Privacy Policy and Personal Data Protection

This Privacy Policy describes how "GREEN DROPS" EOOD collects, uses, stores and protects the personal data of visitors and customers of the website green-drops.com (the "Site"). The Policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation — GDPR), the Personal Data Protection Act (ZZLD) and the applicable Bulgarian and European legislation.

1. Data Controller

• Name: "GREEN DROPS" EOOD
• Email for questions regarding personal data: info@green-drops.com
• Phone: +359 885 031 122

The Company is not required to appoint a Data Protection Officer (DPO), as it does not carry out large-scale systematic monitoring or large-scale processing of special categories of data. All inquiries should be directed to the contacts listed above.

2. What Personal Data We Process

2.1. Data Provided When Placing an Order

• first and last name (or full name);
• phone number;
• email address (optional);
• delivery address or selected "Econt" courier office;
• order contents, value and any notes to the order;
• date and time the request was submitted.

2.2. Data Provided for a Back-in-Stock Request

• name, phone number, email (optional), desired quantity and note.

2.3. Data Provided When Contacting Us

• name, email, phone number and the content of your message.

2.4. Technical Data

• IP address, browser and device type, access time and technical information necessary for the security and proper functioning of the Site;
• data from strictly necessary cookies (see the Cookie Policy).

We do not collect or store bank card data. Payment is made exclusively by cash on delivery upon receipt of the shipment. The Site does not support user accounts or passwords for customers, and therefore we do not process customer authentication data.

We do not knowingly process special categories of personal data (health data, etc.). Please do not send us such information in the free-text fields of your order or messages.

3. Purposes and Legal Grounds for Processing

• Order fulfillment and delivery — legal basis: Art. 6(1)(b) GDPR (performance of a contract or steps taken at the request of the data subject prior to entering into a contract).
• Back-in-stock requests — legal basis: Art. 6(1)(b) GDPR (pre-contractual steps taken at your request).
• Accounting and tax reporting — legal basis: Art. 6(1)(c) GDPR (legal obligation under the Accountancy Act and tax legislation).
• Handling complaints and exercising the right of withdrawal — legal basis: Art. 6(1)(b) and (c) GDPR.
• Security of the Site, prevention of abuse and establishment, exercise or defense of legal claims — legal basis: Art. 6(1)(f) GDPR (legitimate interest).
• Responding to inquiries — legal basis: Art. 6(1)(f) GDPR (legitimate interest in answering the questions raised).

Providing your name, phone number and delivery address is a necessary condition for concluding and performing the distance sales contract. If you refuse to provide them, the order cannot be fulfilled.

4. Recipients and Categories of Recipients

Your personal data may be disclosed only to the following categories of recipients:

• Courier company "Econt Express" OOD — for delivery of the shipment and collection of the cash-on-delivery amount (a recipient acting as an independent controller for the purposes of the courier service);
• Hosting and cloud infrastructure provider — a processor storing the Site's database within the EU;
• Email delivery service provider — a processor used for the purpose of notifying us of new orders;
• Accounting firm — a processor for the purposes of accounting services;
• Competent state authorities — where required by law.

Data processing agreements under Art. 28 GDPR have been or will be concluded with all processors. We do not sell or rent personal data to third parties.

5. Transfers of Data Outside the EU/EEA

As a rule, data is processed within the territory of the European Union. Should any provider process data outside the EU/EEA, the transfer will only take place where there is a European Commission adequacy decision or appropriate safeguards under Art. 46 GDPR (e.g. standard contractual clauses), regarding which you may obtain further information upon request.

6. Retention Periods

• Order and accounting data — 5 (five) years from the beginning of the year following the year in which the order was fulfilled, while accounting ledgers and financial statements — 10 (ten) years pursuant to Art. 12 of the Accountancy Act;
• Back-in-stock requests — up to 12 months from submission;
• Correspondence regarding inquiries — up to 12 months after the correspondence ends;
• Data related to complaints — 3 years from closing of the case;
• Technical security logs — up to 12 months.

After the above periods expire, the data is irreversibly deleted or anonymized.

7. Your Rights as a Data Subject

• Right of access (Art. 15 GDPR) — to obtain confirmation of whether we process your data and a copy of it;
• Right to rectification (Art. 16 GDPR) — to request correction of inaccurate or incomplete data;
• Right to erasure ("right to be forgotten") (Art. 17 GDPR) — unless we are legally obliged to retain it;
• Right to restriction of processing (Art. 18 GDPR);
• Right to data portability (Art. 20 GDPR) — to receive your data in a structured, commonly used and machine-readable format;
• Right to object (Art. 21 GDPR) — to processing based on legitimate interest;
• Right to withdraw consent — where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• Right not to be subject to automated decision-making — we do not carry out automated decision-making, including profiling, that produces legal effects concerning you.

These rights are exercised by means of a free-form written request sent to info@green-drops.com or to our registered address. We respond within 1 month, which may, if necessary, be extended by a further 2 months, of which you will be notified. The service is free of charge, except for manifestly unfounded or excessive requests.

8. Right to Lodge a Complaint

If you believe your rights have been violated, you have the right to lodge a complaint with the Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, phone +359 2 915 3 518, email kzld@cpdp.bg, website www.cpdp.bg, as well as with the competent court.

9. Data Security

• encrypted connection (HTTPS/TLS) for all communication with the Site;
• storage of data in a secure database with restricted access;
• the admin panel is protected with a password, limits on failed login attempts and secure session cookies (HttpOnly, Secure, SameSite);
• access to the data limited to employees and processors for whom it is necessary;
• regular software updates and measures against unauthorized access.

10. Children

The Site is not intended for persons under 18 years of age and we do not knowingly collect personal data of children. If we discover that we have received a child's data without the consent of the holder of parental responsibility, we will delete it immediately.

11. Cookies

The Site uses only strictly necessary cookies for the operation of the shopping cart and the protection of the admin panel. For details, see the Cookie Policy.

12. Changes to the Policy

We reserve the right to update this Policy. The current version is always available on this page, together with the date of the last update. In the event of material changes, we will publish a notice in a prominent place on the Site.