Privacy Policy

Introduction
The security and proper use of personal data is of utmost importance to us.

This Privacy Policy forms an integral part of the Terms and Conditions located at: https://hta.bg/tos . It does not regulate rights and obligations, but aims to explain to users what personal data we process in connection with the provision of goods and services, why and how we process it, including when it is necessary to disclose personal data to third parties. It also provides information about the rights that users have in relation to the processing of personal data by HTA Ltd.

For clarity and for the convenience of users, examples are provided in many places in this Privacy Policy to illustrate why and/or how HTA Ltd processes users’ personal data. These examples are not part of this Privacy Policy and are not exhaustive.

Basic principles for processing personal data

  1. We process personal data lawfully, fairly and in a transparent manner;
  2. We process personal data for specific, explicit and legitimate purposes and do not further process it in a manner incompatible with those purposes;
  3. The personal data processed is appropriate, relevant and limited to what is necessary in relation to the purposes for which it is processed (“data minimisation“);
  4. The personal data processed can be kept up to date at all times by taking all reasonable steps to ensure that inaccurate personal data is erased or rectified in a timely manner, taking into account the purposes for which it is processed (“accuracy”).
  5. Personal data processed by us are stored in a form which permits identification of the data subject for no longer than is necessary for the purposes for which the personal data are processed (“storage limitation”)
  6. The personal data we process is stored in a manner that ensures an adequate level of security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (“integrity and confidentiality”);

Data Controller
Personal data controller is “HTA” Ltd, with UIC BG20 358 6467, registered office and registered address in. HTA, with registered office at 1000 Sofia Str. 7A “Otdih”.
If you have any privacy questions at HTA Ltd or would like to contact us regarding a privacy issue, you may contact our Privacy Officer at info@hta.bg . This Privacy Policy may be amended in accordance with national and European legislation. Any change shall take effect from the time of publication on this page. We encourage you to check our website frequently to see the latest changes. Our privacy policy will not be changed in a way that would allow less protection of the personal data of our customers and users without their written consent.

 

What personal data we process
We collect your personal data to enable us to provide our goods and services and to continuously improve them.

 Here are the types of information we collect:

  1. Information you provide to us: we receive and store any information you provide in connection with HTA Ltd’s services. For example: information relating to searches on the platform, orders placed by you, your customer profile, e-mail, telephone, address, enquiries, requests for access to personal information, etc.
  2. Automatic information: we automatically receive and store certain types of information when you use the HTA Ltd website, such as: information about your use of the site, including your interaction with the content and services available through the site. Like many websites, we use cookies and other unique identifiers and receive certain types of information when your web browser or device accesses the site.

For example: the Internet Protocol (IP) address used to connect your computer or other device to the Internet; e-mail and password; computer, device, and connection information, such as device type and application version or browser type, browser plug-in types and versions, operating system, or time zone setting; the location of your device or computer; content interaction information, such as content downloads, streams, and playback details, including duration and number of simultaneous We may also use device identifiers, cookies and other technologies on devices, applications and web pages to collect browsing, usage or other technical information for fraud prevention purposes.

  1. Information from other sources: we may obtain information about you from other sources such as: information about the delivery of goods purchased through the site, information about the number of page views.

What are cookies?
In order to provide our services and to successfully deliver each of the products offered on the site, we use cookies. For more information about cookies and how we use them, please read our Cookie Policy.

 

On what basis we collect and process your personal data?
We collect and process your personal data lawfully and in accordance with this Policy and the Terms and Conditions.  We process data where you have given your explicit consent to the processing of personal data, or the processing is necessary for the performance of a contract to which you are a party, or to take steps at your initiative before entering into a contract (which step is deemed to be the simple use of the site without the need to have made a purchase order). The processing of data is also necessary for the purposes of our legitimate interest, namely: where without processing certain types of data we would not be able to provide our services and enter into a contract for the purchase of any of the goods on the site, to improve the site and our customer service and to bring value to our users.

For example, the collection of information about searches on the site, its use and the analysis of this data is our legitimate interest because it is a key method of determining the quality of our services and goods. Due to the existence of the above grounds for collecting and processing personal data, in the event that you consider that you do not wish to provide HTA Ltd with the personal data necessary to enter into a Purchase Agreement, HTA Ltd will be in a de facto position of being unable to provide you with its goods.

Purposes of personal data processing.
We process your personal data in order to provide and improve the goods and services on the website. These purposes include:

  1. We use your personal information to take and handle orders, deliver products and services, make payments and communicate with you about orders, products, services and promotional offers. Provide, troubleshoot and improve the services of HTA Ltd.
  2. We use your personal data to provide functionality, analyse performance, correct errors and improve the usability and performance of the site. Testimonials and personalization.
  3. We use your personal data to recommend features, products and services that may be of interest to you, to identify your preferences and to personalize your experience on the site.
  4. Compliance with statutory obligations. In some cases, we have a legal obligation to collect and process your personal data. For example We process personal data to comply with obligations arising under accounting and tax legislation.
  5. To carry out communication. We use your personal data to communicate with you in relation to the goods and services we provide through various channels (e.g. telephone, email, chat). To prevent fraud and credit risks.
  6. We process personal information to prevent and detect fraud and abuse in order to protect the security of our customers.
  7. Purposes for which we seek your consent. We may also seek your consent to process your personal data for a specific purpose that we communicate to you. Where you have consented to us processing your personal information for a particular purpose, you may withdraw your consent at any time and we will stop processing it. However, the same does not apply if the processing is necessary for another lawful purpose.

Categories of persons to whom we disclose users’ personal data.
Information about our customers is an important part of our business and we do not sell it to third parties. “HTA Ltd may share our customers’ personal information (or some of it) only as described below and with third parties who follow practices that are at least as protective as those described in this Privacy Policy. “HTA Ltd may share personal information of its customers with third parties who are processors of personal data. Data processors are persons who process personal data on behalf of and on behalf of HTA Ltd on the basis of a written agreement. They may not process the personal data provided to them for purposes other than the performance of the work assigned to them by HTA Ltd. The processors shall comply with all instructions of HTA Ltd. “HTA Ltd shall take the necessary measures to ensure that the processors involved comply strictly with data protection legislation and HTA Ltd’s instructions, and that they have taken appropriate technical and organisational measures to protect personal data.

Examples of personal data processors are:

  • Courier service providers;
  • Information systems implementation and/or maintenance service providers, who sometimes need to access personal data processed in the relevant systems for the purposes of providing the services;
  • Hosting service providers.

“HTA Ltd. may share personal information of clients and law firms, accounting firms or other providers of consulting services when the same is necessary for the conduct of the business of HTA Ltd., in the event of a dispute or for optimization purposes;

HTA Ltd may share personal information of its customers with banks and payment institutions. In connection with the servicing of consumer payments made by bank transfer or through a payment institution, it is necessary to exchange data between HTA Ltd. and the relevant bank or payment institution.

Third parties in connection with a reorganisation (e.g. merger or amalgamation) or transfer of an undertaking. In the event of a reorganisation of HTA Ltd, as well as in the event of a transfer of assets in accordance with applicable law, it is possible that the personal data of users administered by HTA Ltd may be provided to a third party successor.

Competent authorities. The legislation of the Republic of Bulgaria requires HTA Ltd to store certain personal data about users for a certain period of time. In the presence of legally established prerequisites, these personal data processed by HTA Ltd. should be provided to the competent authorities.

What methods we use to keep your personal information secure?
We work hard to protect the security of your information during transmission by using a Secure Sockets Layer (SSL) certificate that encrypts the information you enter.

 Alongside the above, we maintain physical, technical and procedural safeguards in relation to the collection, storage and disclosure of your personal data. Our security procedures mean that we may sometimes ask for proof of identity before disclosing personal information to you.

Devices on which your personal information is stored offer security features to protect it from unauthorized access and data loss.

It is important to protect yourself against unauthorized access to your password and to your computers and devices. Remember to log out of your account when you are finished using a shared computer.

 

How long we keep your personal data?
“HTA Ltd. retains users’ personal data for as long as necessary to achieve the purposes set out in this Privacy Policy or to comply with the requirements of the legislation.

For example: in order to comply with our obligations under tax and accounting legislation, data on purchases by a user is stored for a period of 12 years.

After the expiry of the processing periods, personal data is anonymised or deleted/destroyed unless:

  • a necessary for pending judicial, arbitration, administrative or enforcement proceedings, or where a complaint has been received from the relevant user which is to be considered by HTA Ltd; or
  • the user concerned has exercised his/her right to request the restriction of the processing of personal data concerning him/her;

HTA Ltd endeavours to ensure that the personal data processed about users is kept up to date (and where necessary corrected) and that no data is stored which is not necessary for the purposes described above.

General information on the rights of natural persons.
“HTA Ltd shall only act on a request from an individual to exercise a right under this section if it is able to identify the individual.

Only individuals who can be identified by HTA Ltd. are able to exercise their rights under this section. If the purposes for which HTA Ltd processes personal data do not require or no longer require the identification of an individual, HTA Ltd is under no obligation to maintain, acquire or process additional information to identify the individual for the sole purpose of acting on that individual’s request.

“HTA Ltd. shall notify individuals of the action taken within one month of receipt of a request under this section, in certain cases this period may be extended by up to two months.

“HTA Ltd. shall provide individuals with information on the action taken in relation to their requests to exercise rights under this section without undue delay and in any event within one month of receipt of the request. Where necessary, this period may be extended by a further two months, taking into account the complexity and number of requests. “HTA Ltd shall inform the person concerned of any such extension within one month of receipt of the request, giving the reasons for the delay.

If a request is refused, HTA Ltd shall inform the individuals concerned of their rights.

If HTA Ltd. does not act on an individual’s request, HTA Ltd. shall inform the individual without delay and at the latest within one month of receipt of the request of the reasons for not acting, as well as of the possibility of lodging a complaint with the Data Protection Commission and seeking judicial redress.

In certain cases, HTA Ltd may request additional information to confirm the identity of individuals

In the event that HTA Ltd has a reasonable concern about the identity of an individual making a request under this section, HTA Ltd may request the provision of additional information necessary to confirm the individual’s identity.

Actions taken by HTA Ltd. in response to and in connection with requests made to exercise rights under this section are completely free of charge to individuals unless their requests are manifestly unfounded or excessive. Where a person’s request is manifestly unfounded or excessive (for example, because of its repetitive nature), HTA Ltd may, at its discretion: (a) refuse to comply with the request; or (b) charge a reasonable fee based on the administrative costs of providing the information requested or taking the action requested.

Users have the right to:

  1. To access personal data relating to them.

Users have the right to obtain information from HTA Ltd about whether personal data relating to them is being processed. If so, users have the right to access the relevant data.

  1. Correction of inaccurate or outdated personal data

If the personal data processed by HTA Ltd. is inaccurate or outdated, users have the right to request HTA Ltd. to correct it.

  1. Erasure of my personal data (“Right to be forgotten”).

Users have the right to request HTA Ltd to delete personal data relating to them in the following cases:

  • the personal data are no longer necessary for the purposes for which they were collected or processed;
  • the user has withdrawn his or her consent on which the processing of personal data is based and there is no other legal basis for the processing;
  • the user has objected to the processing of personal data which is based on a legitimate interest of HTA Ltd, unless there are other legitimate grounds for the processing which override the interests, rights and freedoms of the user, or the processing is necessary for the establishment, exercise or defence of legal claims;
  • the user has objected to the processing of personal data for direct marketing purposes and there are no other legitimate grounds for processing such data;
  • the personal data relating to the user have been unlawfully processed;
  • the personal data must be erased by HTA Ltd. in order to comply with a legal obligation under Bulgarian or European Union law.

Restricting the processing of my personal data.
As of 25.05.2018, users have the right to request HTA Ltd. to restrict the processing of their personal data in the following cases:

  • the accuracy of the personal data is contested by the user, for a period that allows “HTA” Ltd. to verify the accuracy of the personal data;
  • the processing is unlawful, but the user does not wish the personal data to be erased, but requests instead the restriction of its use;
  • HTA Ltd no longer needs the personal data for the purposes of the processing, but the user requires it for the establishment, exercise or defence of legal claims;
  • the user has objected to processing based on a legitimate interest of HTA Ltd, pending verification that HTA Ltd’s legitimate grounds override HTA Ltd’s interests.

 

Portability of my personal data.
As of 25.05.2018, users have the right to obtain from HTA Ltd. the personal data they have provided in a structured, widely used and machine-readable format, as well as to transfer this data to another controller without hindrance from HTA Ltd., as long as:

  • HTA Ltd. processes these data for the purpose of concluding or performing a contract with the user, or on the basis of consent given by the latter ; and
  • the processing of the relevant data is carried out in an automated manner

Users have the right to request HTA Ltd to transfer their personal data directly to another controller where this is technically feasible.

 

Objection to the processing of personal data.
Users have the right, at any time and on grounds relating to their particular situation, to object to the processing of personal data concerning them when HTA Ltd processes their data for the protection of its legitimate interests.

In certain cases, this right is unconditional and HTA Ltd will always suspend the processing of data when users object.

For example, these are cases where HTA Ltd processes personal data for direct marketing purposes.

In other cases, depending on the nature of the objection and the circumstances put forward by the user concerned, HTA Ltd will carry out an internal check on the objection and decide on it in accordance with this section by: (a) notifying the user that it will suspend the processing of his/her personal data; or (b) reasonably refusing to suspend the processing of his/her personal data where there is a lawful basis for doing so.

The right to access, rectify, erase, restrict processing and portability of your personal data can be done through our built-in GDPR module.

Right of appeal to a supervisory authority.
Users have the right to lodge complaints or alerts with the Commission for Personal Data Protection (CPDP) in case they believe that HTA Ltd. violates personal data protection legislation. Instructions for filing complaints are published on the CPPD website https://www.cpdp.bg

 

After 25.05.2018, users may also lodge complaints with other supervisory authorities in the territory of the European Union, as provided for in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) or also referred to as “GDPR”.

Shopping Cart