Privacy Policy
Mandatory Information on Personal Data Protection Rights
Information about the company processing your data
Name: Metamorfosis LTD
Company Registration Number/BULSTAT: BG203364934
Headquarters and Address: Sofia, Oborishte Street 3
Correspondence Address: Sofia, Oborishte Street 3
Email: office@lusciouswear.co
Website: www.lusciouswear.co
Information about the Competent Data Protection Supervisory Authority
Name: Commission for Personal Data Protection
Headquarters and Address: Sofia 1592, Prof. Tsvetan Lazarov Blvd. No. 2
Correspondence Address: Sofia 1592, Prof. Tsvetan Lazarov Blvd. No. 2
Phone: +359 2 915 3 518
Website: www.cpdp.bg
Metamorfosis LTD (hereinafter referred to as the "Administrator" or the "Company") operates in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council from 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. This information is intended to inform you about all aspects of the processing of your personal data by the Company and the rights you have in relation to this processing.
Legal Grounds for Collecting, Processing, and Storing Your Personal Data
Article 1. The Administrator collects and processes your personal data in connection with the use of the online store www.lusciouswear.com and for the conclusion of contracts with the company based on Article 6, Paragraph 1 of Regulation (EU) 2016/679 (GDPR), specifically on the following grounds:
- Explicit consent given by you as a client;
- Fulfillment of the Administrator's obligations under its contract with you;
- Compliance with the legal obligation applicable to the Administrator;
- For the legitimate interests of the Administrator or a third party.
Purposes and Principles for Collecting, Processing, and Storing Your Personal Data
Article 2. (1) We collect and process personal data that you provide in connection with the use of the online store and the conclusion of your contract with the company, for the following purposes among many:
- Creating a profile and providing full access to the online store;
- Concluding and executing the remote contract;
- Identification of the party to the contract;
- Accounting purposes;
- Statistical purposes;
- Protection of information security;
- Ensuring the fulfillment of the service provision contract;
- Sending a newsletter at your request.
(2) We adhere to the following principles when processing your personal data:
- Lawfulness, fairness, and transparency;
- Limited to processing purposes;
- Data minimization in accordance with the purposes of processing;
- Accuracy and timeliness of data;
- Storage limitation for achieving the purposes;
- Integrity and confidentiality of processing, ensuring an appropriate level of personal data security.
(3) In processing and storing personal data, the Administrator may do so in order to protect the following legitimate interests:
- Fulfillment of its obligations to the National Revenue Agency, the Ministry of the Interior, and other state and municipal bodies.
Types of Personal Data Collected, Processed and Stored by Our Company
Article 3. (1) The company performs the following operations with the provided personal data for the purposes of:
- Registration of the user in the online store and execution of a distance sales contract – the purpose of this operation is to create a profile so as to use the online store for the purchase goods and to provide contact details for the delivery of the purchased goods. Registration and profile creation for the use of the online store is not a mandatory step in the service provision. To a great extent the service is available without creating a profile.
- Impact Assessment Summary: based on the conducted impact assessment, the operation "User Registration in the Online Store and Execution of Distance Sales Contract" is permissible and provides adequate guarantees of the protection of the rights and legitimate interests of the data of the subjects in compliance with GDPR requirements.
- Conclusion and execution of a commercial transaction with a customer or partner – the purpose of this operation is to conclude and execute a contract with a commercial partner or customer and its administration. Given the limited scope of collected personal data and the fact that some is accessible from public sources, in such a case an impact assessment is not required.
- Sending a newsletter – the purpose of this operation is to administer the process of sending newsletters to customers who have expressed their desire to receive such information. Given the limited scope of collected personal data, in this case an impact assessment is not required.
- Exercising the right to withdrawal or registering a complaint – the purpose of this operation is to administer the process of exercising the customer's right to withdrawal or registering a complaint. Given the limited scope of collected personal data, an impact assessment is not required.
(2) The Administrator processes the following categories of personal data and information for the purpose of and on the grounds of:
- Personally identifiable information (email, name, etc.)
Purpose: 1) Contacting the user and sending information; 2) user registration in the online store and 3) sending a newsletter.
Legal Grounds: Upon acceptance of the terms and conditions of the online store or by placing an order without registration, or upon the conclusion of a written contract, a contractual relationship is created between the Administrator and you, on the basis of which we process your personal data – according to Article 6, Paragraph 1, (b) GDPR. Your newsletter data is processed based on your explicit consent – according to Article 6, Paragraph 1, (a) GDPR.
- Delivery information (name, phone number, address, etc.)
Purpose: Fulfillment of the Administrator's obligations under a sales contract and delivery of purchased goods.
Legal Grounds: With the acceptance of the terms and conditions and registration in the online store or placing an order without registration, or upon the conclusion of a written contract, a contractual relationship is created between the Administrator and you, on the basis of which we process your personal data – in adherence with Article 6, Paragraph 1, (b) GDPR.
- Additional data provided by you – You may choose to provide additional data, such as your full name or phone number to complete your profile.
Purpose: To complete your profile information in your user account.
Legal Grounds: You have given explicit consent for processing your personal data for one or more specific purposes – in accordance with Article 6, Paragraph 1, (a) GDPR. Providing this data is optional for registration in the online store.
(3) The Administrator does not collect or process personal data related to:
- Racial or ethnic origin;
- Political, religious, or philosophical beliefs, or union membership;
- Genetic or biometric data, health data, or sexual orientation data.
(4) Personal data is collected by the Administrator from the individuals to whom it pertains.
(5) The company does not engage in automated decision-making using personal data.
Article 4. (1) The company performs the following operations with personal data provided by you, as legal representatives or proxies of legal entities-partners, for the following purposes:
- Conclusion and execution of a commercial transaction: For the conclusion and execution of a commercial transaction with a business entity, we only process the full name of the legal representative or the person authorized by the company.
**Impact Assessment Conclusion:** Due to the limited number of individuals whose data is processed and the limited scope of collected personal data, conducting an impact assessment is not required.
(2) Personal data is collected by the Administrator from the individuals to whom it pertains and from the Commercial Register at the Registry Agency.
(3) The company does not engage in automated decision-making using this personal data.
Article 5. The Administrator may use cookies to provide full website functionality, enhance user experience, for statistical purposes, easier access, etc., with which you agree by using our website. You can manage and/or delete cookies at any time through your browser settings. Cookies are not considered personal data and are not used to identify visitors or users of the online store.
Retention Period of Your Personal Data
Article 6. (1) The Administrator retains your personal data for no longer than the duration of your account in the online store. Once your account is deleted, the Administrator takes the necessary steps to erase and destroy all your data without undue delay or to anonymize it (i.e., make it non-identifiable).
(2) The Administrator processes your personal data provided when placing an order without account registration until the order is fulfilled, unless you have given explicit consent during the ordering process for your data to be processed for the purposes of service improvement, personalized content, promotions, or statistical purposes.
(3) The Administrator retains your personal data provided in connection with online orders for 5 years to protect its legal interests in case of legal or administrative disputes with users of the online store.
(4) The Administrator will notify you if the retention period needs to be extended due to legal obligations or legitimate interests of the Administrator or other reasons.
(5) The Administrator stores personal data required by applicable law for the relevant period, which may exceed the duration of your account or the completion of your order.
Article 7. The Administrator retains the personal data of the legal representatives of its business partners for the duration of the contract, to meet the legitimate interests and legal obligations of the Administrator, which may exceed the contract's term.
Transfer of Your Personal Data for Processing
Article 8. (1) The Administrator may, at their discretion, transfer part or all of your personal data to processors for the purposes of processing, with your consent and in compliance with the requirements of Regulation (EU) 2016/679 (GDPR).
(2) The Administrator will notify you in case of intent to transfer part or all of your personal data to third countries or international organizations.
Your Rights Regarding the Collection, Processing, and Retention of Your Personal Data
Withdrawal of Consent for the Processing of Your Personal Data
Article 9. (1) If you no longer wish for your personal data to be processed for marketing purposes or to receive newsletters, you may withdraw your consent at any time by completing the withdrawal form in Appendix No. 1 or by submitting a request via email.
(2) Upon receiving your request, we will send you an email with detailed instructions on how to verify your identity as the recipient of the newsletters and the data subject whose consent is being withdrawn.
(3) Withdrawal of consent does not affect the lawfulness of personal data processing carried out by the Administrator up to that point.
Right of Access
Art. 10. (1) You have the right to request and receive confirmation from the Administrator whether your personal data is being processed by sending a request via email.
(2) You have the right to access the data related to you, as well as to information regarding the collection, processing, and retention of your personal data.
(3) After receiving your request, we will send you an email to the address you used for registration or for placing orders in the online store, with detailed instructions on how to verify your identity as the data subject requesting access.
(4) After verification, as per para. 3, the Administrator will provide you, upon request, with a copy of the processed personal data related to you in electronic or another appropriate form.
-
Access to the data is provided free of charge, but the Administrator reserves the right to impose an administrative fee in cases of repetitive or excessive requests.
Right to Rectification or Completion
Article 11. (1) You may, at any time, correct or complete inaccurate or incomplete personal data related to you through the "Edit Profile" option.
(2) You may rectify or complete inaccurate or incomplete personal data related to you directly through your profile on the website or by sending a request to the Administrator via email, using the form in Appendix No. 4 or through a request.
Right to Erasure ("Right to be Forgotten")
Article 12. (1) You have the right to request the Administrator to delete some or all of the personal data related to you, and the Administrator is obligated to delete them without undue delay when one of the following grounds applies:
- The personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
- You withdraw your consent, which is the basis for processing, i.e. there is no other legal basis for processing;
- You object to the processing of your personal data, including for direct marketing purposes, and there are no overriding legitimate grounds for processing;
- The personal data was unlawfully processed;
- The personal data must be erased to comply with a legal obligation under EU or Member State law that applies to the Administrator;
- The personal data was collected in connection with the provided services of the information society.
(2) The Administrator is not required to erase the personal data if they are being stored and processed:
- In the name of the right to freedom of expression and information;
- In compliance with the legal obligationof requiring processing under EU or Member State law, that applies to the Administrator, or for the performance of a task carried out in the public interest or in executing the official authority vested in the Administrator;
- In the public interest when pertaining to the public health;
- For archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes;
- For the establishment, execution, or defense of legal claims.
(3) To exercise your right to be forgotten, you need to send an email request for the deletion of your personal data processed by the Administrator, by filling out the form in Appendix No. 2 or through a free-text request. The Administrator will then send detailed instructions for your verification as a user of the store and a data subject for whom the deletion request has been made to the email used for registration or ordering in the online store.
(4) After verifying the identity of the person making the request and the person to whom the data relates, in accordance with the instructions provided to you, we will delete all data we process about you, in accordance with paragraph 3.
(5) If you have an order in process, the earliest you can request to be "forgotten" is after the successful completion of the order.
Right to Restriction
Article 13. You have the right to request the Administrator to restrict the processing of your data by sending a request via email when:
- You contest the accuracy of the personal data, for a period enabling the Administrator to verify the accuracy of the personal data;
- The processing is unlawful, but you do not want the personal data to be erased, only their use restricted;
- The Administrator no longer needs the personal data for processing purposes, but you request it for the establishment, exercise, or defense of legal claims;
- You have objected to processing pending verification of whether the Administrator's legitimate grounds override your interests.
(2) After receiving your request, we will send detailed instructions for verification to the email used for registration or ordering in the online store, to verify you as a user and the data subject whose processing is requested to be restricted.
(3) After completing the verification under paragraph 2, the Company will cease processing your data but will not remove any posts you have made in the online store, if any exist.
Right to Data Portability
Article 14. (1) If you have consented to the processing of your personal data, or the processing is necessary for the performance of a contract with the Administrator, or if your data is processed by automated means, you may:
- Request that the Administrator provide your personal data in a readable format for transfer to another Administrator;
- Request that the Administrator directly transfer your personal data to an Administrator specified by you, when technically feasible.
(2) You may exercise your right to data portability by sending an email with the completed form from Appendix No. 3 or a written request. The Administrator will then send detailed instructions for verification to the email you used for registration or ordering in the online store.
(3) After completing the verification under paragraph 2, the Company will send the data it processes about you in XML format to the email address you specified.
Right to Receive Information
Article 15. You may request the Administrator to inform you about all recipients whose personal data, for which rectification, deletion, or restriction of processing was requested, have been disclosed. The Administrator may refuse to provide this information if it is impossible or would require disproportionate effort.
Right to Object
Article 16. You may object at any time to the processing of personal data by the Administrator related to you, including if the data are processed for profiling or direct marketing purposes.
Your Rights in Case of a Personal Data Breach
Article 17. (1) If the Administrator identifies a personal data breach that may result in a high risk to your rights and freedoms, they will notify you without undue delay of the breach, as well as of the measures that have been taken or are to be taken.
(2) The Administrator is not required to notify you if:
- Appropriate technical and organizational measures have been taken to protect the data affected by the breach;
- Measures have been taken afterward to ensure that the breach will not result in a high risk to your rights;
- Notification would require disproportionate effort.
Entities to Whom Your Personal Data May Be Provided
Article 18. (1) For the purposes of processing your personal data and providing the service in its full functionality, and in view of your interests, the Administrator may provide the data to the following data processors:
|
Data Processor |
Purpose of Personal Data Processing |
|
GombaShop.bg („Гомба ЕООД“) – Bulgaria |
Hosting of the online store, technical support, and platform maintenance |
|
Unicredit BulBank |
Processing of online payments |
|
Courier services (TNT, Econt) |
Delivery of purchased products |
(2) The data processors comply with all legal and security requirements when processing and storing your personal data.
Article 19. The Administrator does not transfer your data to third countries.
Article 20. In case of violation of your rights according to the above or applicable data protection legislation, you have the right to file a complaint with the Commission for Personal Data Protection as follows:
- Name: Commission for Personal Data Protection
- Headquarters and address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
- Correspondence address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
- Phone: +359 2 915 3 518
- Website: www.cpdp.bg
Article 21. You may exercise all your rights regarding the protection of your personal data through the forms attached to this information. However, these forms are not mandatory, and you can submit your requests in any format that contains a statement to that effect and identifies you as the data owner.
Article 22.If consent relates to a transfer, the Administrator will describe the potential risks of transferring data to third countries in the absence of an adequate protection decision and appropriate safeguards.
Appendix No. 1
Form for Withdrawal of Consent for Processing Purposes
Your name: ....................................
Your email used in the online store: ....................................
Contact information (email): ....................................
To:
Name: ....................................
Company ID/BULSTAT: ....................................
Headquarters and address: ....................................
Correspondence address: ....................................
Phone: ....................................
Email: ....................................
Website: ....................................
By this, I withdraw my consent for the processing of the personal data I have provided for the purposes of receiving newsletters, promotional messages, or other marketing materials. I acknowledge the conditions for withdrawing consent in accordance with the Mandatory Information on the Rights of Data Subjects regarding the protection of personal data of the online store.
In case of violation of your rights according to the above or applicable data protection legislation, you have the right to file a complaint with the Commission for Personal Data Protection as follows:
- Name: Commission for Personal Data Protection
- Headquarters and address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
- Correspondence address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
- Phone: +359 2 915 3 518
-
Website: www.cpdp.bg
Appendix No. 2
Request to "Be Forgotten" – for the Deletion of Personal Data Related to Me
Your Name: ....................................
Your Email Address Used for Registration or Orders in the Online Store: ....................................
Contact Information (email): ....................................
To:
Name: ....................................
Company ID/BULSTAT: ....................................
Headquarters and Address: ....................................
Correspondence Address: ....................................
Phone: ....................................
Email: ....................................
Website: ....................................
I hereby request that all personal data collected, processed, and stored by you, either provided by me or by third parties related to me, as per the above identification, be deleted from your databases.
I declare that I am aware that part or all of my personal data may continue to be processed and stored by the administrator for the purpose of fulfilling their legal obligations.
In case of a violation of your rights under the above or applicable data protection legislation, you have the right to file a complaint with the Commission for Personal Data Protection as follows:
- Name: Commission for Personal Data Protection
- Headquarters and Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
- Correspondence Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
- Phone: +359 2 915 3 518
- Website: www.cpdp.bg
Appendix No. 3
Request for Data Portability
Your Name: ....................................
Your Email Address Used for Registration or Orders in the Online Store: ....................................
Contact Information (email): ....................................
To:
Name: ....................................
Company ID/BULSTAT: ....................................
Headquarters and Address: ....................................
Correspondence Address: ....................................
Phone: ....................................
Email: ....................................
Website: ....................................
I hereby request that all personal data related to me, collected, processed, and stored in your databases, be sent in XML format to:
Email: ....................................
Receiving Data Administrator: ....................................
Name: ....................................
Identification Number (Company ID, BULSTAT, Registration Number in the Commission for Personal Data Protection): ....................................
Email: ....................................
In case of a violation of your rights under the above or applicable data protection legislation, you have the right to file a complaint with the Commission for Personal Data Protection as follows:
- Name: Commission for Personal Data Protection
- Headquarters and Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
- Correspondence Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
- Phone: +359 2 915 3 518
-
Website: www.cpdp.bg
Appendix No. 4
Request for Data Correction
Your Name: ....................................
Your Email Address Used for Registration or Orders in the Online Store*: ....................................
Contact Information (email)*: ....................................
To:
Name: ....................................
Company ID/BULSTAT: ....................................
Headquarters and Address: ....................................
Correspondence Address: ....................................
Phone: ....................................
Email: ....................................
Website: ....................................
I kindly request that the following personal data collected, processed, and stored by you, either provided by me or by third parties related to me, be corrected as follows:
Data to be corrected:
..................................................
Please correct it in the following way:
..................................................
In case of a violation of your rights under the above or applicable data protection legislation, you have the right to file a complaint with the Commission for Personal Data Protection as follows:
- Name: Commission for Personal Data Protection
- Headquarters and Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
- Correspondence Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
- Phone: +359 2 915 3 518
- Website: www.cpdp.bg