PRIVACY POLICY
of Yambol Komers Ltd.
1. General Provisions
This Privacy Policy governs the manner in which Yambol Komers Ltd., UIC 838168469, processes the personal data of natural persons when they use the website https://mebelinovdom.com, purchase goods, use the services provided, submit inquiries, file complaints, request warranty service, or otherwise communicate with the Company.
This Privacy Policy applies to all natural persons whose personal data is processed by Yambol Komers Ltd., including:
visitors to the website;
customers;
registered users;
individuals submitting inquiries;
individuals submitting complaints;
individuals requesting warranty services;
individuals using the contact forms;
individuals applying for employment through the website.
2. Data Controller
The Controller of personal data is:
Yambol Komers Ltd.
UIC: 838168469
Registered office and business address:
1 Industrialna Street, Yambol 8600, Bulgaria
Telephone:
+359 878 796 263
E-mail:
admin@mebelinovdom.com
Website:
https://mebelinovdom.com
3. Data Protection Contact
As of the date of adoption of this Privacy Policy, the Company has not appointed a Data Protection Officer (DPO), as it is not legally required to do so under Article 37 of Regulation (EU) 2016/679 (GDPR).
Any questions concerning the processing of personal data may be addressed to:
admin@mebelinovdom.com
4. Principles of Personal Data Processing
Yambol Komers Ltd. processes personal data in accordance with the principles set out in Article 5 of Regulation (EU) 2016/679 (GDPR), namely:
lawfulness, fairness and transparency;
purpose limitation;
data minimisation;
accuracy;
storage limitation;
integrity and confidentiality;
accountability.
The Company processes only those personal data that are necessary for the specific purposes described in this Privacy Policy.
5. Categories of Personal Data Processed
Depending on the service used, the Company may process the following categories of personal data.
5.1 Identification Data
full name;
first and last name;
company name (where applicable);
company registration number (UIC) and VAT number (for legal entities).
EGN / Personal Identification Number (only when choosing the “instalments / on credit” payment method);
5.2 Contact Details
telephone number;
e-mail address;
delivery address;
billing address.
5.3 Order Information
purchased products;
quantity;
purchase value;
payment method;
delivery method;
order date;
order number;
purchase history.
5.4 Warranty Service and Complaint Data
description of the issue;
warranty certificate number;
invoice or receipt number;
photographs provided by the customer;
correspondence relating to the complaint.
5.5 Communication Data
When contacting the Company via the contact form, e-mail or telephone, the following personal data may be processed:
name;
telephone number;
e-mail address;
content of the message;
date and time of communication;
correspondence history.
5.6 Technical Information
When visiting the website, the following technical information may be processed automatically:
IP address;
date and time of access;
browser type;
operating system;
language settings;
device type;
approximate geographic location;
pages visited;
actions performed on the website;
cookie identifiers.
Such information is processed solely for the purposes described in this Privacy Policy.
6. Personal Data That We Do Not Intentionally Process
Yambol Komers Ltd. does not intentionally process special categories of personal data within the meaning of Article 9 GDPR, including:
health data;
biometric data;
genetic data;
racial or ethnic origin;
political opinions;
religious or philosophical beliefs;
trade union membership;
data concerning a person's sex life or sexual orientation.
Should such information be provided voluntarily without being necessary for the requested service, the Company will take appropriate measures to restrict or delete its processing in accordance with the applicable legislation.
7. Purposes of Personal Data Processing
Yambol Komers Ltd. processes personal data solely for specific, explicit and legitimate purposes.
7.1 Performance of a Sales Contract
Personal data is processed for the purposes of:
receiving and processing orders;
confirming orders;
processing payments;
arranging deliveries;
issuing invoices and accounting documents;
fulfilling statutory warranty obligations;
handling customer complaints and warranty claims;
communicating with customers regarding the performance of the contract.
7.2 Customer Account Registration
When creating a customer account, personal data is processed for the purposes of:
creating and maintaining the customer account;
identifying the user;
managing account settings;
storing order history;
facilitating future purchases.
7.3 Contact Form
When an enquiry is submitted through the contact form, personal data is processed for the purposes of:
responding to the enquiry;
providing the requested information;
maintaining subsequent communication where necessary.
7.4 Telephone Enquiries
When customers contact the Company by telephone, personal data may be processed for the purposes of:
providing information;
accepting orders;
arranging deliveries;
providing warranty services;
handling complaints and warranty claims.
7.5 E-mail Communication
Personal data submitted by e-mail is processed solely for the purposes of:
responding to enquiries;
providing customer support;
fulfilling contractual obligations;
maintaining business correspondence.
7.6 Direct Marketing
Where permitted by applicable law and based on an appropriate legal basis, the Company may process personal data for the purposes of:
informing customers about new products;
promotional campaigns;
special offers;
newsletters;
personalised marketing communications.
Where prior consent is required by law, marketing communications will only be sent after such consent has been obtained.
The data subject may withdraw consent at any time without affecting the lawfulness of processing carried out before its withdrawal.
8. Legal Basis for Processing
Personal data is processed only where at least one of the legal bases under Article 6(1) of Regulation (EU) 2016/679 (GDPR) applies.
8.1 Performance of a Contract
Legal basis: Article 6(1)(b) GDPR
Processing is necessary for:
accepting and fulfilling orders;
arranging deliveries;
processing payments;
providing warranty services;
handling complaints;
processing returns;
communicating with customers regarding their orders.
Without the required personal data, the Company may be unable to conclude or perform the contract.
8.2 Compliance with a Legal Obligation
Legal basis: Article 6(1)(c) GDPR
Processing is necessary for compliance with legal obligations arising from applicable legislation, including but not limited to:
the Bulgarian Accountancy Act;
the Bulgarian Value Added Tax Act;
the Bulgarian Tax and Social Security Procedure Code;
the Bulgarian Act on the Supply of Digital Content and Digital Services and on the Sale of Goods;
other applicable legislation.
8.3 Legitimate Interests
Legal basis: Article 6(1)(f) GDPR
Processing may be necessary for the purposes of the legitimate interests pursued by the Company, including:
fraud prevention;
protection of information systems;
prevention of abuse;
improving the quality of services;
protecting the Company's legal rights and interests;
establishing, exercising or defending legal claims.
Where processing is based on legitimate interests, the Company performs an appropriate balancing test between its legitimate interests and the rights and freedoms of the data subject.
8.4 Consent
Legal basis: Article 6(1)(a) GDPR
Where processing is based on consent:
consent is freely given;
specific;
informed;
unambiguous.
The data subject has the right to withdraw consent at any time.
Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
9. Retention Periods
Yambol Komers Ltd. retains personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law.
Online Orders
Personal data relating to online purchases is retained for the period necessary to perform the contract, fulfil statutory warranty obligations and defend potential legal claims.
Accounting Documents
Accounting and tax documents containing personal data are retained for the periods required under the applicable accounting and tax legislation.
Complaints and Warranty Claims
Personal data relating to complaints and warranty claims is retained until the claim has been fully resolved and for any additional period required to establish, exercise or defend legal claims.
Contact Form Enquiries
Personal data submitted through the contact form is retained until the communication has been completed, unless a longer retention period is required by law or justified by another legal basis.
Marketing Data
Personal data processed for marketing purposes is retained until consent is withdrawn or until the applicable legal basis for processing ceases to exist.
Customer Accounts
Personal data relating to registered customer accounts is retained until the account is deleted by the customer or until continued retention is no longer necessary, unless applicable legislation requires otherwise.
10. Is the Provision of Personal Data Mandatory?
The provision of certain personal data is necessary for entering into and performing a sales contract.
Failure to provide the required personal data may prevent the Company from:
accepting an order;
arranging delivery;
issuing an invoice;
fulfilling warranty obligations;
processing complaints or warranty claims;
providing the requested products or services.
11. Recipients of Personal Data
Yambol Komers Ltd. does not sell, rent, or otherwise disclose personal data to third parties unless such disclosure is:
necessary for the performance of a contract;
required by applicable law;
based on another lawful ground under Regulation (EU) 2016/679 (GDPR).
Personal data may be shared with the following categories of recipients:
courier service providers;
payment service providers;
banks and financial institutions;
accounting and auditing service providers;
hosting service providers;
cloud service providers;
IT service providers;
analytics and website performance providers;
advertising and marketing service providers;
competent public authorities where disclosure is required by law.
All recipients are required to process personal data in accordance with the applicable data protection legislation.
12. Courier Service Providers
To perform deliveries, the Company uses courier service providers, including:
Econt Express Ltd.;
Speedy AD;
other courier companies where necessary.
The following personal data may be transferred for delivery purposes:
full name;
telephone number;
delivery address;
parcel details;
cash-on-delivery amount, where applicable.
Legal basis: Article 6(1)(b) GDPR – performance of a contract.
13. Banks and Financial Institutions
Where a customer chooses payment by instalments or financing, personal data may be transferred to:
TBI Bank EAD;
DSK Bank AD;
UniCredit Consumer Financing EAD;
iutePay;
other financial institutions where such services become available.
Depending on the selected financing option, the following data may be processed:
full name;
Personal Identification Number or equivalent identifier where required by law;
telephone number;
e-mail address;
residential address;
order information;
purchase value.
Once transferred, the relevant financial institution acts as an independent data controller and processes the personal data in accordance with its own privacy policy.
14. Hosting Services
The website is hosted by:
Jump.bg
The hosting provider may process technical information necessary for providing the hosting service, including:
IP addresses;
server logs;
technical request information;
security-related information.
Such processing is necessary to:
provide uninterrupted website operation;
ensure cybersecurity;
diagnose technical issues;
create backups;
restore services in the event of incidents.
15. Cloudflare
The website uses services provided by Cloudflare, Inc. to enhance performance and security.
Cloudflare may process:
IP addresses;
browser information;
HTTP requests;
technical logs;
security-related information.
Cloudflare acts as a provider of network security, content delivery and performance optimisation services.
16. Google Analytics 4
The website uses Google Analytics 4 to analyse website traffic and user behaviour.
Google Analytics 4 may process information such as:
visited pages;
session duration;
browser type;
operating system;
device type;
approximate geographical location;
traffic source;
interactions with website content.
This information is processed exclusively for:
analysing website performance;
improving website functionality;
enhancing user experience;
measuring website traffic.
Google Analytics 4 is configured in accordance with the Company's settings and is not intended to directly identify individual users.
17. Google Ads
The website uses Google Ads services for:
conversion tracking;
advertising performance measurement;
remarketing;
displaying personalised advertisements, where legally permitted.
Google may use cookies and similar technologies for these purposes.
18. Meta Pixel
The website uses Meta Pixel.
Meta Pixel enables the Company to:
measure advertising effectiveness;
analyse user behaviour;
create advertising audiences;
conduct remarketing campaigns.
Where required by law, processing for marketing purposes is carried out only after obtaining the user's consent.
19. TikTok Pixel
The website also uses TikTok Pixel.
TikTok Pixel may process information relating to:
website visits;
user interactions;
conversions;
advertising campaign performance.
The collected information is used solely to optimise advertising campaigns and improve marketing performance.
20. International Transfers of Personal Data
Some service providers used by the Company may be established outside the European Union or the European Economic Area.
Where personal data is transferred outside the EEA, such transfer is carried out only in accordance with Chapter V of Regulation (EU) 2016/679 (GDPR), including, where applicable:
an adequacy decision adopted by the European Commission;
Standard Contractual Clauses (SCCs);
other appropriate safeguards recognised under GDPR.
Yambol Komers Ltd. takes appropriate technical and organisational measures to ensure that personal data remains adequately protected during any international transfer.
21. Data Processors
Where the Company engages third parties to process personal data on its behalf, such parties act as data processors within the meaning of Article 28 GDPR.
Where required by law, Yambol Komers Ltd. enters into written data processing agreements with such processors.
Data processors may process personal data only:
on documented instructions from the Company;
for the agreed purposes;
under appropriate confidentiality obligations;
while implementing suitable technical and organisational security measures in compliance with GDPR.
22. Rights of Data Subjects
Every data subject whose personal data is processed by Yambol Komers Ltd. has the rights provided under Regulation (EU) 2016/679 (GDPR).
22.1 Right to Information
Pursuant to Articles 13 and 14 GDPR, every data subject has the right to receive clear, transparent and easily understandable information regarding the processing of their personal data.
22.2 Right of Access
Under Article 15 GDPR, every data subject has the right to obtain confirmation as to whether personal data concerning them is being processed.
Where personal data is processed, the data subject has the right to obtain information regarding:
the purposes of the processing;
the categories of personal data concerned;
the recipients or categories of recipients;
the envisaged retention period;
the rights available under GDPR;
the source of the personal data, where it has not been collected directly from the data subject;
transfers of personal data to third countries or international organisations;
the existence of automated decision-making, including profiling, where applicable.
The data subject is also entitled to obtain a copy of the personal data undergoing processing.
22.3 Right to Rectification
Under Article 16 GDPR, every data subject has the right to request the correction of inaccurate personal data without undue delay.
The data subject also has the right to have incomplete personal data completed.
22.4 Right to Erasure ("Right to be Forgotten")
Pursuant to Article 17 GDPR, the data subject has the right to request the erasure of personal data where one of the grounds specified in the Regulation applies, including where:
the personal data is no longer necessary for the purposes for which it was collected;
consent has been withdrawn and there is no other legal basis for processing;
the data subject has successfully objected to the processing;
the processing is unlawful;
erasure is required to comply with a legal obligation.
The right to erasure shall not apply where processing is necessary for compliance with a legal obligation, for the establishment, exercise or defence of legal claims, or in any of the other situations provided for in Article 17(3) GDPR.
22.5 Right to Restriction of Processing
Under Article 18 GDPR, the data subject has the right to request restriction of processing where:
the accuracy of the personal data is contested;
the processing is unlawful and the data subject opposes erasure;
the Company no longer needs the personal data, but the data subject requires it for the establishment, exercise or defence of legal claims;
the data subject has objected to processing under Article 21 GDPR.
22.6 Right to Data Portability
Pursuant to Article 20 GDPR, the data subject has the right to receive the personal data they have provided in a structured, commonly used and machine-readable format where:
processing is based on consent or on a contract; and
processing is carried out by automated means.
Where technically feasible, the data subject may request that the data be transmitted directly to another data controller.
22.7 Right to Object
Under Article 21 GDPR, the data subject has the right, at any time, to object to the processing of personal data based on the Company's legitimate interests.
Where personal data is processed for direct marketing purposes, the data subject has the unconditional right to object, and the Company shall cease such processing without undue delay.
22.8 Right to Withdraw Consent
Where processing is based on consent, the data subject has the right to withdraw such consent at any time.
Withdrawal of consent shall not affect the lawfulness of processing carried out before the withdrawal.
23. Exercising Data Subject Rights
Requests concerning the exercise of data subject rights may be submitted:
By e-mail:
admin@mebelinovdom.com
or
By post to:
Yambol Komers Ltd.
1 Industrialna Street
8600 Yambol
Bulgaria
To prevent unauthorised disclosure of personal data, the Company may request additional information to verify the identity of the applicant.
Requests shall be handled within the time limits established by Article 12 GDPR.
24. Automated Decision-Making
As of the date of this Privacy Policy, Yambol Komers Ltd. does not carry out automated individual decision-making or profiling that produces legal effects or similarly significant effects on data subjects within the meaning of Article 22 GDPR.
The use of analytics and advertising tools does not constitute automated decision-making under Article 22 GDPR.
25. Cookies
The website uses cookies and similar technologies for the following purposes:
ensuring the proper operation of the website;
maintaining website security;
remembering user preferences;
analysing website traffic;
measuring advertising performance;
improving the user experience.
Detailed information regarding the use of cookies is available in the Company's separate Cookie Policy.
Where required by applicable law, non-essential cookies are placed only after the user has provided valid consent.
26. Security Measures
Yambol Komers Ltd. implements appropriate technical and organisational measures in accordance with Articles 24, 25 and 32 GDPR, including:
encrypted communication using SSL/TLS technology;
access control to information systems;
role-based access for authorised personnel only;
strong authentication and password protection;
regular data backups;
malware protection;
monitoring of information security;
timely software updates;
confidentiality obligations for employees and external service providers.
Although the Company applies appropriate security measures, no method of electronic transmission or storage can guarantee absolute security.
27. Complaints to the Bulgarian Commission for Personal Data Protection
If a data subject believes that the processing of their personal data infringes the GDPR or applicable data protection legislation, they have the right to lodge a complaint with:
Commission for Personal Data Protection (CPDP)
Address:
2 Prof. Tsvetan Lazarov Blvd.
1592 Sofia
Bulgaria
Website:
https://www.cpdp.bg
The right to lodge a complaint with the supervisory authority does not affect the data subject's right to seek judicial remedies.
28. Amendments to this Privacy Policy
Yambol Komers Ltd. reserves the right to amend this Privacy Policy whenever necessary, including where required by:
changes in applicable legislation;
changes in the Company's processing activities;
implementation of new services;
introduction of new technologies;
other legitimate business or legal reasons.
The latest version of the Privacy Policy shall always be published on the Company's website.
29. Contact Information
For any questions regarding this Privacy Policy or the processing of personal data, please contact:
Yambol Komers Ltd.
UIC: 838168469
Registered office:
1 Industrialna Street
8600 Yambol
Bulgaria
Telephone:
+359 878 796 263
E-mail:
admin@mebelinovdom.com
Website:
https://mebelinovdom.com
30. Final Provisions
This Privacy Policy shall enter into force on the date of its publication on https://mebelinovdom.com.
Any matters not expressly governed by this Privacy Policy shall be subject to:
Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR);
the Bulgarian Personal Data Protection Act (PDPA);
the applicable legislation of the Republic of Bulgaria and the European Union.
