
Price
Brief description
Manufacturer
Availability
Color
Specifications
Composition
Size range
Standard
Toe cap
Lining
Insole
Sole
Upper
Plate
Density
Protection

Privacy Policy

This Privacy and Personal Data Protection Policy, referred to in the General Terms and Conditions and hereinafter for brevity as the "Policy" or "Privacy Policy", sets out the ways in which "BULTEX 99" EOOD, in its capacity as Personal Data Controller, hereinafter referred to for brevity as the "Controller" or the "MERCHANT", collects, stores and processes all information and personal data provided by CUSTOMERS when using the services and purchasing the goods offered on the online store stenso.net, and establishes for what purposes, on what legal basis and for what period such data are stored, and what appropriate physical and technical measures are taken to protect the information provided against unlawful access, use, disclosure and dissemination.

This Privacy Policy has been drawn up in full compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, hereinafter referred to as the "Regulation", "GDPR" or "General Data Protection Regulation", which applies from 25 May 2018, the Personal Data Protection Act and the other European and Bulgarian legislative acts in the field of personal data protection.

This Privacy Policy aims to inform CUSTOMERS about all aspects of the processing of their personal data by the Merchant and the rights they have in connection with such processing.

This Privacy Policy is an integral part of the General Terms and Conditions for use of the website www.bultex99.com , administered by the MERCHANT.

This Privacy Policy is published and accessible on the Internet at any time at: https://stenso.net/content/2-politika-za-poveritelnost in a manner that allows it to be stored and reproduced.

I. DETAILS OF THE MERCHANT, PERSONAL DATA CONTROLLER

Art. 1. (1) The website www.bultex99.com is owned by "BULTEX 99" EOOD, a commercial company entered in the Commercial Register and Register of Non-Profit Legal Entities at the Registry Agency under UIC 115784032, with registered office and address of management at: Plovdiv, 31 Vasil Aprilov Blvd., represented by Stefan Slavchev Bashev.

(2) "BULTEX 99" EOOD, in its capacity as Personal Data Controller, collects, stores and processes information and personal data of the CUSTOMERS and users of the website www.bultex99.com.

(3) Information about the Controller processing your data:

1. Name of the MERCHANT: "BULTEX 99" EOOD

2. Registered office and address of management: Plovdiv 4000, 31 Vasil Aprilov Blvd.

3. Address for carrying out business activity: Plovdiv, 8 Karlovsko Shose Blvd.

4. Correspondence details and address for submitting consumer complaints: Plovdiv, 8 Karlovsko Shose Blvd., tel: 032/909 799, 0889860889, e-mail: sales@stenso.net

5. Entry in public registers: "BULTEX 99" EOOD is entered in the Commercial Register and Register of Non-Profit Legal Entities at the Registry Agency under the Ministry of Justice of the Republic of Bulgaria under UIC 115784032

6. Registration under the Value Added Tax Act: VAT ID: BG115784032

7. Information about the person responsible for data protection: Vesela Dimitrova, e-mail address: e-sales@bultex99.com

(4) Information about the competent supervisory authority for personal data protection:

Commission for Personal Data Protection: address: Sofia, 2 Prof. Tsvetan Lazarov Blvd.

tel.: (02) 940 20 46, fax: (02) 940 36 40, E-mail: kzld@cpdp.bg, Website: www.cpdp.bg

(5) "BULTEX 99" EOOD carries out its activity in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

II. DEFINITIONS

Art. 3. For the purposes of this Privacy Policy, the terms and expressions set out below shall have the following meaning:

"Controller" means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

"Processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.

"Personal data" means any information which directly identifies or is capable of identifying a given natural person – full name, date of birth, e-mail address, address, etc.

"Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

"Data subject" means a natural person who is or can be identified, directly or indirectly, by reference to an identifier /name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, intellectual, economic, cultural or social identity.

"Consent of the data subject" means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

"Third party" means a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or processor, are authorised to process personal data.

III. LEGAL BASIS FOR THE COLLECTION, PROCESSING AND STORAGE OF PERSONAL DATA

Art. 3. The Controller collects and processes personal data of the CUSTOMERS in connection with the use of the website www.bultex99.com, the conclusion and performance of contracts with them, and in particular on the basis of the following grounds under Art. 6(1) of Regulation (EU) 2016/679 (GDPR):

Explicit consent obtained from the CUSTOMER;
Performance of the Controller's obligations under a contract concluded with the CUSTOMER;
Compliance with a legal obligation to which the Controller is subject;
For the purposes of the legitimate interests of the Controller or of a third party.

IV. PURPOSES AND PRINCIPLES OF THE COLLECTION, PROCESSING AND STORAGE OF PERSONAL DATA

Art. 4. (1) In its capacity as Personal Data Controller, "BULTEX 99" EOOD collects and processes the personal data which the CUSTOMERS provide in connection with the use of the website www.bultex99.com and the conclusion of a contract for online sale, including for the following purposes:

Conclusion and performance of contracts for the sale and purchase of goods with the CUSTOMERS of the online store www.bultex99.com, placing orders and purchasing goods, delivery of the ordered goods to the CUSTOMERS, receipt of payments, as well as any other purposes related to the performance of the concluded contracts for the sale and purchase of goods with the CUSTOMERS of the online store bultex99.com;
Creation and maintenance of the CUSTOMER's account upon registration in the online store www.bultex99.com and provision of full functionality when using the online store;
Sending of a newsletter and marketing offers, special promotions and campaigns, promo codes, vouchers, subject to the CUSTOMER's explicit consent;
Exercise of the right of withdrawal from purchased goods, return of goods for replacement, satisfaction of a claim regarding goods;
Identification of the CUSTOMER as a party to the contract;
Financial and accounting purposes – compliance with the provisions of the Accountancy Act, the VAT Act, the Corporate Income Tax Act and other acts;
Statistical purposes – improving the services offered by the website www.bultex99.com , including for the creation of new functionalities, for making informed business decisions through the use of aggregated analysis and business research;
Protection of information security;
Securing the performance of the contract for the provision of the relevant service;
Participation in events and the holding of games, prize draws, promotions and advertising campaigns organised by the Merchant, subject to the explicit consent of the CUSTOMER/user;
Participation in loyalty programmes organised by the MERCHANT, subject to your explicit consent;
Informing you of promotional terms and sending any other type of commercial communications and SMS for information purposes, subject to the CUSTOMER's consent.

(2) We observe the following principles when processing the personal data of the CUSTOMERS:

lawfulness, fairness and transparency;
purpose limitation;
relevance to the purposes of processing and minimisation of the data collected;
accuracy and currency of the data;
storage limitation with a view to achieving the purposes;
integrity and confidentiality of processing and ensuring an appropriate level of security of personal data;
accountability.

(3) When processing and storing personal data, the Controller may process and store personal data for the purpose of protecting its legitimate interests and fulfilling its obligations to the National Revenue Agency, the Ministry of the Interior and other state and municipal authorities.

V. WHAT TYPES OF PERSONAL DATA THE CONTROLLER COLLECTS, STORES AND PROCESSES

Art. 5. The Controller performs the following operations with the personal data provided by the CUSTOMERS for the following purposes:

Conclusion and performance of a contract for the sale and purchase of goods with a business partner or CUSTOMER of the online store bultex99.com – the purpose of this operation is the conclusion and/or performance of a contract with a business partner or CUSTOMER and its administration. In individual cases, the purpose of the operation may also be the protection of the legitimate interests of the MERCHANT or a third party in connection with the performance of the contract.
Registration of a CUSTOMER in the online store – the purpose of this operation is the creation of an Account for using the online store to purchase goods and the provision of contact details for the delivery of the purchased goods, receipt of newsletters and/or information about special commercial offers, promotions and campaigns, where such a wish has been expressed. The registration of a CUSTOMER Account in the online store is not a mandatory step for purchasing goods and using the services provided by the website www.bultex99.com , which are to a significant extent accessible without creating an Account.
Sending of a newsletter and marketing offers, special promotions and campaigns, electronically, by means of electronic communication, including by e-mail, via the social networks Facebook, Instagram or via SMS and Viber messages for information purposes – the purpose of this operation is the administration of the process of sending newsletters and/or marketing offers, special promotions and campaigns to Customers who have given their explicit consent to receive them. CUSTOMERS have the right to opt out at any time from receiving newsletters and e-mails with marketing offers for promotions and campaigns of the MERCHANT, without stating reasons for doing so.
Exercise of the right of withdrawal, replacement or making a claim regarding goods – the purpose of this operation is the fulfilment of the Controller's legal obligations in connection with liability for defects discovered in the goods and in the process of the CUSTOMER exercising the right of withdrawal, return, replacement or claim regarding goods. The personal data processed in connection with the examination of individual requests by CUSTOMERS for the exercise of their claim rights are used solely for the purposes of exercising the said rights.
For the purposes of the company's financial and accounting activity – the purpose of this operation is compliance with the legal requirements applicable to the Controller for maintaining accounting records of the commercial activity and the document flow related to the delivery of purchased goods.
For the purposes of statistics, aggregated business analyses and research of the commercial activity – the purpose of this operation is the legitimate interest of the Controller in improving the services offered by the website www.bultex99.com , by collecting information and aggregated analysis of information which enables the development of its commercial activity in line with the needs and behaviour of the CUSTOMERS/users of the site.
Registration of a participant in events and sending of information or prizes – the purpose of this operation is the administration of the process of registering participants in events and games, subject to their explicit consent thereto, and the sending of prizes from games held.

Art. 6. (1) The Controller processes the following categories of personal data and information for the following purposes and on the following grounds:

Data for the conclusion and performance of a contract of sale with a business partner or CUSTOMER of the online store bultex99.com (as a CUSTOMER – first name, surname, e-mail, telephone, gender, delivery address, etc.; as a Guest – first name, surname, e-mail, telephone, delivery address)

Purpose for which the data are collected:

Establishing contact with the CUSTOMER or user and sending information to him or her, subject to explicit consent or at his or her request;
Potential opportunity to conclude a contract for the sale and delivery of goods;
Registration of a CUSTOMER/user with his or her Account in the online store for the conclusion of a contract for the sale and delivery of goods;
Conclusion and performance of a contract for the delivery of goods with the CUSTOMER.
Fulfilment of the Controller's obligations regarding the conclusion and performance of a distance contract for sale and purchase and the delivery of goods, including upon the exercise of the right of return for withdrawal, replacement and claim regarding purchased goods – Art. 6(1)(b) GDPR.

Legal basis for processing your personal data – Upon placing, or taking steps to place, an order for the conclusion of a contract for the purchase of goods through the online store stenso.net by a registered CUSTOMER, or upon acceptance of the general terms and conditions and placing of an order by a CUSTOMER without registration ("Guest"), a contractual relationship is created between the Controller and the CUSTOMER, on the basis of which we process your personal data – Art. 6(1)(b) GDPR. Your data for the sending of a newsletter and marketing offers are processed on the basis of the CUSTOMER's explicit consent – Art. 6(1)(a) GDPR, which may be withdrawn at any time.

Data for registration of an Account (as a CUSTOMER – first name, surname, gender, e-mail, telephone, address, optional data such as date of birth, etc.)

- Purpose for which the data are collected:

Establishing contact with the CUSTOMER or user and sending information to him or her, subject to explicit consent or at his or her request;
Registration of a CUSTOMER/user with his or her Account in the online store in order to provide the full functionality of the website, receive promo codes or participate in the MERCHANT's loyalty programmes ;
Potential opportunity to conclude a contract for the delivery of goods offered by the MERCHANT in the online store;
Sending of a newsletter and/or e-mails with marketing offers, special promotions and campaigns, promo codes, news, subject to explicit consent.

- Legal basis for processing your personal data – Upon acceptance of the general terms and conditions and registration in the online store, or placing of an order without registration (as a "Guest"), or upon the conclusion of a contract, a contractual relationship is created between the Controller and the CUSTOMER, on the basis of which we process your personal data – Art. 6(1)(b) GDPR. Your data for the sending of a newsletter and marketing offers are processed on the basis of your explicit consent – Art. 6(1)(a) GDPR, which may be withdrawn at any time.

Data for sending newsletters and marketing offers, special promotions, campaigns for goods/services and other commercial communications (names, telephone, e-mail)

- Purpose for which the data are collected - For direct marketing: sending of a newsletter and marketing communications about promotions, campaigns and new goods.

- Legal basis for processing your personal data - your data for the sending of a newsletter and commercial communications, marketing offers, promotions and campaigns for goods and services are processed on the basis of your explicit consent – Art. 6(1)(a) GDPR, which may be withdrawn at any time.

Data for the exercise of the right of withdrawal, replacement or making a claim regarding goods (first name, surname, e-mail, telephone, delivery/return address, bank account, etc.)

- Purpose for which the data are collected - Fulfilment of the controller's obligations under a distance contract for sale and purchase and the delivery of goods – Art. 6(1)(c) GDPR, in connection with liability for defects discovered in the goods and in the process of the CUSTOMER exercising the right of withdrawal, return, replacement or claim regarding goods.

- Legal basis for processing your personal data – your data upon submitting claims, withdrawal, return or replacement of goods are processed on the basis of the Controller's legal obligation in connection with liability for claims regarding goods and the exercise of the right of withdrawal and replacement of goods, on the basis of which we process your personal data – Art. 6(1)(c) GDPR, as well as on the basis of the protection of the Controller's legitimate interest in respect of claims brought and legal disputes - Art. 6(1)(f) GDPR.

Data for carrying out delivery and payment (names of the recipient of the goods, telephone, e-mail, address; details of the payment instrument used)

- Purpose for which the data are collected: Fulfilment of the controller's obligations under a distance contract for sale and purchase and the delivery of goods – Art. 6(1)(b) GDPR.

Data on the CUSTOMER's visits and behaviour when using the online store - (IP address, "cookies", operating system, browser type, language settings, keywords in search queries and content viewed, etc.)

- Purpose for which the data are collected – ensuring the functioning, improving the content and quality of the goods and services offered on the website, aggregated business analysis of the traffic and behaviour of the CUSTOMERS and visitors of the website, tracking of sales and goods and services and other statistical purposes.

- Legal basis for processing your personal data – for the protection of the Controller's legitimate interests in improving the services provided by the website and statistics, on the basis of which we process your personal data – Art. 6(1)(f) GDPR. Upon loading the website bultex99.com and viewing in any manner its content, goods and services, your Data are processed on the basis of your explicit consent – Art. 6(1)(a) GDPR, which may be withdrawn at any time.

Data from the CUSTOMER's social media profile (the publicly available information from your Facebook and Instagram profiles)

- Purpose for which the data are collected:

Establishing contact with the user and sending information to him or her;
For the purposes of registration on the website, participation in a game, prize draw, campaign, etc.
For identification of the CUSTOMER/user, for the conclusion and performance of a contract for the sale and delivery of goods from the online store.

- Legal basis for processing your personal data – Upon placing an order through the customer's Profile on social networks or upon the conclusion of a written contract, a contractual relationship is created between the Controller and you, on the basis of which we process your personal data – Art. 6(1)(b) GDPR. Your data for signing up for our events, games, campaigns, etc. are processed on the basis of your explicit consent – Art. 6(1)(a) GDPR.

(2) The Controller does not collect or process so-called special categories of personal data which:

reveal racial or ethnic origin;
reveal political opinions, religious or philosophical beliefs, or trade union membership;
relate to genetic and biometric data, data concerning health or data concerning sex life or sexual orientation.

(3) The personal data have been collected by the Controller from the persons to whom they relate.

(4) The Company does not carry out automated decision-making with data.

(5) The Company does not collect or process data on persons under 18 years of age, except with the consent of a parent or guardian, in accordance with the applicable legislation.

VI. PERIOD OF STORAGE OF PERSONAL DATA

Art. 7. (1) The Controller stores your personal data for a period not exceeding 10 years from your last activity (placing of an order) or until the withdrawal of your consent, respectively the submission by you of a request for restriction of the processing of your data. After the deletion of your account or the successful completion of the order, the Controller takes the necessary care to erase and destroy all data without undue delay.

(2) The Controller stores your personal data provided in connection with online orders placed for a period of 10 years with a view to protecting the Controller's legal interests in judicial or administrative claims and disputes with CUSTOMERS and users of the online store, and the accounting documents are likewise stored for the statutory 10-year period.

(3) The Controller stores the personal data provided upon registration of an Account in the online store stenso.net for a period not exceeding the existence of the CUSTOMER's account on the website. After the expiry of this period, as well as upon the withdrawal of your consent to maintain an Account, the Controller is obliged to erase and destroy these data without undue delay.

(4) The personal data provided to the Controller by CUSTOMERS for the receipt of a newsletter and marketing offers are stored until the withdrawal of consent to their processing.

(5) The personal data provided for financial and accounting activity are stored for the statutory 10-year period.

(6) The personal data processed for the improvement of services, including for the creation of new functionalities of the online store, for making informed business decisions through the use of aggregated analysis and business research, are stored until the fulfilment of the purposes for which they were collected.

(7) When the need for their storage ceases to exist, the Controller is obliged to erase or destroy your personal data in a secure manner and without undue delay.

Art. 8. The Controller stores the personal data of the legal representatives of its business partners for a period of 10 years from the performance or termination of the contract, in order to comply with the legitimate interests and legal obligations of the Controller, and this period may exceed the term of the concluded contract.

VII. TRANSFER OF PERSONAL DATA FOR PROCESSING

Art. 9. (1) The Controller may, at its own discretion, transfer some or all of your personal data to processors acting on behalf of the Controller for the fulfilment of the processing purposes to which you have consented, in compliance with the requirements of Regulation (EU) 2016/679 (GDPR).

(2) The Controller does not transfer personal data to third countries or international organisations.

(3) The Controller may disclose personal data to the following categories of recipients:

a) the natural persons to whom they relate;

b) persons, where provided for by law;

c) the persons processing the personal data;

d) the owner of "Bultex 99" EOOD

(4) Customers consent to the processing of their personal data for the receipt of an electronic newsletter and/or marketing communications about promotions and campaigns by ticking a checkbox. They may at any time opt out of receiving the newsletter by notifying the Controller of their decision electronically at the contact e-mail, without stating reasons for doing so.

VIII. RIGHTS OF DATA SUBJECTS IN THE COLLECTION, PROCESSING AND STORAGE OF PERSONAL DATA

Withdrawal of consent to the processing of your personal data

Art. 10. (1) If you do not wish all or some of your personal data to continue to be processed by the Controller for a specific purpose or for all processing purposes, including for the receipt of a newsletter and for marketing purposes, you may at any time withdraw your consent to processing by completing the Consent Withdrawal Form, Annex No. 1 to this Policy, or by a free-text request, and sending it to us at the contact e-mail.

(2) Upon receipt of the request for withdrawal of consent to data processing, the Controller sends to the e-mail which the CUSTOMER has specified for the receipt of newsletters and marketing communications a letter with detailed instructions for confirming your unsubscription from the list of CUSTOMERS receiving newsletters and communications.

(3) Upon withdrawal of consent to the processing of personal data which are mandatory for the creation and maintenance of an account in the online store, your account will become inactive. Of course, you will still be able to browse the online store and the products offered and to place orders as a guest or to register anew.

(4) The withdrawal of consent does not affect the lawfulness of the processing of personal data carried out by the Controller up to that point.

(5) If you have placed an order which is in the process of being processed, the earliest moment at which you may withdraw your consent to processing is upon the successful completion of the order.

Right of access

Art. 11. (1) You have the right to request and obtain from the Controller confirmation as to whether personal data relating to you are being processed, and if you are a registered user, you may at any time view in your account the personal data which you have provided and which are processed about you.

(2) You have the right to obtain access to the data relating to you, as well as to the information concerning the collection, processing and storage of your personal data.

(3) The Controller provides you, upon request, with a copy of the personal data relating to you which are being processed, in electronic or other appropriate form.

(4) The provision of access to the data is free of charge, but the Controller reserves the right to impose an administrative fee in the event of repetitive or excessive requests.

Right to rectification or completion

Art. 12. (1) You may rectify or complete inaccurate or incomplete personal data relating to you directly by editing your account on the website, or you may submit such a request to the Controller using the Data Rectification/Completion Form, Annex No. 4 or by making a free-text request.

Right to erasure ("right to be forgotten")

Art. 13. (1) You have the right to request from the Controller the erasure of some or all of the personal data relating to you, and the Controller has the obligation to erase them without undue delay where one of the following grounds applies:

the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
you withdraw the consent on which the processing of the data is based and there is no other legal ground for the processing;
you object to the processing of the personal data relating to you, including for direct marketing purposes, and there are no overriding legitimate grounds for the processing;
the personal data have been unlawfully processed;
the personal data have to be erased for compliance with a legal obligation under EU law or the law of a Member State to which the Controller is subject;
the personal data have been collected in relation to the offer of information society services.

(2) The Controller is not obliged to erase the personal data if it stores and processes them:

for exercising the right of freedom of expression and the right to information;
for compliance with a legal obligation which requires processing under EU law or the law of the Member State to which the Controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in it;
for reasons of public interest in the area of public health;
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
for the establishment, exercise or defence of legal claims.

(3) In the event that you exercise your right to be "forgotten", the Company will erase all of your data, with the exception of the following information:

information which is necessary to certify that your right to be forgotten has been fulfilled;
technical information about the functioning of the online store, which information cannot be linked in any way to your identity;
the e-mail address with which you registered in the online store.

(4) In order to exercise your right to be "forgotten", you must submit a request to the Controller through your account in the online store, using the Form – Request for Erasure of Data, Annex No. 2 or send a free-text request by e-mail to the Controller

(5) If you have placed an order which is in the process of being processed, the earliest moment at which you may request to be "forgotten" is upon the successful completion of the order.

(7) Upon erasure of your personal data, your account will become inactive. Of course, you will still be able to browse the online store and the products offered and to place orders as a guest or to register anew.

(8) The Controller does not erase data which it is legally obliged to retain, including for its defence in respect of legal claims brought against it or for proving its rights and legitimate interests.

Right to restriction

Art. 14. You have the right to request that the Controller restrict the processing of the data relating to you, by sending a free-text request by e-mail, where:

you contest the accuracy of the personal data, for a period enabling the Controller to verify the accuracy of the personal data;
the processing is unlawful, but you do not wish the personal data to be erased and instead request that their use be restricted;
the Controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of your legal claims;
you have objected to the processing pending the verification of whether the legitimate grounds of the Controller override your interests.

Right to data portability

Art. 15. (1) You may at any time download or receive your data, which are stored and processed in connection with the use of the Controller's services, in a structured, commonly used and machine-readable format, directly through your account via the data export option or by a request by e-mail to the Controller, using the Form – Request for Portability, Annex No. 3 or by making a free-text request, where the processing is based on consent or on a contractual obligation and is carried out by automated means.

(2) You may request that the Controller transmit your personal data directly to a controller designated by you, where technically feasible.

Right to receive information

Art. 16. You may request that the Controller inform you of all recipients to whom the personal data for which rectification, erasure or restriction of processing has been requested have been disclosed. The Controller may refuse to provide this information if this would be impossible or would involve disproportionate effort.

Right to object

Art. 17. You may object at any time to the processing by the Controller of personal data relating to you, including if they are processed for the purposes of profiling or direct marketing.

Your rights in the event of a breach of the security of your personal data

Art. 18. (1) If the Controller establishes a breach of the security of your personal data which may result in a high risk to your rights and freedoms, it shall notify you without undue delay of the breach, as well as of the measures which have been taken or are to be taken.

(2) The Controller is not obliged to notify you if:

it has implemented appropriate technical and organisational protection measures in respect of the data affected by the security breach;
it has subsequently taken measures which ensure that the breach will not result in a high risk to your rights;
the notification would involve disproportionate effort .

Right to lodge a complaint with a supervisory authority

Art. 19. In the event of a violation of your rights under the foregoing or the applicable personal data protection legislation, you have the right to lodge a complaint with the Commission for Personal Data Protection or to seek judicial remedy.

Art. 20. You may exercise all rights regarding the protection of your personal data through the forms attached to this information. Of course, these forms are not mandatory and you may submit your requests in any form which contains a statement to that effect and identifies you as the data subject.

IX. PERSONS TO WHOM YOUR PERSONAL DATA ARE PROVIDED

Art. 21. (1) For the purposes of processing your personal data in the provision of the services for the use of the online store stenso.net in their full functionality and with a view to your interests, the Controller may, at its discretion, provide your data to the following persons, who are processors and with whom it has concluded personal data protection agreements:

Processor	Purpose of the processing of personal data
"Speedy" AD	Domestic deliveries
"ECONT Express" OOD	Domestic deliveries
"SuperHosting"	Hosting for the online store

The said persons (postal operators, auditors, lawyers, website maintenance companies, etc.) act as processors on behalf of the Controller and, on the basis of the contract concluded with it, have undertaken to comply with all requirements for lawfulness, confidentiality and security in the processing and storage of your personal data solely for the intended purposes.

(2) The Controller may disclose and provide your personal data to public authorities where required by law (e.g. the National Revenue Agency, the Commission for Personal Data Protection, the Ministry of the Interior and other state and municipal authorities).

X. LINKS TO OTHER WEBSITES

Art. 22. This Privacy Policy does not cover the links on the website www.bultex99.com to other websites. We recommend that you read the privacy statements of the other websites you visit.

XI. SECURITY MEASURES

Art. 23. The Controller adopts technical and organisational measures to protect your personal data against unlawful access or disclosure, accidental loss, unlawful destruction or alteration, as well as against other forms of unlawful processing. Information in electronic form is stored on secure servers within the territory of the European Union, installed in a well-equipped, fire-resistant and technically maintained colocation facility for telecommunications equipment. The transfer of data between the servers and the client device/browser is carried out in encrypted form, via HTTPS.

The Controller uses technical means to protect personal data against acquisition or alteration by unauthorised persons, including:

An SSL security certificate which encrypts the connection between the site and the end device.
Protection of the database against unlawful access, data backup.
Anti-virus software and software for protection against unauthorised access.
Protection of customer accounts with e-mail and password.

Your personal data (those of them which are necessary) are accessible only to employees or subcontractors of "Bultex 99" EOOD who have access to them in order to perform their duties arising from the contractual relations between the Controller and the CUSTOMERS of the online store bultex99.com. The Controller guarantees that the employees and subcontractors who have access to your personal data have the appropriate professional qualifications, knowledge and skills to perform their duties, and introduces differentiated access rights depending on their position and responsibilities.

XII. USE OF COOKIES

Art. 24. (1) The Controller uses "cookies" to ensure the proper functioning of the online store www.bultex99.com , as well as to collect statistical information and data for the purpose of carrying out analysis to improve access to and use of the website's services. The cookies used serve to distinguish users and sessions, to submit requests, to store the source of traffic and the manner in which the site was reached.

A list of the "cookies" we use can be found – here.

Through the appropriate settings of your browser you can always disable, block or set your preferences for both our cookies and third-party cookies. In this case, you may lose some of the functionality of certain services on our site.

For more information on how cookies work, see https://www.allaboutcookies.org/.

(3) In the event that you use a link which redirects you to another site, that site will have its own cookies and security policy over which we have no control.

XII. LOG FILES

Art. 25 Like most sites, the website www.bultex99.com collects data in log files. This information contains your IP, which browser you use (e.g. Mozilla, IE, Chrome, etc.), the operating system (Linux, Windows, iOS, Android), when you visited our website, the pages visited. We reserve the right to use the IP addresses of users to reveal their identity in cases where this is necessary in compliance with the law.

XIII. LINKS TO OTHER WEBSITES

Art. 26 This Privacy Policy does not cover the links on the website www.bultex99.com to other websites. We recommend that you read the privacy statements of the other websites you visit and whose services you use.

XIV. CHANGES TO THE PRIVACY POLICY

Art. 27 "BULTEX 99" EOOD reserves the right to amend this Privacy Policy at any time, and the amendments shall enter into force upon their publication on the website www.bultex99.com

If you have any questions regarding the processing of your personal data by the Controller of the website www.bultex99.com , please contact us at: sales@stenso.net or by telephone: 032909799.