WINTER SALE GDPR - Privacy Policy
GDPR – Personal Data Protection (Privacy Policy)
Summary
- This policy explains how we process personal data when using https://www.extreme-bg.com.
- Controller: “Extreme Sport” OOD, UIC 131452613, Sofia, Bulgaria.
- We collect data for registration, orders, bank transfer payments, and contact requests, plus automatic data (device, IP, location, usage).
- We use cookies and remarketing; you can accept/decline cookies, while some are strictly necessary.
- We use data to provide services and orders, ensure security, improve content, communicate, and send newsletters/offers.
- We do not share data with third parties except in the cases described (consent, contractual support, legal obligation, etc.).
- You have GDPR rights (access, rectification, erasure, restriction, objection, portability, etc.).
- Data is stored on servers in Bulgaria and retained while you are an active user and no longer than necessary for the purposes.
1) Data Controller (Who we are)
Controller: “Extreme Sport” OOD, a company registered under the laws of the Republic of Bulgaria, UIC 131452613.
Registered office and management address: Sofia, “Ovcha Kupel” district, “692” St. No. 12, Office No. 1, Bulgaria.
2) Scope, validity and definitions
This Policy describes how we process personal data you provide through the Website when using its services, content and resources.
“Processing of personal data” includes collecting, receiving, recording, organizing, updating, extracting and any other lawful use and sharing of personal data.
Accessing and using the services/resources on the Website requires confirmation that you have read, understood and accepted this Policy. If you do not agree, you should not use the Website and its services/products.
We may update this Policy; new versions are published on the Website and users are notified automatically. If you disagree with changes, you should notify us in writing, after which your profile will be deleted.
Age requirement: using the Website services requires you to be at least 16 years old.
3) What personal data we collect
3.1. Data you provide
You may browse the Website without registration. To use certain services (registration, orders, payments, contact requests), providing personal data is required.
a) When creating an account (mandatory fields)
- first and last name
- email address
- phone number
- country, city/town and address
b) When placing an order without registration
- first and last name
- phone number
c) When paying by bank transfer
- three names (full name)
- bank account number
- bank name
d) When sending an inquiry via the contact form
- first and last name
- email address
- subject and description of the inquiry
Providing non-mandatory fields is entirely at your discretion and responsibility. Data you provide without us explicitly requesting it is treated as personal data provided with explicit consent and processed under minimization and limitation principles.
3.2. Data collected automatically
- Device information: device model, operating system and browser version, IP address.
- Location information (geolocation): we may collect and process information about your actual location (via IP address, GPS, Wi-Fi access points, and cell towers).
- Usage information: referring pages, pages the Website links to, visit date/time and duration, loading speed, and other interaction data.
3.3. Categories we do NOT collect
We do not collect data revealing racial or ethnic origin, political, religious or philosophical beliefs, membership in political parties/organizations/unions, or health/sexual life/human genome data, except for the specific exception stated in the original text regarding a report of an adverse side effect after using a product.
4) Processing purposes
We process personal data to provide quality services and timely technical and other support where necessary.
- Normal functioning of services: account creation, placing orders, paying orders, communication with the Controller.
- Secure and reliable use: verification of access rights to requested services/resources.
- Continuous improvement of services and content based on your suggestions and ideas.
- Sending news, newsletters, offers, useful information and other messages.
- Providing specialized information for promotions, campaigns, games and instructions based on preference data.
- Inviting you to surveys and user satisfaction studies.
- Other lawful purposes related to quality performance of present and future Website services/resources.
If purposes change, we will inform you and request your explicit consent in line with the new purposes.
5) Legal grounds
Note: The original policy explicitly states that before receiving and processing your personal data we require your explicit, informed and freely given consent (e.g., during registration/order/inquiry), and that disclosure may be required by law or by an act of a public authority in certain cases.
[TODO: confirm whether you want an explicit list of GDPR Art. 6 legal bases (contract, legal obligation, legitimate interests, consent, etc.). The original text does not provide a structured list.]
6) Who can access data / recipients
Your personal data will not be transferred to third parties unless:
- you provide explicit, informed and freely given consent;
- third parties provide support under a contract for delivering our products or services;
- required by law or by an act of a public authority;
- necessary to protect rights, property, user security, or another protectable public interest;
- required in connection with the sale of a business/company/assets (subject to confidentiality).
Our employees and partners may access your data for Website/service support and are bound by confidentiality obligations.
We may share non-personally identifying data with commercial partners (media, marketing agencies and other partners that have accepted to comply with this Policy) for providing information about products/services/promotions with your consent, as stated in the original policy.
For any other purposes not explicitly listed, we will request your explicit consent and identify partners and purposes for sharing/transfer.
Based on a court decision or binding act of a public authority, we may be obliged to disclose identity/data, and we are not required to notify the user in the specific investigation/proceeding scenario described in the policy.
8) Your rights
Under applicable law, you may exercise rights at any time, including by sending an explicit request to: office@extreme-bg.com.
- Right to object to processing.
- Right to be informed before data is first provided to third parties for direct marketing, and the right to oppose such use/transfer.
- Right of access in a structured, commonly used and machine-readable format.
- Right to portability / transfer to another controller.
- Right to rectification of inaccurate data.
- Right to erasure (deletion) under the policy conditions.
- Right to restriction of processing; and the right to request that third parties be informed of restrictions/erasure/prohibition.
Supervisory authority
The policy indicates the local supervisory authority as:
Commission for Personal Data Protection (Bulgaria)
Address: Sofia 1592, 2 “Tsvetan Lazarov” Blvd.
Tel.: +359 2 915 3580 | Fax: +359 2 915 3525
Email: kzld@cpdp.bg
Website: http://www.cpdp.bg/
9) Storage and retention
Personal data is stored on servers located in the Republic of Bulgaria.
We retain your data while you are a registered active user and no longer than necessary to achieve the stated purposes, or until the services and/or the Website are discontinued.
If you request deletion of your profile, the stored personal data will be deleted without undue delay.
By exception, further retention is allowed only in the cases described in the original text (e.g., freedom of expression/information, legal obligation, public interest task/official authority, public health, archiving in the public interest, scientific/historical research, statistical purposes, or establishment/exercise/defense of legal claims).
10) Security measures and risks
The policy states that adequate technological and organizational measures have been implemented to protect data quality and integrity, including accuracy, timeliness and completeness.
Important: data transmission over the Internet or another open network is never fully secure; there is a risk of unauthorized access by third parties.
11) Contact details
For additional information, complaints or exercising your rights, you can contact us:
- Address: Sofia, 42 Knyaz Al. Dondukov Blvd., Bulgaria
- Phone: 0899130357
- Email: office@extreme-bg.com
Dates: The original text mentions “Effective from: 25.05.2018” and also “This Policy is effective from 25.05.2019”.
[TODO: confirm which date should be treated as the “last update” date to avoid ambiguity.]
12) FAQ
Frequently Asked Questions (FAQ)
What personal data is required for account registration?
Account registration requires first and last name, email address, phone number, country, city/town, and address.
Can I place an order without creating an account?
Yes. Orders without registration require first and last name and a phone number.
What personal data is provided when paying by bank transfer?
When paying by bank transfer, full name (three names), bank account number, and bank name are required.
Do you collect data automatically when I visit the website?
Yes. We collect device data (including IP address), possible geolocation, and interaction data such as visited pages and visit duration.
Do you use cookies?
Yes. The online store uses cookies for website functionality, analytics, and marketing purposes. Some cookies are strictly necessary and cannot be disabled.
Can I decline cookies?
Yes. You can decline cookies via the consent banner or through your browser settings. Declining cookies may limit certain website functionalities.
Do you use remarketing and third-party advertising?
The policy describes the use of Google Analytics for Display (remarketing) and states that third parties such as Google and Facebook may show ads based on previous visits.
When do you share personal data with third parties?
Personal data is shared only with the user’s explicit consent, when required for contractual services, by legal obligation, or to protect legitimate interests as described in the policy.
How can I exercise my GDPR rights?
You can exercise your rights by sending a written request, including by email to office@extreme-bg.com.
Where is my personal data stored and for how long?
Personal data is stored on servers located in the Republic of Bulgaria and retained only for as long as necessary to fulfill the processing purposes.