Privacy Policy

(effective as of 01.10.2021)

I.   Purpose
The holder of the website Gama Organica (www.gamaorganica.com) processes personal data of visitors and registered users of the site for the purposes of sale, delivery, and advertising of products, offered on the website.

Data protection and security of all personal and financial information of our customers is a matter of great importance and priority for us. We process confidentially the personal data collected in accordance with the Bulgarian and European legal provisions, namely the European Data Protection Directive (GDPR), the Data Protection Act of the Republic of Bulgaria, and the Electronic Commerce Act of the Republic of Bulgaria.

Personal Data is any information and data that can identify the individual, whether directly or indirectly. For example, personal data as name, address, phone number, payment information, and the like. Data that cannot be directly (or in combination with additional references) related to the identity of an individual is not considered personal data.

This Privacy Policy is intended to provide the visitors of the website Gama Organica (www.gamaorganica.com) with comprehensive information, in a clear and plain language, regarding the personal data they provide, namely:
      » what kind of personal data we collect and process;
      » what is the purpose of data collection and processing;
      » who we share your personal data with;
      » for how long we store the data collected;
      » what are your rights regarding personal data protection;
      » how we notify you of any change in our Privacy Policy.
By means of this Privacy Policy, Gama Organica Ltd declares that all technical and organizational measures for data protection, which are prescribed by law or other normative acts at national and European levels, have been applied. This Policy is applied when you visit our website www.gamaorganica.com, but it is not applicable for any other websites or services, that we do not own or control.

The decision of whether and what kind of data to provide to us is a Users’ personal decision and right. However, please take into consideration that, if you shop on our e-store, collection of certain personal data is required in order for we to be able to execute your purchase order. Lack of the requested personal data will lead to an impossibility for us to execute your order.

II.   Identification of the Personal Data Controller
Controller of the personal data, collected and proceeded on the website Gama Organica® (www.gamaorganica.com), is Gama Organica Ltd, UIC: 205263142, business address: Bulgaria, postcode 2500, city of Kyustendil, 26 Peter Beron str.

The Personal Data Protection Officer shall answer all your questions regarding the data procession and protection. Contact details:
      email: info@gamaorganica.com.
      phone number.: +359 899 72 31 32
      Address: Bulgaria, postcode 2500, city of Kyustendil, 26 Peter Beron str.

III.   Type of personal data processed and purpose of processing 
Any time you contact us or visit our website, you provide us with your personal data. To ensure effective access to our services, we need to collect certain personal data from you. Gama Organica Ltd contentiously and purposefully strives to minimize as much as possible the data that collects and processes, and to protect it in the best way possible.

We process the following type of personal data:
   1.    Data that we process when you visit our website
When you visit our website, webservers store temporally, for security purposes, data for the IP address of the device that connects our website. We also collect information for the web pages of our site that you visit, the date and the duration of your visit, data for identifying the type of your browser and operation system, as well as the website through which you connect our website. This data is obtained after data anonymization, and it is used by us for the purpose of statistical analyses.
   2.    Data that we process when you register a user profile on our site
By registering a user profile in our e-store, you enter into a contractual agreement with us, based on the General terms and conditions related to the use of the website Gama Organica. Upon registration of the user profile, we process the following data:
      » Name and surname;
      » E-mail;
      » User’s password;
      » Orders history. We process the above-stated data for the purposes of execution of placed orders; for preparation of documents, related to orders; to respond to your inquiries or complaints; to contact you in case this is necessary for the timely end successful execution of an order, placed by you, etc.
   3.    Data that we process when you place an order in our e-store www.gamaorganica.com
To execute orders placed in our e-store, we need you to provide us with the following data:
      » Name and surname of the person, who will receive the delivery;
      » Delivery address – country, city, postcode, address;
      » Phone number;
      » Invoice data (optional) – name/business name, address, VAT number;
      » Delivery method;
      » Payment method;
      » Payment cart details – card number, validity date, cvv/cvc;
      » Order number;
      » Amount of payment.
We collect such data, in order to be able to execute placed orders; to prepare delivery documents; to contact you in case of a complaint or existing issue with the order or delivery.  Also, we process this data for accounting purposes.
   4.    Data that we process when you fill in a contact form on our website when publishing a comment, sen ding us an email or conventional mail, phone message or phone call or another form of communication:
      » Name and surname;
      » E-mail;
      » Phone number;
      » Address;
      » Message / comment content.
We process this data to identify you as a sender/author of a message or published comment, as well as to be able to communicate with you, if necessary.

We may be obliged to process certain parts of this data, in order to meet requirements of national supervisory or administrative bodies of the Republic of Bulgaria (such as the Regional Health Inspectorate, the Commission for Consumer Protection, the Commission for Personal Data Protection), in relation to claims, complaints or other procedures against us. We may be obligated to process personal data to other state bodies, as well as for the purpose of administrative control, safety control, prevention, or detection of crimes.

In addition, we may process your personal data for one or more of the following reasons:
      » to comply with legal obligations (e.g. for compliance with legal requirements for accounting reporting and control in accordance with the Bulgarian and EU legislation;
      » if it represents our legitimate interest in our capacity of Personal Data Controller.
      » In case we have received your explicit, freely and unambiguous consent for processing your personal data for marketing purposes. In this case, we will use your e-mail or phone number to inform you of new products, promotional campaigns or sales. With this information, we aim to improve our services and customer experience and satisfaction. We will only do this if you give us your consent to send you this information periodically via e-mail or phone number. We do not use your personal data to advertise third-party products or services.

You may withdraw any of the aforementioned consents by submitting to us a Data Subject Rights Request Formor by contacting us via e-mail (info@gamaorganica.com). Upon the consent withdrawal, the processing of the respective type of personal data for the specified purposes shall be suspended. The withdrawal does not affect the lawfulness of the data processing which was based on consent granted prior to its withdrawal. 

IV.   Third parties with access to your personal data for the purposes of fulfilling our contractual obligation to you.
We will not transmit to third parties your personal data without your explicit consent, except when it is necessary for fulfilling any contractual obligations related to you.

In order to fulfill any contractual and/or pre-contractual obligations with you, Gama Organica Ltd may disclose your personal data to the following parties:

Companies providing courier services– We process to courier companies data needed for delivery of online orders (client’s names; address; phone number; the amount of payment, in case the payment method is “cash on delivery”). We have contractual agreements with the following courier companies:
      » Econt;
      » Speedy (DPD);
      » DHL;
      » TNT.
Third-party payment processorswe cooperate with for the execution of orders paid online. Gama Organica Ltd does not store any credit card details.

Hosting service providerswho, on our behalf, process the personal data of our customers – only to the extent necessary for the website hosting.

Accounting services companies providing services to Gama Organica Ltd– we process data from cash receipts, issued invoices, and bank payments for the purposes of accounting and compliance with tax and accounting legislation.

State authoritie s and institutions in relation to inspections and control carried by them in accordance with the legal requirements.

The transfer of data to the above-stated parties shall be done with strict confidentiality and security of your personal data. As regards the non – state third parties, Gama Organica Ltd requires that they apply all technical and organizational measures for data protection.

V.   Personal data of third parties
Gama Organica Ltd processes only data that Users provide freely and voluntarily. We rely on the fact that the personal data provided by Users is possessed and provided by them lawfully.

Users are liable not to provide data of third parties in violation of their personal data rights. Gama Organica Ltd has not the capacity, nor is able to control whether personal data of third parties is provided with their consent, given according to the Bulgarian and EU legislation. Therefore, each User bears unlimited liability if he/she provides us with third party personal data (names, phone number, e-mail, delivery address, etc.), without their consent in accordance with the applicable GDPR legislation, regardless of the type of data or the reasons for data providing. 

VI.   Time periods for storing and processing personal data
We do not store personal data for periods longer than necessary for the purposes of data processing. The storage period depends on the nature, sensitivity and quantity of personal data, the purposes for data processing and the legal requirements for data storing.
      » Personal data provided by you upon registration on our website is stored and is being processed for the period of registration until the user profile is deregistered.
      » Personal data provided by you upon submission of an online order (without user registration on our website) is stored for a period of one year from the date of order.
      » Personal data on cash receipts and other accounting documents is stored for a period of 10 years in accordance with the Bulgarian legislation.
      » Personal data provided through a contact form on our website, including an incomplete registration on our website, is stored for a period of 6 months for security reasons and for the purpose to facilitate subsequent communication with the User.
      » Personal data provided by Users for the purposes of direct marketing is stored and processed until the User withdraws his/her consent.
      » Personal data, provided by you in relation to your comments on our website represents your right of free expression in a format and content, freely chosen by you. In this regard, we do not determine a specific period for storing and processing such personal data. Instead, you are given an opportunity to delete a comment, published by you, thus exercising your rights as a data subject. Exceptions exist where a comment contains insulting phrases or phrases that are defamatory for the Administrator or undermine its reputation. In such cases, the Administrator is entitled to remove the comment from its website.

When the lawful basis for personal data processing ceases to exist (e.g. the legitimate period for data storage expires; our legitimate interest for data procession is expired; you have withdrawn your consent for data procession), we shall erase your personal data in a secure manner.

VII.   Your rights in relation to your personal data
   1.    Right of Access, including the right to have a copy of your personal data under processing
You have the right to request information about your personal data that we store and process. You may contact us with a written request, and after authentication of your identity, the data will be provided to you.
   2.    Right to Rectification
You have the right to request rectification of your personal data if the information is incorrect or incomplete. You may do this through your user profile or through a written request to us, after authentication of your identity.
   3.    Right to Erasure (“Right to be forgotten”)
This right could be executed in the following cases:
·         The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
·         Withdrawal of consent when processing is based on consent;
·         Illegal data processing;
·         Legal obligation to delete.
The right to be forgotten is not an absolute right and may not be granted in the cases provided for by the law or due to a lack of proper authentication of your identity.
   4.    Right to Restriction of proce ssing of personal data
You can exercise the right of restriction in the following cases:
·       in case data accuracy is objected - for the period in which data accuracy is being checked; or
·       the processing is unlawful, but you oppose the erasure of personal data and request the restriction of the use of your personal data instead; or
·       the Controller no longer needs the personal data, but it is required by you to defend legal claims.
·       you object to a processing based on Controller’s legitimate interest. In this case, the Controller shall restrict all processing of such data pending the verification of the legitimate interest.
   5.    Right to Data P ortability
According to this right, we will:
·       provide the data directly to you; or
·       If requested by you and there is a technical possibility, the data is provided to another controller of your choice.
   6.    Right to Object to processing based on legitimate interest
You may object to the processing of your personal data based on the legitimate interest of the Controller or a third party. The Controller will not continue to process your personal data unless it is proven that there are compelling legal bases that have priority over your interests and rights or due to litigation and other procedural and extra-procedural actions.
   7.    Right to Object to direct marketing
You have the right to object to the receipt of any marketing communication sent by us.
   8.    Right to Avoid automated individual decision making, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling.
   9.    Right to complain with a supervisory authority
You have the right to complain with a supervisory authority in the Member State of habitual residenceplace of work or place of the suspected violation if you consider that the processing of your personal data is in breach of the provisions of Regulation (EC) 2016/679. On the territory of the Republic of Bulgaria, where the Controller's headquarter is located, the supervisory authority is the Commission of Personal Data Protection. More information for the Commission, you can find on its website: www.cpdp.bg.

Execution of some of the aforementioned rights is free of charge. However, please note that if your requests are manifestly unfounded or excessive, we may charge a fee, considering our administrative costs to provide you with the information.

You may execute your data subject rights by filling in a Data Subject Rights Request Form. You will receive an answer to your request within one month of receipt of your written request. If necessary, the period may be extended by further two months, considering the complexity and number of requests.

In order to ensure your personal data will not be disclosed to persons, who are not entitled to receive it, we may ask you for specific information to help us to verify your identity.  

VIII.   “Cookies”
Regarding the data, contained in the cookies used on the website Gama Organica (www.gamaorganica.com), please read our Cookies policy.  

IX.   Changes in the Privacy Policy
Gama Organica is entitled to make amendments to this Privacy Policy. For any change, the Users will be notified by a posting on our website.