Privacy Policy

PRIVACY POLICY

REGARDING THE USE OF THE ONLINE STORE WWW.DECANTUSWINES.COM

Effective from June 22, 2023

WHO ARE WE?

We are “Decantus Wines” LLC, UIC 207298366 (“Company”, “we”, “us”).

We are the seller of goods offered in the online store www.decantuswines.com (“Online Store”) and the owner of the Online Store.

We encourage you to contact us if you have any questions, misunderstandings, or objections regarding our processing of your personal data when using our website www.decantuswines.com and shopping through the Online Store.

CONTACTS

How you can reach us:

  • Registered office and address of management: Sofia 1202, 11 Industrialna Str., Bulgaria

  • Email for contact with the Online Store: www.decantuswines.com; Phone: (+359) 879 00 00 17

  • Contact forms: Any of the contact forms available on the Online Store website www.decantuswines.com

Supervisory Authority: Commission for Personal Data Protection (“CPDP”):

Please remember that you have the right to contact the CPDP directly if you believe we have violated your rights as a data subject.

  • Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria

  • Website: https://www.cpdp.bg/

  • Email: kzld@cpdp.bg

THIS POLICY IS FOR THE PROTECTION OF YOUR PERSONAL DATA

The Online Store is managed by Decantus Wines in accordance with the provisions of the Personal Data Protection Act of the Republic of Bulgaria (“PDPA”), Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (“GDPR”), and related personal data protection regulations.

As a customer of the Online Store, you provide us with certain personal data (necessary for the execution of your order, or provided with your explicit consent).

We are the Controller of your personal data. We are obliged to take, and do take, the necessary measures for its protection. Through this document, we explain your rights as a Data Subject. You have all rights under the GDPR and the PDPA.

POLICY UPDATES

We may make changes to this Policy at any time, primarily due to advances in digitalization and the dynamic development of consumer law, e-commerce, and European regulations governing personal data processing in this regard.

Any changes to the Policy will be immediately reflected in the “News” section to ensure complete transparency and awareness regarding your rights as a Data Subject.

PERSONAL DATA. OTHER TERMS USED IN THIS POLICY

  • “Personal Data” – Any information that relates to you as an individual (a user of the Online Store) and which, independently or in combination with other information, can help us establish your identity or link your user behavior to a specific device from which you access our website (e.g., email address, full name, phone number).

  • “Data Subject” – You, the visitor (individual) of the Online Store (e.g., a person creating a User Profile, placing an order through the Online Store).

  • “Processing of Personal Data” – Any operation or set of operations performed on your personal data, including, but not limited to, collection, storage, analysis, or destruction (e.g., storing logs of a created User Profile, storing name and address to fulfill an order requested by you).

  • “Data Controller” – In relation to the Online Store, this is us, Decantus Wines. We determine:

    • The purpose of processing your personal data, which is always carried out on a lawful basis under the GDPR;

    • The means by which this processing is carried out (e.g., technical infrastructure and applications used for processing).

      Obligations regarding the security and protection of your personal data lie with us. When we process your personal data with another entity (payment service provider/courier), that other entity, to the extent it is an independent controller (or joint controller with us), also bears obligations regarding the security and protection of your personal data.

  • “Data Processor” – A third party, separate from us, that processes your personal data on our behalf and according to our explicit instructions, where Decantus Wines has strictly defined the purpose and means of processing and verified that the entity meets GDPR requirements.

  • “Online Store” – Software accessible over the Internet via a web browser or mobile application at www.decantuswines.com, used for selling goods by concluding distance contracts with Decantus Wines. More information regarding terms of sale for specific types of goods can be found in the respective general terms and conditions on www.decantuswines.com.

WE PROCESS YOUR PERSONAL DATA

We collect, use, and store personal data necessary for the sale of goods offered through our Online Store.

Information about you is also collected during your browsing of our Online Store, such as when you manage a User Profile, place Orders, or subscribe to our Newsletter.

Below are examples of the types of personal information we may collect about you, the ways we may use it, and the legal grounds for doing so.

WHAT PERSONAL INFORMATION DO WE COLLECT?

We strive to collect a minimal amount of personal data, limited to what enables us to conduct operations through the Online Store. For example:

  • User Profile Creation: When registering an account (to manage access and identify your profile): full name / email address;

  • Social Network Login: When using an existing profile from social or other networks: profile data (username);

  • Placing an Order: Full name, email address, delivery address (yours or a third party’s specified by you), contact phone number (yours or a third party’s). If you provide third-party data, we process it based on your order, assuming you have informed that party beforehand;

  • vPOS Payments: When paying via the virtual vPOS terminal supported on the website: payment and security details resulting from approved transactions, purchase amount, etc.;

  • Sales Documentation: Data required to issue sales records under applicable legislation based on the payment method: unique order number, quantity/value of items, unit price, total amount, payment method(s), full name, phone number, and address;

  • Newsletter Subscription: Email address for administering newsletter distribution to requesting customers;

  • Customer Communication: Email address, name, and phone number when inquiries are sent via email.

FOR WHAT PURPOSES DO WE USE YOUR PERSONAL DATA?

The primary purposes for using your personal data relate to fulfilling your order and ensuring security during purchase, alongside complying with legal obligations as an e-commerce merchant.

We will not process your personal data for purposes other than those initially collected, unless there is a clear compatibility between the original and subsequent processing goals.

The purposes of processing may change over time, but we will always inform you whenever updates occur.

Processing Purposes Include:

  • Management and operation of the Online Store;

  • Fulfillment of placed orders and execution or termination of sales contracts;

  • Accounting and issuance of documents registering sales according to payment methods and regulatory requirements;

  • Management of your User Profile in the Online Store;

  • Management and sending of Newsletters.

LEGAL GROUNDS FOR PROCESSING YOUR PERSONAL DATA

The legal grounds for processing your personal data depend on the purposes of collection and our relationship with you (e.g., contract for purchasing goods). If our purposes change, we will ensure processing remains lawful and based on an appropriate legal ground.

Legal Basis Overview:

  1. Performance of a Contract / Pre-contractual Steps:

    Processing is primarily based on Article 6(1)(b) GDPR for taking steps at your request prior to entering into a contract or for executing an established contract for distance sales via the Online Store.

  2. Legal Obligations:

    Pursuant to applicable tax, social security, and consumer legislation (including e-commerce regulation). Even after contract termination or execution, certain data is retained as required by law (e.g., tax and accounting records retained within deadlines specified under the Tax and Social Security Procedure Code).

  3. Explicit Prior Consent:

    Processing personal data for newsletter delivery and related communication relies on Article 6(1)(a) GDPR (your explicit prior consent). Where consent is provided for specific processing (e.g., cookie usage for newsletter delivery), you may withdraw it at any time.

ABOUT COOKIES

A cookie is a small piece of text or data sent by our website to your device (computer, laptop, tablet, phone) for storage. It can be retrieved by us to gather information for purposes disclosed to you prior to deployment—such as statistical, marketing, or essential functional features.

Detailed information regarding cookies used by our Online Store is available in our Cookie Policy published on the website.

DISCLOSURE OF YOUR PERSONAL DATA

In certain cases, Decantus Wines may disclose personal information to strategic partners—controllers or processors—providing products and services related to our operations:

  • Payment Processing: You provide details necessary to complete payments via UniCredit’s virtual environment (UniCredit / BORICA Virtual POS Terminal) redirected from our store. After successful transaction processing, you return to www.decantuswines.com.

  • Courier Services: We transfer necessary details to courier companies to deliver your order.

  • Public Authorities: Data may be disclosed upon written request from a public authority acting within its statutory powers.

Whenever data is processed by third parties acting as Data Processors, we take measures to ensure they follow strictly documented instructions and maintain our data protection standards.

Processors include:

  • IT Maintenance: Providers ensuring secure infrastructure operation and data safety.

  • Web Hosting: Service providers hosting our website database.

  • Third-party Scripts: Entities placing scripts or cookies on your device during website visits (e.g., Google, Facebook).

PROTECTION OF PERSONAL INFORMATION

Decantus Wines applies organizational, technical, and physical safeguards to protect personal information against loss, theft, misuse, unauthorized access, disclosure, alteration, or destruction.

  • Communication with the UniCredit vPOS payment server occurs exclusively via encrypted SSL protocol to ensure maximum security for connection and transferred transaction data.

  • All employees, including administrators of the Online Store site, are bound by strict confidentiality obligations and technical protection protocols. Access is granted strictly on a need-to-know basis.

  • Contracts with third parties (such as product suppliers or ad networks like Google Ads/Facebook) contain mechanisms ensuring compliance with agreed data security standards.

DATA RETENTION

Personal data collected through Online Store forms is stored in our secure information systems. Storage duration depends on processing purposes, legal grounds, and statutory retention periods.

  • Cookie Data: Retained per the timelines outlined in our Cookie Policy.

  • Anonymization / Erasure: Upon expiration of retention terms, data is anonymized or deleted/destroyed unless a restriction or erasure request is exercised earlier.

  • Order / Contract Data: Retained for 5 years following the expiration of the limitation period for settling related public obligations, or longer if legal disputes arise until finalized by a binding court decision.

  • Accounting / Financial Documents: Invoices, electronic fiscal receipts, and hand-over protocols are retained for the statutory 5-year period following order execution or contract termination, unless longer periods are mandated by law.

  • Payment Credentials: We do not store or access credit card credentials processed by the vPOS terminal; transaction results are handled directly by the bank and BORICA under statutory timelines.

  • Newsletter Subscriptions: Retained until you unsubscribe or request removal.

  • General Data: Personal data lacking explicit legal retention mandates is deleted once original collection purposes are achieved.

YOUR RIGHTS REGARDING YOUR PERSONAL DATA

You hold the following rights, which can be exercised independently or in combination at any time:

  1. Right to Information:

    Request details regarding what data is processed, processing purposes, retention periods, legal grounds, and access categories/recipients.

  2. Right of Access:

    Receive copies of stored personal data within 15 business days of request. Cookie data will be supplied in a machine-readable format within 15 business days via your preferred electronic channel.

  3. Right to Data Portability:

    Obtain processed personal data in a structured, machine-readable format within 30 business days for transfer to another Controller. Requests submitted more than twice per year may incur reasonable administrative fees disclosed in advance.

  4. Right to Rectification:

    Request correction of inaccurate or incomplete personal data within 10 business days.

  5. Right to Restriction of Processing:

    Request temporary restriction of processing if you object to specific processing operations, contest accuracy, or pursue legal/CPDP claims.

  6. Right to Erasure (“Right to be Forgotten”):

    Request immediate deletion of personal data if processed unlawfully or if no longer necessary for original collection purposes, subject to mandatory statutory storage requirements.

  7. Right to Object (Legitimate Interest):

    Object to data processing carried out under legitimate interests. We evaluate objections within 30 days with a reasoned decision regarding acceptance or rejection.

  8. Withdrawal of Consent:

    Withdraw consent for specific processing (e.g., newsletters) at any time by contacting info@decantuswines.com. Reminders regarding consent status are sent at intervals not exceeding 6 months.

  9. Right to Lodge a Complaint:

    Lodge complaints directly with the Commission for Personal Data Protection (CPDP) or contact us first at info@decantuswines.com for resolution.

HOW TO EXERCISE YOUR RIGHTS

To exercise your rights or submit requests regarding your data, you can submit a written application containing:

  • Date, signature (electronic or wet signature);

  • Identification details (full name, phone number, email address);

  • Description of the request and preferred communication channel;

  • Power of attorney if submitted via a representative.

Submission Methods:

  • In Person: Sofia 1202, 11 Industrialna Str., Bulgaria

  • By Post: Sent to our office address above

  • By Email: info@decantuswines.com

Note: If reasonable doubts exist regarding identity, additional verification information may be requested before processing the request. Requests may be partially or fully refused if restrictions are provided for by law.

CHILDREN’S DATA

We do not intentionally collect personal data from individuals under 18 years of age. Selling alcoholic beverages to individuals under 18 is strictly prohibited by law.

If we learn that personal information of a child under 18 has been collected, we will take steps to delete the information as soon as possible. Parents or legal guardians who discover that a minor under their care has submitted personal data to Decantus Wines can contact us immediately at the addresses provided above for prompt removal.