REGARDING THE USE OF THE ONLINE STORE WWW.DECANTUSWINES.COM

Effective Date: June 22, 2023

1. WHO WE ARE

We are “Decantus Wines” LLC (Decantus Wines EOOD), Unified Identification Code (UIC): 207298366, registered address: 11 Industrialna Str., 1202 Sofia, Bulgaria (“Company”, “we”, “us”, “our”).

We are the seller of the goods offered in the online store www.decantuswines.com (“Online Store”) and the owner of the Online Store.

We encourage you to contact us if you have any questions, concerns, or objections regarding our processing of your personal data when browsing our website or purchasing through our Online Store.

CONTACT DETAILS

  • Registered Office and Management Address: 11 Industrialna Str., 1202 Sofia, Bulgaria

  • Phone: (+359) 879 00 00 17

  • Email: info@decantuswines.com

  • Website Contact Forms: Available directly at www.decantuswines.com

SUPERVISORY AUTHORITY

Commission for Personal Data Protection (CPDP / КЗЛД) You have the right to lodge a complaint directly with the supervisory authority if you believe your data protection rights have been violated.

  • Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria

  • Website: https://www.cpdp.bg/

  • Email: kzld@cpdp.bg

2. REGULATORY COMPLIANCE

The Online Store is operated in strict compliance with:

  • The Personal Data Protection Act of the Republic of Bulgaria (PDPA);

  • Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR);

  • Applicable EU and national e-commerce and consumer protection legislation.

As a data controller, we implement necessary technical and organizational security measures to protect your personal data and ensure the full execution of your rights under the GDPR.

3. DEFINITIONS

  • “Personal Data” – Any information relating to an identified or identifiable natural person (User/Data Subject), directly or indirectly (e.g., full name, email address, phone number, shipping address, IP address).

  • “Data Subject” – The natural person visiting, browsing, registering, or making purchases on the Online Store.

  • “Processing” – Any operation performed upon personal data, such as collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, restriction, erasure, or destruction.

  • “Data Controller” – “Decantus Wines” LLC, as the entity that determines the purposes and means of processing personal data.

  • “Data Processor” – A natural or legal person, public authority, agency, or other body that processes personal data on behalf of the Data Controller under explicit instructions.

4. WHAT PERSONAL DATA WE COLLECT

We strive to minimize data collection to what is strictly necessary to perform our e-commerce services:

  1. User Profile Registration: Full name, email address.

  2. Social Network Authentication: Public profile identifier (username) if logging in via third-party providers.

  3. Order Placement & Execution: Full name, email address, contact phone number, delivery address (yours or a specified third-party recipient). If providing third-party data, you confirm that you have notified them accordingly.

  4. Payment Transactions via Virtual POS (vPOS): Transaction confirmation codes, payment amount, order reference (we do not process or store sensitive credit card credentials).

  5. Billing & Financial Documentation: Order number, itemized goods purchased, unit and total prices, tax invoice details, name, phone number, and billing address.

  6. Newsletter Subscriptions: Email address (processed strictly upon voluntary opt-in).

  7. Customer Service Inquiries: Email address, name, phone number, and conversation history.

5. PURPOSES OF PROCESSING

We process personal data for the following specific purposes:

  • Management, operation, and administrative support of the Online Store;

  • Fulfillment, delivery, and administration of online purchases and distant sales contracts;

  • Invoicing, accounting compliance, and tax administration under applicable law;

  • Account registration and profile maintenance for registered users;

  • Direct marketing communication and newsletter management (upon prior consent).

6. LEGAL GROUNDS FOR PROCESSING

  • Performance of Contract / Pre-contractual Steps (Art. 6(1)(b) GDPR): Processing required to process orders, manage accounts, and deliver purchased goods.

  • Legal Obligation (Art. 6(1)(c) GDPR): Compliance with statutory tax, accounting, audit, consumer protection, and statutory record-keeping obligations.

  • Explicit Consent (Art. 6(1)(a) GDPR): Voluntary subscriptions to newsletters, marketing communications, or non-essential cookies. Consent can be revoked at any time.

  • Legitimate Interest (Art. 6(1)(f) GDPR): Website security, prevention of fraudulent transactions, system maintenance, and legal dispute defense.

7. RECIPIENTS AND DISCLOSURE OF DATA

Decantus Wines may disclose personal data only when necessary to trusted third parties:

  • Payment Gateways: UniCredit Bulbank / BORICA Virtual POS system (for payment processing).

  • Courier & Logistics Services: Courier firms handling package transit and home/office delivery.

  • Technical Infrastructure & IT Maintenance Providers: Hosting platforms, web development contractors, and security maintenance providers.

  • Public Authorities: State, tax, or law enforcement authorities upon formal written request under legal statutory mandate.

All third-party processors act under written contractual obligations to maintain identical data privacy standards.

8. DATA SECURITY

We employ physical, technical, and administrative measures to prevent loss, misuse, unauthorized access, alteration, or disclosure:

  • Encrypted communications via SSL/TLS protocols across web forms and payment gateways;

  • Strict access limitations based on role-based access control (RBAC);

  • Automated firewall and security monitoring solutions.

9. RETENTION PERIODS

  • E-Commerce Contracts & Orders: Retained for 5 years following the expiration of the general limitation period for legal claims or tax audits.

  • Financial & Accounting Records: Tax documents and sales receipts are retained for 5 to 10 years in accordance with national accounting and tax legislation.

  • Newsletter Data: Retained until consent is withdrawn or the subscription is cancelled.

  • Cookies & Web Data: Stored per the expiration terms defined in our Cookie Policy.

Upon expiration of storage periods, data is permanently erased or irreversibly anonymized.

10. YOUR RIGHTS UNDER GDPR

As a Data Subject, you have the following rights:

  1. Right to Information & Access: Request confirmation of processing and obtain copies of stored data within 15 business days.

  2. Right to Rectification: Request immediate correction of inaccurate data within 10 business days.

  3. Right to Erasure (“Right to be Forgotten”): Request deletion of data no longer required for legal or contractual purposes.

  4. Right to Restriction of Processing: Request temporary suspension of processing under disputed conditions.

  5. Right to Data Portability: Receive data in a structured, machine-readable format within 30 business days.

  6. Right to Object: Object to processing based on legitimate interests or direct marketing.

  7. Right to Withdraw Consent: Revoke consent at any time without affecting past lawful processing.

  8. Right to Lodge a Complaint: Appeal directly to the Commission for Personal Data Protection (CPDP).

11. HOW TO EXERCISE YOUR RIGHTS

To submit a data subject request, send a written application containing your name, email, contact details, and specific request description to:

  • Email: info@decantuswines.com

  • By Mail / In Person: “Decantus Wines” LLC, 11 Industrialna Str., 1202 Sofia, Bulgaria

Verification of identity may be requested before fulfilling data subject requests.

12. PROTECTION OF MINORS

Our services and products (alcoholic beverages) are intended strictly for persons 18 years of age or older. We do not knowingly collect personal data from minors. If we discover data submitted by a minor, it will be deleted immediately.