Privacy Policy

Information about the Personal Data Administrator

“Lotos Trading Ltd.” is a company registered in the Commercial Register of the Registry Agency with UIC: BG148063310, email: ivento-eu@gmail.com, and phone: 052 390 333.

Legal Grounds and Purposes for Processing Your Personal Data

We process your personal data based on the following grounds:

• The Terms of Use of the Website;
• Your explicit consent – the specific purpose is indicated in each case;
• A legal obligation as required by law.

In the following paragraphs, you will find detailed information regarding the processing of your personal data depending on the legal basis under which we process it.

For Contract Execution

We process your personal data for the purposes of using the Website in accordance with the Terms of Use.

Purposes of Processing (where applicable):

• Verifying your identity;
• Providing the functionalities of our website.

On this basis, we process only personal data related to your user account.

The data collected on this basis is deleted 2 years after the termination of the contractual relationship, regardless of whether it is due to contract expiration, termination, or any other reason.

Based on Your Consent

We process your personal data on this basis only with your explicit, unambiguous, and voluntary consent. Refusal to provide consent will not result in any adverse consequences for you.

Consent is a separate legal basis for processing your personal data, and the purpose of processing is specified in the consent itself. It does not overlap with the purposes listed in this policy. If you provide consent, and until its withdrawal or the termination of any contractual relationships, we may create personalized offers for products/services based on detailed analysis of your primary personal data.

Data Processed on This Basis:

On this basis, we may process personal data for the purposes of direct marketing, including data on website usage and social media profile information.

Sharing Data with Third Parties

On this basis, we may provide your data to marketing agencies, Facebook, Google, or other similar entities.

Withdrawal of Consent

You may withdraw your consent at any time. The withdrawal of consent does not affect the fulfillment of contractual obligations. If you withdraw your consent for one or all of the processing activities described above, we will cease using your personal data for those specific purposes.

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

To withdraw your consent, you can simply use our website or contact us using the provided contact details.

When We Delete Data Collected on This Basis

Data collected on this basis is deleted upon your request or 12 months after its initial collection.

How We Protect Your Personal Data

To ensure adequate protection of company and customer data, we implement all necessary organizational and technical measures as required by the Personal Data Protection Act.

The company has established rules to prevent misuse and security breaches, supporting the processes of protecting and safeguarding your data.

For maximum security in processing, transmission, and storage of your data, we may use additional protection mechanisms, such as encryption, pseudonymization, and others.

User Rights

Every user of the website is entitled to all data protection rights under Bulgarian law and European Union regulations.

Users can exercise their rights by sending a request to our email.

Every user has the right to:

• Be informed (regarding the processing of their personal data by the administrator);
• Access their personal data;
• Rectification (if the data is inaccurate);
• Erasure of personal data (the “right to be forgotten”);
• Restriction of processing by the administrator or data processor;
• Data portability between different administrators;
• Object to the processing of their personal data;
• Not be subject to automated decision-making, including profiling, which produces legal effects concerning them or similarly significantly affects them;
• Seek legal or administrative protection if their rights have been violated.

Right to Erasure (“Right to be Forgotten”)

The user may request data deletion if one of the following conditions applies:

• The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
• The user withdraws their consent, which was the basis for processing, and no other legal grounds exist for the processing;
• The user objects to the processing, and there are no overriding legitimate grounds for processing;
• The personal data has been processed unlawfully;
• The personal data must be erased to comply with a legal obligation under EU or Member State law applicable to the administrator;
• The personal data was collected in connection with the provision of information society services to children, and consent was given by the holder of parental responsibility.

Right to Restrict Processing

The user has the right to restrict the processing of their personal data by the administrator when:

• They contest the accuracy of the personal data. In this case, processing is restricted for a period allowing the administrator to verify the accuracy of the personal data;
• Processing is unlawful, but the user does not wish for the personal data to be erased and instead requests restriction of its use;
• The administrator no longer needs the personal data for processing purposes, but the user requires it for legal claims;
• They object to processing, pending verification of whether the administrator’s legitimate grounds override the user’s interests.

Right to Data Portability

The data subject has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used, and machine-readable format and has the right to transfer this data to another controller without hindrance from the controller to whom the personal data was provided. This applies when processing is based on consent or contractual obligation and is carried out by automated means.

When exercising the right to data portability, the data subject also has the right to have their personal data transferred directly from one controller to another, where technically feasible.

Right to Object

Users have the right to object to the processing of their personal data by the controller. The controller is required to cease processing, unless they can demonstrate compelling legitimate grounds for processing that override the interests, rights, and freedoms of the data subject, or if the processing is necessary for the establishment, exercise, or defense of legal claims.

If an objection is raised against the processing of personal data for direct marketing purposes, processing must be stopped immediately.

Complaint to the Supervisory Authority

Every user has the right to file a complaint against the unlawful processing of their personal data with the Commission for Personal Data Protection or the competent court.

Useful links