PRIVACY POLICY

1. INTRODUCTION
   

   This Privacy Policy (“Policy”) outlines the rules regarding the protection of personal data of individuals using the Website (“Platform”), owned by https://elixirika.com/.

   The Website fully complies with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “Regulation”), effective from 25.05.2018, and the Bulgarian Personal Data Protection Act (“PDPA”). By using the Website you accept and agree to comply with this Privacy Policy, the Cookie Policy, and the Website’s Terms and Conditions.

2. DEFINITIONS
   
   1. „Personal Data means any information relating to an identified or identifiable natural person (“Data Subject”) who can be identified, directly or indirectly, by reference to identifiers such as name, personal identification number, location data, gender, address, phone number, online identifier, or other identifiers specific to that person’s physical, physiological, genetic, mental, economic, cultural, or social identity.
   2. „Processing of Personal Data“ means any operation or set of operations performed on personal data, whether by automated or other means, including collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.
   3. „Data Subject“ refers to any natural person who is a User of the Website.
   4. „Website“ means the content hosted at the domain https://elixirika.com/ and its subdomains.
3. PRINCIPLES FOR DATA PROTECTION
   
   1. Lawfulness, Fairness, and Transparency
      

      We process your personal data lawfully, fairly, and transparently. Elixirika.com/ processes your data for the following purposes:

      1. Managing your request and executing a contract
         
         1. Contact information: full name, contact address, email, phone number
         2. Identification data: : full name, personal ID number, permanent address; for legal entities: company name, registration address, UIC, contact email and phone
         3. Communication records related to requests, complaints, and correspondence
      2. Maintaining records of correspondence for order fulfillment, problem resolution, and more
      3. Contacting users and sending relevant information
      4. Complying with legal obligations
   2. Purpose Limitation
      

      We collect and process data only for specific, legitimate purposes:

      1. Account creation and full access to the e-commerce functionality
      2. Order fulfillment
      3. Contractual identification
      4. Accounting
      5. Statistical analysis
      6. Information security
   3. Data Minimisation
      

      We collect only data that is adequate, relevant, and limited to what is necessary for the purposes for which it is processed. We use data anonymisation or pseudonymisation wherever applicable to reduce risks to data subjects.

   4. Accuracy
      

      We ensure data is accurate and kept up to date. Any inaccurate data will be corrected or deleted. The website is not liable for incorrectly submitted data by users.

   5. Storage Limitation
      

      Data is retained no longer than necessary. After account deletion or consent withdrawal, your data is deleted or anonymised without undue delay.

   6. Integrity and Confidentiality
      

      We process personal data in a way that ensures appropriate security, including protection against unauthorised or unlawful processing, accidental loss, destruction, or damage, using appropriate technical and organisational measures.

   We may disclose your personal data to competent authorities or legal entities when required by law.

4. USER RIGHTS
   

   Users are entitled to all rights under the GDPR and national legislation, including:

   1. Right of Access
      

      You may request confirmation of whether your data is processed, a copy of the data, and information including:

      1. Purposes of processing
      2. Data categories
      3. Data recipients
      4. Sources of data
      5. Storage period
      6. Your rights (rectification, erasure, objection, etc.)
      7. Automated decision-making, if applicable
      8. Data transfers outside the EU
   2. Right to Erasure (“Right to Be Forgotten”)
      

      You may request deletion of your data under certain circumstances, such as:

      1. Data no longer needed
      2. Consent withdrawal
      3. Unlawful processing
      4. Legal obligations
      5. Data collected from minors in relation to information society services
   3. Right to Data Portability
      

      You can request to receive your personal data in a structured, machine-readable format and have it transferred to another controller, provided:

      1. Processing is based on consent or contract
      2. Processing is automated
   4. Right to Object
      

      You may object to data processing. If processing is based on legitimate interest or for direct marketing, it must stop unless compelling legal grounds prevail.

5. PROCESSING OF ANONYMISED DATA
   

   We may use anonymised data for statistical and analytical purposes, where identification of the individual is not possible.

   1. Legal Requirements
      

      We process personal data when required by law, such as:

      1. Anti-money laundering regulations
      2. Consumer protection laws
      3. Accounting and tax compliance
      4. Legal proceedings
   2. Advertising & Remarketing
      

      We use tools like Google Ads, Meta Ads, Facebook Pixel, and Google Analytics to:

      1. Analyse user behavior for optimization
      2. Conduct demographic reporting
      3. Measure conversions and retarget ads based on site actions

      Users can opt out via their Google Ads Settings and Facebook Ad Preferences.

6. DATA RETENTION PERIODS
   

   Data is retained as follows:

   1. Accounting documents – 11 years (per Accounting Act)
   2. Legal obligations – 5 years (e.g., legal inquiries)
7. DATA SECURITY
   

   We apply industry-standard security measures (encryption, pseudonymisation, etc.) to protect personal data from unauthorised access or breaches, in compliance with applicable laws and best practices.

8. DATA PROTECTION OFFICER (DPO) RESPONSIBILITIES
   

   The DPO supports the controller and staff with:

   1. Legal guidance and training
   2. Monitoring compliance
   3. Conducting data protection impact assessments
   4. Serving as point of contact with supervisory authorities and users
9. INCIDENT REPORTING PROCEDURE
   

   You may lodge a complaint with the supervisory authority:

   Commission for Personal Data Protection

   Address: Prof. Tsvetan Lazarov Blvd. No. 2, Sofia 1592, Bulgaria
   Phone: +3592/91-53-518
   Website: www.cpdp.bg

10. CONTACT
    

    For questions or exercising your rights, please contact us via the contact details provided in the “Contact” section of the Website.

Date: 10.06.2025