Mandatory rules

POLICY FOR THE PROTECTION OF PERSONAL DATA OF NATURAL PERSONS

This document presents the Policy for the protection of personal data of individuals ("Policy") and is related to the General Terms and Conditions, but does not form an integral part thereof, as it does not regulate specific rights or obligations, but aims to inform users about what personal data we collect, how we process it, for what purposes, and what protective measures are applied. Through this Policy, we also provide information about the rights that you, our customers and users, have with regard to the processing of personal data by "Havayavahana" Ltd. Any changes to the Policy will be announced publicly in this document.

Last update: January 17, 2025

Your privacy is extremely important to us. This policy describes what personal data we collect in connection with our mutual relationship and how we use this information.

PERSONAL DATA ADMINISTRATOR

Havayavahana Ltd., UIC: 207671121, with registered office and address: Sofia, 37 Chumerna St., fl. 1, email: [email protected] (hereinafter referred to as "Havayavahana", "we", "online store", "site", "website", "administrator") is the administrator of data, including personal data, collected through the use of the site www.hva.bg or when making a purchase through it, as well as when using services or placing an order through our Facebook page (hereinafter referred to as "Site," "website" for brevity).

This Policy also applies to cases where you, as a natural person (hereinafter referred to as "subject"), voluntarily provide us with personal data by email, telephone, in person at a commercial outlet, or through other channels. Havayahavana processes personal data in response to your inquiries, as well as for marketing, advertising, and promotional purposes, participation in campaigns and sweepstakes, and other lawful activities.

The processing of personal data is carried out in strict compliance with all applicable regulatory provisions, including, but not limited to, Regulation (EU) 2016/679 (GDPR) and the Personal Data Protection Act, as the security of your information is of utmost importance to us.

SCOPE OF THE POLICY

This Policy applies to all our customers – individuals who use our services by placing orders on the Website or by sending inquiries (referred to as "data subjects" or "users").

Partners and external parties working with or for Havayavahana who have access to personal data are required to familiarize themselves with and comply with this Policy. No third party has the right to access personal data without a confidentiality agreement that imposes obligations as strict as those we have undertaken. Hawaiawaha reserves the right to conduct checks on compliance with these conditions.

The Policy also applies to employees, subcontractors, and suppliers with whom Havaivahana has contractual relationships. Violation of the GDPR is considered a disciplinary offense or a breach of contractual obligation, and in case of suspicion of a crime, the case is referred to the competent authorities without delay.

For visitors to the website who do not use services but only view content, the Cookie Policy published on the website applies.

DEFINITIONS

(remain unchanged here due to their legal nature, with minimal edits for clarity)

Regulation (GDPR) – General Data Protection Regulation (EU) 2016/679, aimed at protecting the personal rights of individuals and ensuring informed and voluntary data processing.
Personal data – Any information relating to an identified or identifiable natural person.
Processing – Any operation or set of operations performed on personal data, such as collection, storage, alteration, transmission, destruction, etc.
Controller – A person or entity that, alone or jointly with others, determines the purposes and means of processing personal data.
Data subject – A natural person whose information is processed by the controller.
Consent – Voluntary, specific, informed, and unambiguous agreement to the processing of personal data.
Profiling – Automated processing of data to evaluate or predict aspects of a person's behavior, preferences, or location.
Recipient – A person or organization to whom personal data is disclosed.
Third party – Any person or body other than the data subject, the controller, and the processor.

DATA PROCESSING PRINCIPLES

We follow basic principles, including: lawfulness, transparency, purpose limitation, data minimization, accuracy, storage limitation, confidentiality, and accountability.

CATEGORIES OF DATA SUBJECTS

In the course of its activities, Hawaiawaha processes information about:

Persons who use the site without registering and without providing personal data (anonymous data is processed).
Unregistered users who have voluntarily provided data (phone number, email address).
Registered users who have provided their name, address, email, billing information, etc.
Individuals who have sent inquiries or complaints via telephone, email, the website, etc.
Individuals who participate in games, surveys, initiatives, events, and campaigns.
Persons with whom we have contractual relationships (including distance contracts).
Persons whose data has been provided by a third party (e.g. when ordering a gift).
Persons whose data we have received for the purpose of publishing their opinion publicly on the website;
What personal data we process

We collect and process only data that is necessary for the performance of a specific service, contract, or legal obligation. We do not collect special categories of personal data within the meaning of Articles 9 and 10 of Regulation (EU) 2016/679 (GDPR), unless you have provided them yourself on your own initiative.

1. Order data

When placing an order, you must provide the following information:

Names
Email address
Contact telephone number
Delivery address
Payment details (e.g., credit card)
Billing details (including personal identification number when issuing an invoice to a natural person)

If the order is for a third party (e.g. a gift), you are responsible for providing their personal data.

2. Data when registering on the website

If you decide to create a user account, in addition to the above data, the following is also stored:

Order history
IP address
Date and time of registration
Account login and terms and conditions acceptance logs

3. Data for other contracts

When concluding other contracts (other than online orders) with individuals, we collect:

Full name
Personal identification number
Address
Email address

4. Data from social networks and external applications

If you connect or register through social networks (e.g., Facebook), we may have access to:

Names
Email
Phone number
Gender, age, education
Photo, place of residence, marital status
Information about activity, interests, etc.

This only happens after you have explicitly activated this connection.

Important: Social networks have their own privacy policies. We recommend that you familiarize yourself with them before sending us data through these channels.

5. Data in comments and publications

When you post a comment on the site, we store:

Names (if you have entered them)
Email
IP address

This data is used to protect against abuse and is stored in accordance with the Electronic Document and Electronic Certification Services Act (EDECA) for a period of 1 year.

6. Data when applying for a job

When processing applications and concluding employment contracts, we collect:

Names
Personal identification number
Address
Gender, age
Data on education, work experience, qualifications
Bank details
Health data (after admission)

7. Data for correspondence, complaints, and reports

When submitting inquiries, complaints, and reports, we store:

Names
Email
Phone number
Address
Results of the report processing

8. Technical data when using the website

We automatically collect data from the device used:

IP address
Device and browser type
Search history
Data on sessions and actions on the website
Security and support logs
Location information (if you have given your consent)

We also use cookies. You can find more information about them in our [Cookie Policy].

What we do not do

We do not process data revealing ethnic origin, religious beliefs, health status, sexual orientation, and other sensitive categories, unless you have provided it voluntarily.
We do not transfer your personal data to countries outside the EU.
We do not use automated decision-making (profiling).
We do not collect data from persons under the age of 16. If you are under this age, please do not provide us with personal data.

PURPOSE OF PROCESSING YOUR PERSONAL DATA

The main reason why Havayahavana processes your personal data is to provide services through the website and social networks. This includes concluding distance sales contracts, delivering the products and services you have ordered, and accounting for revenue. In addition, we use your information to optimize the Services we offer, provide you with a personalized experience on the site, communicate with you about your profile or requests, provide customer service, and for targeted advertising and marketing tailored to your preferences. In certain cases, your data is also used to detect and investigate fraudulent or illegal activities.

Havayavahana collects, stores, and uses the information described above for the following purposes:

Concluding a contract for the purchase of goods or services remotely through our Website or social networks – we require your identification, contact, and payment details in order to fulfill the contract and deliver the order;
Concluding a consumer credit agreement when you have chosen to purchase goods through financing;
Processing payments and preventing fraudulent transactions – in certain cases, we may provide your data to third parties to perform these activities;
Employee recruitment – when submitting a resume or entering into an employment contract;
Protecting the legitimate interests of other users, third parties, and the platform itself – these interests may include:
detecting and resolving technical issues and functionality errors;
- developing and improving the services and purpose of the site;
- communicating with you on important matters regarding the Services or contractual relationships;
- offering offers, promotions, and updates tailored to your preferences;
- processing signals, complaints, inquiries, and other correspondence;
- protecting the rights and legitimate interests of the company, including through legal action, as well as assisting in the protection of other users and/or third parties;
administering the website and application to ensure security;
analyzing and improving user behavior on the website and in the application;
- measuring the effectiveness of advertisements and providing offers and recommendations based on your behavior;
contacting you about your profile – if necessary, we may use automated calling and messaging systems;
- sending information about new products or services through your chosen communication channels (email, SMS, post, social networks) – only with your explicit consent.

Additional purposes include:

Website registration – we use your personal data to create, maintain, and update your account (e.g., change of address or marketing communication settings);
Organizing and managing games, sweepstakes, and promotional campaigns conducted by Havayavahana;
Providing location-based services, such as localized advertising, search results, and personalized content;
Compliance with regulatory obligations, including, but not limited to:
obligations to store or provide information to the state (e.g., under the Accounting Act, VAT Act, Income Tax Act, the Corporate Income Tax Act, the Tax and Social Security Procedure Code, and other applicable laws);
compliance with requirements set forth in the Labor Code, the Commercial Register and Register of Non-Profit Legal Entities Act, etc.;
- actions imposed by competent state or judicial authorities (e.g. on the basis of the Law on the Ministry of Interior, the Criminal Procedure Code, the Electronic Communications Act);
- compliance with obligations arising from Regulation (EU) 2016/679 on the protection of personal data, including notifications regarding your rights or data security;
- obligations under the Consumer Protection Act, including ensuring the right of withdrawal and legal guarantees;
protection of the interests of Havayavahana in the event of legal disputes.

In certain cases, we process data based on your explicit consent – this happens when there is no other legal basis (law or legitimate interest) for the processing. Most often, this is necessary when sending messages about new products, promotions, events, etc.
RETENTION PERIOD OF YOUR PERSONAL DATA

When administering personal information, WE apply the basic principle of limiting storage to the minimum necessary volume and for a period that does not exceed that necessary for the provision of the Services, the performance of contractual obligations, ensuring their security and sustainability, as well as compliance with applicable law. We will retain your personal information for the time necessary to achieve the purposes set out in this Privacy Policy, unless an extension of this period is required by law or based on our legitimate interest. Depending on the nature of the data and the purposes for which it was collected, a specific storage period is determined, after which the relevant information is irretrievably deleted.

Data category | Storage period | Legal basis | Explanations

Registration data (first name, last name, email, phone number, address) \
and \
information about the registration process and acceptance of the General Terms and Conditions (date, time, IP address)

Retention period \
Until termination of the user profile and up to 5 (five) years thereafter
Legal basis \
Performance of contractual obligations; compliance with regulatory obligations; protection of legitimate interests

Your data identifies you as a registered user on the Site. In order to resolve any disputes that may arise after termination of registration, and in connection with the ZEDEUU (see below), the information is stored for up to 5 years after deactivation of the account. \
Important: According to the ZEDEUU, part of this information (e.g., IP address, activity) must be stored for 1 year after termination of the account, with the extended period intended to protect the legitimate interests of the administrator.

Personal data related to orders, invoices, payment documents, reports, and other accounting documentation

Term \
Up to 5 years after the termination of the relevant legal relationship; certain documents are stored from 5 to 50 years in accordance with accounting requirements
Legal basis \
Compliance with legal obligations and protection of the legal interests of the administrator

The data is stored to certify the performance of a distance selling contract, to protect your consumer rights (including legal guarantees), and in view of our tax and social security obligations. \
Pursuant to Article 38 of the Tax and Social Security Procedure Code:

payroll records – 50 years,
accounting records and reports – 10 years,
tax and social security control documents – 5 years after the expiry of the limitation period for the public obligation. \
Pursuant to Article 38, paragraph 2, after the expiry of the relevant period, the media may be destroyed if they are not subject to transfer to the National Archives.

Personal data from correspondence, complaints, reports, requests, initiatives

Term \
Up to 5 (five) years, in accordance with the terms of the Obligations and Contracts Act
Legal basis \
Protection of the legitimate interests of the controller

Information related to correspondence, complaints, etc. is stored for the purpose of reviewing and responding to them, including resolving disputes that have arisen. The data is processed and stored in accordance with the time limits for bringing claims under the applicable legislation.

Logs certifying the submission of a comment, order, or other statement (including sender, recipient, date, and time)

Term \
From 1 to 5 years
Legal basis \
Compliance with regulatory provisions and protection of the legitimate interests of the administrator

The sending of an electronic statement (such as a comment, inquiry, etc.) is treated in accordance with the Electronic Document and Electronic Signature Act, which is why a log of this action must be kept for at least 1 year. If there is a legitimate interest, this period may be extended to 5 years.

Quick searches (do not contain personal information)

Term \
Until deleted by the user, until the account is closed, or up to 6 months if used without registration
Legal basis \
Consent of the subject and legitimate interest

This feature makes it easier for users to repeat searches. The data can be deleted at any time via the browser you use.

System settings and logs (do not contain personal data, but may include date, IP, URL, browser, and device)

Duration \
Until they are deleted by the user or the account is deactivated. If stored in cookies – between 6 and 12 months from last use
Legal basis \
Consent of the data subject; compliance with regulatory obligations; legitimate interest

Covers settings such as selected language, interface, and other personalizations that can be adjusted through the browser. Server logs and security device logs are important for diagnosing and preventing malicious activity.

Information in mobile application

Duration \
While you use the application (until uninstalled)
Scope \
Data necessary for the technical functioning of the Services (e.g., settings)

Cookies

Duration \
Between 6 and 12 months, depending on the type and settings of the browser
Legal basis \
Consent and legitimate interest

For details, see "Cookie Policy"

Exceptions to the specified periods

Please note that your personal data will not be deleted or anonymized if it is required in connection with pending legal, administrative, or arbitration proceedings, including a complaint filed against us. Deletion will only take place once the need for storage has ceased, which may exceed the above-mentioned time limits.

You can request the deletion of specific data or the deactivation of your account at any time. We will comply with this request, retaining only information that is required by law or necessary to protect our legitimate interests. In certain cases, in order to comply with regulatory obligations, prevent fraud, or protect our rights, we may retain your data even after your account has been closed, for a limited period of time.

To ensure continuity of service and protect against loss of information due to technical reasons, the Site has an archiving policy. The maximum period for the final deletion of data from backup copies is 30 days.

TRANSFER OF YOUR PERSONAL DATA TO THIRD PARTIES

Havayavahana and the website do not transfer your personal data to external parties unless there is a legal basis for doing so – a legal obligation, contractual commitments, the existence of a legitimate or vital interest, or your express consent. We strive to minimize the amount of personal information we disclose, and this is always closely related to the specific purpose. We do not sell, rent, or otherwise disclose your personal information to third parties for their marketing or advertising activities without your prior consent. We guarantee that access to your data by private entities—third parties—is carried out in accordance with legal requirements in the field of personal information protection and confidentiality, based on contracts concluded with them.

We may be required to provide your data in the event of a legal obligation. In certain situations, "Havayavahana" is required to provide your information to government institutions such as the police, the prosecutor's office, or the court in connection with the prevention or investigation of crimes. This also includes the exchange of information with other companies and organizations for the purpose of combating fraud and reducing credit risk. Please be aware that if we are required by the police or other government or regulatory authority investigating alleged illegal activities to provide information about you, we have the right to do so after verifying the legality of the request.

When we generate revenue from sales, we may be required by tax authorities to provide information related to orders placed, including personal data. In this regard, we provide such information to the accounting companies we work with. The website and "Havayavahana" have a regulatory obligation to ensure the security of the networks and data they process. To this end, we implement various measures that in certain cases require the processing of personal data by IT companies responsible for our cybersecurity.

In the context of a contractual obligation, your data may be provided if a distance selling contract has been concluded between you and us, under which we must deliver the product or service you have chosen by courier. The same applies to payments made through bank, payment, or credit intermediaries with whom you personally share your data or authorize us to do so on your behalf. When insuring a product or service through our website, your personal data is transferred to the relevant insurance company. In the case of installation by an external contractor, we may share your data with them in order to perform the relevant service or warranty activity.

The legitimate interest of "Havayavahana" in certain cases justifies the transfer of personal data to third parties. This applies to administrative proceedings before institutions such as the Personal Data Protection Commission, the Consumer Protection Commission, and other state authorities. A legitimate interest also exists when we assign specific tasks to external companies or individuals—such as subcontractors under data processing agreements—who assist in the provision of our services. With your explicit consent, we may provide certain personal data to companies offering marketing or telemarketing services, as well as to partners with whom we carry out joint initiatives to promote products and services.
Our website may include links to and from third-party websites. If you follow such a link, please note that these sites have their own privacy policies, for which we are not responsible. We recommend that you review them before providing personal information. The site uses the services of YouTube LLC, represented by Google Inc., to embed video content. Normally, when you load such a page, your IP address is sent to YouTube and cookies are installed. However, the videos on our site are embedded with enhanced privacy mode enabled – in this case, according to Google's policy, your personal data is not used directly. YouTube does not store information about visitors unless the video is played. If you do so and are logged into your YouTube account, this activity will be associated with your account. You can avoid this by logging out of your account before watching the video. We do not have detailed information about the possible collection and use of your data by YouTube. For more information, see Google's privacy policy at: www.google.com/intl/bg/policies/privacy/.

TO WHICH COUNTRIES DO WE TRANSFER YOUR PERSONAL DATA

We currently store and process your personal data within the territory of the Republic of Bulgaria.

However, some of your data may be transferred to entities located within or outside the European Union, including countries for which the European Commission has not established an adequate level of personal data protection. Whenever we transfer data internationally, we take the necessary steps to protect your rights and interests. These transfers are based on contractual commitments and, where applicable, additional safeguards such as standard contractual clauses approved by the European Commission or certification mechanisms such as the EU-US Privacy Shield for transfers between the EU and the US.

You can contact us at any time using the contact details provided at the end of this Policy to obtain details about the countries to which we transfer your personal data and the safeguards we apply in relation to these transfers.

YOUR RIGHTS REGARDING YOUR PERSONAL DATA

Under the provisions of the General Data Protection Regulation (GDPR), you have the following rights:

Right to be informed

This document is intended to provide you with detailed information about how your personal data is processed. In the event of a potential risk to the security of this data, the controller is obliged to inform you of the nature of the breach, the measures taken to remedy it, and whether the supervisory authority has been notified. In addition, you have the right to request information about any third parties to whom personal data subject to correction, deletion, or restriction of processing has been disclosed.

Right of access

You have the right to obtain confirmation as to whether your personal data is being processed, as well as access to that data and information about the purposes of the processing, the categories of data, the recipients, the storage period, and your rights. Requests must be made in writing or electronically and addressed to the controller. Upon such request, you will be provided with a copy of the personal data being processed in an appropriate format.

Right to rectification

You may request that your personal data be updated or corrected if it is incomplete or inaccurate. Registered users can do this directly through their profile on the platform, and unregistered persons can do so by submitting an official request to the administrator. The response will be provided in writing to the email address you specify.

Right to erasure ("right to be forgotten") and account closure

You have the right to request the removal of your personal data without undue delay. The administrator is obliged to delete it from all its systems and to inform third parties to whom it has been provided.
You can also close your user profile at any time, as this functionality is available through the user panel. After closure, your data will be deleted, except in cases where storage is required by law (e.g., ZES, ZEDEUU). Backups are updated (deleted) within 30 days.
Deletion may be requested if any of the following conditions apply, in accordance with the GDPR:

The data is no longer necessary for the initial purpose of processing;
You have withdrawn your consent;
You have objected to the processing and there are no overriding legal grounds;
The data is being processed unlawfully;
Erasure is necessary for compliance with a legal obligation;
The data has been collected in relation to the provision of information society services.

The controller may refuse to erase the data if there is a legal basis or regulatory obligation to do so. You will be informed in a timely manner in such a case. Exceptions include processing:

for the exercise of the right of expression and information;
for the performance of a legal obligation or task in the public interest;
for reasons related to public health;
for scientific, historical, or statistical purposes;
for the establishment, exercise, or defense of legal claims.

Right to restriction of processing

You may request restriction of the processing of your data if at least one of the following conditions is met:
you believe that the data is inaccurate – the restriction applies until verification is completed;
the processing is unlawful, but you do not want the data to be deleted, only restricted;
the controller does not need the data, but you need it for legal action;
you have lodged an objection and a decision on the legal grounds of the controller is pending.

Right to notify third parties

Where appropriate, you may request the controller to notify all third parties to whom your data has been disclosed of its rectification, erasure, or restriction of processing.

Right to data portability

You have the option to receive your personal data in a structured and machine-readable format and to transfer it to another controller when the processing is based on consent or a contract and is carried out by automated means.
Important: You are solely responsible for the storage and any consequences of sharing this data with other controllers.
Right not to be subject to automated decision-making

You have the right not to be subject to fully automated decision-making, including profiling, which has legal or significant consequences for you, unless there are grounds provided for in the applicable legislation and there are appropriate safeguards for your rights and interests.

Right to withdraw consent

You may withdraw your consent at any time, without affecting the lawfulness of the processing until the moment of withdrawal. For example, you can unsubscribe from email notifications at any time. When withdrawing your consent, we may request confirmation of your identity.

Right to object

You have the right to object to the processing of personal data based on legitimate interest. If the objection is justified, we will stop processing unless there are compelling legal grounds or a need to protect legal claims.
Right to lodge a complaint with a supervisory authority
You may lodge a complaint with a supervisory authority if you believe that your personal data is being processed in violation of applicable laws. In the Republic of Bulgaria, this is: \
Commission for Personal Data Protection \
Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd. Email: [email protected]
Website: www.cpdp.bg
Phone: 02 915 3 518
HOW YOU CAN EXERCISE YOUR RIGHTS.
HOW YOU CAN EXERCISE YOUR RIGHTS. RESPONSE TIMES
You may exercise the above rights free of charge at any time by email or by submitting a request to the addresses listed in the contact form on the Website or at the end of this Privacy Policy. Requests may be addressed to the administrator or directly to the Data Protection Officer. Requests should be submitted in a manner that allows the sender to be identified. In some cases, technical methods may be used to exercise rights, for example, through an unsubscribe button. The administrator is obliged to respond to the request or to rule on the exercised right at the address specified in the request, including electronically, within one month of receipt.
If the rights are exercised unreasonably or excessively, for example due to repetition, we reserve the right to impose a reasonable fee, taking into account the administrative costs of providing the information or communication or performing the requested actions. In such cases, we will inform you of the applicable fees before considering your request.
ACCURACY OF INFORMATION

We are not responsible for the accuracy of the data you provide and do not verify its accuracy. We cannot guarantee the actual identity of the persons who provided the information. If you have any doubts or discover fraud or abuse, please notify us immediately. You undertake not to violate the rights of third parties related to the protection of their personal data or other rights when providing information on the Site.

GENERAL INFORMATION ABOUT THE POLICY

This Personal Data Protection Policy may be amended or supplemented in accordance with changes in applicable Bulgarian or European legislation, at the initiative of Hawaiawahana or by decision of a competent authority. Users will be informed of any changes or additions by publishing the updated version of the Personal Data Policy on our website. We recommend that users regularly check the latest updated version of this Policy on the Hawaivahana website.
HOW WE PROTECT YOUR RIGHTS

SECURITY MEASURES

In order to ensure maximum protection of the data of the company, our customers, users, contractors, and visitors to the Site, WE apply all necessary organizational and technical measures in accordance with the General Data Protection Regulation and the Personal Data Protection Act, as well as best international practices. We have established effective physical, electronic, and administrative procedures to protect the collected data from accidental or unlawful destruction, loss, alteration, unauthorized access, or disclosure.
Your data is stored on secure servers using modern cryptographic technologies and backup copies. The company has adopted the necessary internal rules and procedures related to the lawful processing of your personal data, including a Data Breach Response Plan, and has established structures to prevent abuse and security breaches. A Data Protection Officer has been appointed to coordinate the processes for the lawful processing and protection of your data.

Access to your personal data is restricted to those employees, service providers, or related parties who need the information to perform their job duties. All employees are trained to comply with internal rules and to accept the relevant security and confidentiality commitments before being granted access to personal data.

COOKIE POLICY

Part of this Privacy Policy is the Cookie Policy, which is published and available both on the Website and on our Facebook page.

CONTACT US

DATA PROTECTION OFFICER

If you have any questions or requests regarding the exercise of your personal data protection rights, you can contact Hawaiawaha via the contact email address provided on the Website.