Data Controller
Inofarm Ltd. is a company registered under the Commercial Act of the Republic of Bulgaria, UIC 208452963, with contact address: Sofia 1362, Suhodol, 6 Pencho Raykov St., studio 6a, telephone: +359 889 461 226, email: office@innovaherb.com.
Legal Bases & Purposes for Processing Your Personal Data
We process your personal data on the following legal bases:
- Contracts for the delivery of our products;
- Your explicit consent - the purpose is specified in each individual case;
- A statutory obligation under applicable law.
Performance of a contract
We process your personal data to fulfil our contractual and pre-contractual obligations and to exercise our rights under contracts concluded with you. Purposes include: verifying your identity, providing website functionality, issuing invoices, and preventing unlawful actions.
Data we process on this basis includes:
- Contact details - address, email, phone number;
- Identity data - full name, national ID or foreigner personal number, address;
- Order data;
- Correspondence relating to your service requests, complaints and feedback;
- Payment information - card details, bank account number or other banking and payment data;
- Technical data - IP address, demographic data, social media profile data, on-site behaviour.
We delete data collected on this basis 2 years after termination of the contractual relationship.
Compliance with legal obligations
Where required by law, we are obliged to process your personal data - for example, under the Anti-Money Laundering Act, the Consumer Protection Act, the Accountancy Act and the Tax and Social Insurance Procedure Code. We delete data collected on this basis once the obligation expires or is fulfilled.
With your consent
We process personal data on this basis only after your express, unambiguous and voluntary consent. Consent may be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal. Data collected on this basis is deleted upon your request or 12 months after initial collection.
How We Protect Your Personal Data
We apply all necessary organisational and technical measures provided under the Personal Data Protection Act. We have established rules to prevent abuses and security breaches. Where appropriate, we use additional protective mechanisms such as encryption and pseudonymisation.
Sharing Data with Third Parties
We may share your personal data with third-party contractors, including courier service providers for the delivery of your orders, or - with your explicit consent - for direct marketing purposes, including marketing agencies, Facebook and Google.
Your Rights
Every user of the site has the following rights regarding their personal data:
- Right to be informed about the processing of your personal data;
- Right of access to your own personal data;
- Right to rectification if data is inaccurate;
- Right to erasure ("right to be forgotten");
- Right to restriction of processing;
- Right to data portability between controllers;
- Right to object to the processing of your personal data;
- Right not to be subject to solely automated decision-making, including profiling;
- Right to judicial or administrative protection if your rights have been violated.
You may exercise these rights by sending a message to our email address. You also have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP) or the competent court.