Transparency in the processing of personal data

 As a Personal Data Administrator, “Grand Millennium” EOOD has an obligation to inform you of what to expect when processing your personal data.

Types of personal data we process:

1. We process the following categories of data on a contractual and pre-contractual basis (Art. 6, par. 1, b. GDPR):
2. Your e-store account details jarvanitskincare.com , which is created for you after entering into an informal contract with the Administrator, accepting the General Terms and Conditions for using the website and e-store www.jarvantskincare.com (“General Terms and Conditions”), as follows:

● First and last name;
● Email address;
● Password.

2. Online order details through the e-store jarvantskincare.com , made by you, concluding an informal distance contract with the Administrator under the application of the General Terms and Conditions, as well as data for preparing orders (pre-contractual process for initiating/starting orders by phone according to the General Terms and Conditions):

● Data about ordered products (including SKU number of the respective product from the e-store) and quantity;
● First and last name of the delivery person;
● Delivery address – country, city, postal code, address;
● Delivery phone number;
● Email address;
● Invoice data – names, phone, city, country, zip code, address;
● Delivery method;
● Payment method;
● Order number;
● Payment amount;
● Payment status;
● Delivery status;
● Traffic data according to the Electronic Communications Act or metadata (if available and depending on the communication).

1. We process the following data on the basis of your consent (Art. 6, par. 1, b. “a” of the GDPR), expressed by a deliberate action – independent entry of optional data and/or free selection of specific options:
2. Your e-store account details jarvantskincare.com :

•  Company name of a legal entity and/or name of another personified or non-personified entity/organization.

2. Contact details and sent message, voice communication or published comment , provided when filling out a contact form on the jarvantskincare.com e-store or when sending us an email, conventional mail, telegram, fax, phone call, sending SMS, publishing a blog comment and other forms of communication and/or expression, as follows:

● First and last name;
● Email address;
● Phone number;
● Fax number;
● Address;
● Internet site;
● Content of the comment / message / voice communication;
● Traffic data according to the Electronic Communications Act or metadata (if available and depending on the communication).

3. Online order details through the e-store jarvantskincare.com :

• Order history.

4. Bank account details for refund purposes:

• You may withdraw any of the consents provided above through your account settings or in the form and manner prescribed in this Policy. Upon withdrawal of consent, the processing of the relevant type of personal data for the specified purposes shall cease. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

III. We process the following data on a legal basis (Art. 6, par. 1, b. “c” of the GDPR), in accordance with local and EU legislation:

1. Your e-store account details jarvantskincare.com :

● First and last name;
● Email address;
● Company name of a legal entity and/or name of another personified or non-personified entity/organization.

2. Online order details through the e-store jarvantskincare.com , as well as order preparation information:

● Data on ordered foods and products by type (including SKU number of the respective product from the e-store) and quantity;
● First and last name of the delivery person;
● Delivery address – country, city, postal code, address;
● Delivery phone number;
● Telephone number from which the pre-contractual process is initiated;
● Email address (in the pre-contractual process);
● Invoice data – names, personal identification number, telephone number, city, country, postal code, address;
● Delivery method;
● Payment method;
● Order number;
● Payment amount;
● Payment status and history;
● Status and history of deliveries;
● Order history;
● Message content / voice communication;
● Traffic data according to the Electronic Communications Act or metadata (if available and depending on the communication).

3. Contact details and sent message, voice communication or published comment provided when filling out a contact form on the jarvantskincare.com e-store or when sending us an email, conventional mail, telegram, fax, phone call, sending SMS, publishing a blog comment and other forms of communication and/or expression, as follows:

● First and last name;
● Email address;
● Phone number;
● Fax number;
● Address;
● Internet site;
● Content of the comment / message / voice communication;
● Traffic data according to the Electronic Communications Act or metadata (if available and depending on the communication).

1. We process the following data on the basis of legitimate interest (Art. 6, par. 1, b. “e” of the GDPR):
2. Your e-store account details jarvantskincare.com :

• ● First and last name;
  ● Email address;
  ● Company name of a legal entity and/or name of another personified or non-personified entity/organization.

2. Online order details through the e-store jarvantskincare.com , as well as order preparation information:

● Data on ordered foods and products by type (including SKU number of the respective product from the e-store) and quantity;
● First and last name of the delivery person;
● Delivery address – country, city, postal code, address;
● Delivery phone number;
● Telephone number from which the pre-contractual process is initiated;
● Email address (in the pre-contractual process);
● Invoice data – names, personal identification number, telephone number, city, country, postal code, address;
● Delivery method;
● Payment method;
● Order number;
● Payment amount;
● Payment status and history;
● Status and history of deliveries;
● Order history;
● Message content / voice communication;
● Traffic data according to the Electronic Communications Act or metadata (if available and depending on the communication).

3. Contact details and sent message, voice communication or published comment provided when filling out a contact form on the jarvantskincare.com e-store or when sending us an email, conventional mail, telegram, fax, phone call, sending SMS, publishing a blog comment and other forms of communication and/or expression, as follows:

● First and last name;
● Email address;
● Phone number;
● Fax number;
● Address;
● Internet site;
● Content of the comment / message / voice communication;
● Traffic data according to the Electronic Communications Act or metadata (if available and depending on the communication).

Purposes of personal data processing:

1. Your e-store account details jarvantskincare.com are processed for the purposes of:

● Fulfillment of the Administrator's accountability obligation by recording legally significant authentication data in electronic protocols - technical logs;
● Delivery of ordered products;
● Providing support for technical malfunctions, informing customers by operators in our contact (call) center or in connection with complaints, tracking deliveries, payments, etc.;
● Verification by sending an email to ensure the security of access to your account data and when changing your password;
● Authentication when logging into your account;
● Sending emails and/or push notifications for direct marketing and advertising purposes with your explicit consent;
● Comply with legal provisions, court decisions, legal orders and decisions of authorities and supervisory bodies. This includes using your personal data to collect and verify accounting data and comply with accounting rules.

2. Online order details through the e-store jarvantskincare.com are processed for the purposes of:

● Delivery of ordered products;
● Providing support for technical malfunctions, informing customers by operators in our contact (call) center or in connection with complaints, tracking deliveries, payments, etc.;
● Preventing and investigating abuses in online orders and related deliveries, as well as losses and fraud;
● Comply with legal provisions, court decisions, legal orders and decisions of authorities and supervisory bodies. This includes using your personal data to collect and verify accounting data and comply with accounting rules;
● Analyzing statistical data obtained after anonymizing your data.

3. Contact details and sent messages or published comments are processed for the purposes of:

● Identification of you as the sender/author of a message or a published comment;
● Communicating with you.

Third parties with access to personal data in connection with their activities and services provided, in conjunction with jarvantskincare.com :

1. We use the following cloud service providers, hosting, reverse proxy, CDN, servers/clusters, colocation, as well as an international payment system:

• SuperHosting.BG EOOD – provides hosting and cloud services for the needs of jarvantskincare.com . You can read their privacy policy as well as their data processing agreement at the following address: https://www.superhosting.bg/web-hosting-page-terms-and-agreements.ph p
• International electronic payment system Stripe Inc ("Stripe") – all payments and any information you provide in connection with payments will be processed on behalf of Stripe and will be subject to Stripe's terms and privacy policies, available at https://stripe.com/privacy , which may be updated from time to time at Stripe's discretion.

2. Consultants and suppliers in various fields for the purposes of protecting our legitimate interests in maintaining and improving the quality of the services we provide to you, to meet legal requirements, to protect legal rights and interests in judicial, pre-trial and administrative proceedings. Those of them that we use regularly are the following:

•   Courier delivery companies: "Econt", "DPD" ("Speedy"), euShipments.

3. State bodies and institutions in connection with inspections carried out by them in accordance with legal requirements and restrictions:

With respect to private entities, we require and monitor that said third parties implement all technical and organizational measures to protect this data.

The data is processed for the following periods:

1. Data provided on a contractual basis:

•   Account data – until 5 years from the date of the last online order or in the absence of an order, as well as until the account is deleted through the e-store functionalities or until 5 years from the date of your last login, whichever is sooner.

The account data is linked to and determining the data for online orders, which determines the application of the deadline set in relation to them.

In the absence of an order based on the informal contract, you as a user have a legal expectation of using the account and therefore we have provided you with a functional option to delete your account at any time before the expiry of the final five-year period.

• Data for online orders – until the expiration of 5 years from the date of the specific order. The period is determined based on the statute of limitations for repayment of receivables.

2. Data related to the collection and verification of accounting data and compliance with accounting records:

• Accounting records and financial statements , including documents for tax control, audit and subsequent financial inspections, are kept for 10 years, starting from January 1 of the reporting period following the reporting period to which they relate.

All other carriers of accounting information are stored for 3 years, starting from January 1 of the reporting period following the reporting period to which they relate.

3. Data provided based on consent:

• Until its withdrawal, in the manner in which it was provided, including through the functionalities of the e-store or blog or by deletion, and with regard to the e-store - until the expiration of 5 years from the date of the latter.

Your rights in relation to your personal data:

5.1 Right of access, including the right to a copy of the data being processed:

• You have the right to request information about your personal data that we store at any time. You can contact us and, based on a written request and verification of your identity, the data will be provided to you.

5.2 Right to rectification of inaccurate personal data:

• You have the right to request correction of your personal data if it is incorrect, including completion of incomplete personal data. You can do this through your profile or by submitting a written request to jarvant@jarvantskincare.com, after duly verifying your identity.

5.3 Right to erasure (“Right to be forgotten”) in the following cases:

● Elimination of the need for processing;
● Withdrawal of consent when processing is based on consent;
● Illegal data processing;
● Legal obligation to delete.

The right to be forgotten is not an absolute right and may not be respected in cases provided for by law or due to lack of proper verification of your identity.

5.4 Right to restriction of processing when:

● The accuracy of the data is disputed for the period in which its accuracy must be verified;
● The processing of the data is without legal basis, but instead of us deleting it, you request its restricted processing;
● If the data is necessary for the establishment, exercise or defense of your legal claims;
● An objection has been filed to the processing of the data, pending verification of whether the controller's grounds are lawful.

In the event of rectification, erasure or restriction of processing, we will inform each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

5.5 Right to object to processing based on legitimate interest:

• You have the right to object to the processing of your personal data based on the legitimate interest of the Administrator or a third party. The Administrator will not continue to process your personal data unless it is proven that there are compelling legal grounds for doing so that override your interests and rights or due to litigation and other procedural and extra-procedural actions this is necessary.

5.6 Right to object to direct marketing:

• You have the right to object to receiving marketing communications, including profiling and analysis for direct marketing purposes.

The above-described rights are exercised by means of a written request in a form determined by the Administrator, which you can obtain at the Administrator's headquarters or electronically after requesting the Data Protection Officer and completing the electronic form received in response, attaching the necessary documents. You will receive a response to your request within one month of receiving your written request.

Use of cookies:

1. What are cookies?

Cookies are small text files that a website can save to your computer or mobile device when you visit a page or site. The cookie will help the site or other sites recognize your device the next time you visit it. Web beacons or other similar files can do the same. We use the term cookies in this policy to refer to all files that collect information in this way.

Cookies perform many different functions. For example, they help us remember your username or preferences, analyze how well our sites are performing, or even allow us to recommend content that we think you will find interesting.

Some cookies contain personal information – for example, if you clicked “Remember Me” when you were logged in, the cookie will remember your username. Most cookies do not collect information that can identify you, but rather collect general information about how users reach and use our sites or what their location is.

2. How to turn off cookies?

All modern browsers allow you to change your cookie settings. You can usually find these settings in your browser's "options" or "preferences" menu. To be aware of these settings, the above-mentioned links may help you, or you can use the "Help" button in your browser's menus for more details.

Please remember that if you choose to disable cookies, some sections of our site may not function properly.

3. Does it use jarvantskincare.com cookies that contain your personal data?

No, the cookies we use are anonymous and do not contain any personal data.

6.3 More information:

More information about how businesses use cookies is available at: www.allaboutcookies.org .

If you have any questions regarding this Cookie Policy , please contact us at: jarvant@jarvantskincare.com