Privacy Policy
This Policy is an integral part of the GENERAL TERMS OF USE of the website crystalpeptides.co.uk (the Website), administered by Crystal Peptides LTD (the Administrator). This document is prepared in accordance with the provisions of Regulation (EU) 2016/679 of the EP and the Council (General Data Protection Regulation or GDPR) and the Personal Data Protection Act. Below is the manner in which the Administrator collects and processes personal data of data subjects – users who visit the Website.
1. Grounds for Processing Personal Data
Processing of personal data is permissible under any of the following conditions:
- Consent – when users have given their consent for data processing for specific purposes, e.g., for marketing purposes or for establishing contact (by sending an inquiry).
- Conclusion and performance of a contract – personal data is necessary when concluding a contract to which the data subject is a party, e.g., when registering a user profile on the Website and purchasing products from the online store.
- Legal obligations – the Administrator is obliged to comply with certain requirements of consumer legislation and personal data protection legislation, and for this purpose may process personal data to fulfill its legal obligations.
- Legitimate interests – the Administrator may process personal data when filing or responding to reports, complaints, claims to competent state and judicial authorities. It is also in their interest to constantly improve services, and for this purpose may process data to analyze user preferences and feedback when using the Website.
2. Processing of Personal Data
For the best presentation of the Website and for some of its functions, the following data is also collected: IP address; browser type; language settings; device type and operating system through which the Website is accessed; time of use.
The Administrator may process personal data in the course of one or more of the following activities:
- conclusion, performance and termination of purchase and sale contracts for products;
- fulfillment of obligations under a concluded contract in accordance with the Consumer Protection Act and the Act on the Provision of Digital Content and Digital Services and the Sale of Goods;
- management of the online store and fulfillment of legal obligations in accordance with the Electronic Commerce Act;
- processing of inquiries, complaints and claims;
- provision of warranty and service maintenance;
- informing about changes in applied policies and general terms;
- processing of orders and sending of goods with courier delivery services;
- issuing invoices and fulfilling legal obligations in accordance with tax and accounting legislation;
- direct marketing of products and services;
- evaluation of advertising effectiveness;
- prevention of fraud in connection with payments;
- management of profiles and pages on social networks and online platforms;
- evaluation of satisfaction with provided products and/or services;
- exercising and protecting legal claims, collecting receivables, filing or responding to reports, complaints, claims to competent state and judicial authorities.
In these activities, the Administrator may collect and process the following categories of data:
- physical identity data – names, personal identification number (when requesting an invoice for an individual);
- contact data – phone number, email;
- delivery data – exact delivery address (personal address or courier office);
- payment data – information about date and method of payment made;
- user profile data – email/username, purchase history, delivery data and payment method, and others;
- Website visit data – IP addresses, system and analytical data collected through installed cookies;
- other – data shared on the initiative of the data subjects in sent reports, inquiries, applications, objections and feedback.
3. Collection of Personal Data
Personal data may be collected personally from data subjects (when creating a user profile, generating an order, making an inquiry, etc.) and/or automatically through the Website (by using cookies and other similar solutions).
4. Purpose, Basis and Storage Period
More specifically, the Administrator may process data on the following grounds and conditions:
| Category | Collection | Purpose | Basis (GDPR) | Period |
|---|---|---|---|---|
| IP address, browser type, language settings, device type, time of use, operating system type | When using the website by data subjects and through cookies | To provide the full functionality of the Website | Art. 6(1)(b) – for contract performance | 2 years |
| Personally from data subjects through the "Contacts" section or provided email address | Inquiries, comments and feedback | Art. 6(1)(a) – provided consent | 2 years | |
| Name, Email, Contact phone, Delivery address, Accounting and payment data | When ordering by the user | For concluding a purchase contract and fulfilling contractual obligations | Art. 6(1)(b) – processing necessary for contract performance | up to 60 months |
| Analytical data | When using the Website | Improving services provided by the Website and statistics | Art. 6(1)(f) – legitimate interest | up to 26 months |
| Marketing data (unique visitor identifier, device identifier, user behavior on the Website, IP addresses) | When using the Website | User profiling and ad targeting, content serving and measurement, retargeting and remarketing | Art. 6(1)(a) – consent provided by the data subject | up to 26 months or withdrawal of consent |
5. Protection of Personal Data
In accordance with applicable legislation, the Administrator maintains appropriate and proportionate technical and organizational measures to protect users' data, including to prevent unauthorized access to them and/or their improper use.
The Administrator uses business systems, procedures and information technologies that adequately protect personal data and ensure their security. The data collected from Website users is systematized in registers that are subject to cryptographic protection. The data registers themselves are located on the hard drive of computer systems with limited technical and physical access, only by qualified and trained personnel.
6. Sharing of Personal Data
The Administrator may share data on the use of the Website with industry-recognized solutions such as Google Analytics. The Administrator may also share personal data with other contractors assisting in the fulfillment of legal obligations, management of specific work processes and pursuit of certain legitimate interests. Such contractors may be IT and hosting service providers related to the maintenance of the Website.
In certain situations, it may be necessary to share data with a special authority (administrative, judicial and/or executive authority) pursuant to Art. 6(1)(c) and (f) of the General Data Protection Regulation (GDPR), when this is necessary to resolve legal disputes, is provided for in a legal provision or is absolutely necessary to prevent, detect or prosecute criminal activity or fraud.
7. Rights of Data Subjects
Visitors to the Website are data subjects within the meaning of the General Data Protection Regulation (GDPR) and have the following rights:
| Right of access | You have the right to receive confirmation that your personal data is being processed, as well as to request and receive information about the purposes of processing; the categories of personal data processed; the recipients; the sources; the expected storage period; the right to lodge a complaint with a supervisory authority; the existence of automated decision-making, including profiling. |
| Right to rectification | You have the right to request the rectification (without undue delay) of inaccurate personal data relating to you. If the data is incomplete, you have the right to request its completion. |
| Right to erasure | You have the right to request the erasure of personal data relating to you when: they are no longer necessary for the purposes for which they were collected and processed; you withdraw your consent or object to the processing and we have no other legal basis for their processing; your personal data is being processed unlawfully; your personal data must be erased in order to comply with a legal obligation under EU or Member State law. |
| Restriction of processing | You have the right to request restriction of processing when: the accuracy of your personal data is contested – for a period that allows for verification of the accuracy of the data; the processing is unlawful; we no longer need your personal data, but you require them for the establishment, exercise or defense of legal claims; you have objected to processing and are awaiting verification of our legal grounds and their precedence over your interests. |
| Right to portability | You have the right, when the processing of your data is based on consent or performance of a contractual obligation and at the same time is carried out in an automated manner, to receive without hindrance the personal data relating to you and which you have provided to us, in order to transfer them to another controller. |
| Right to object | You have the right, on grounds relating to your particular situation, to object to the processing, including profiling, of your personal data that goes beyond legitimate purposes. |
| Right to lodge a complaint | You have the right to file a complaint with the Commission for Personal Data Protection for violation of your rights within six months of becoming aware of the violation, but no later than 2 (two) years from its commission. In case of violation of your rights, you may also appeal our acts and actions in court before the competent court. |
Users can learn more about their rights and how to exercise them on the information website of the European Data Protection Supervisor or the supervisory authority for the Republic of Bulgaria – Commission for Personal Data Protection.
The User may always and at any time exercise their rights listed above. For this purpose, they need to send a letter or email to the addresses listed below.
Submitted requests regarding personal data will be answered within two months, and in case of need to extend the specified period, the data subject will be informed of the extension, as well as the reasons for the delay.
The Administrator may refuse to process requests that are unreasonably repeated or threaten the confidentiality of other data subjects. The Administrator will provide a free copy of the personal data that is being processed, reserving the right to charge a proportional fee for repeated or excessive requests.
Version: 1.0
Date of adoption and publication: January 2025
| ADMINISTRATOR CONTACT INFORMATION | |
| Administrator name | Crystal Peptides LTD |
| Headquarters | Bulgaria |
| info@crystalpeptides.eu | |
| SUPERVISORY AUTHORITY CONTACT | |
| Supervisory authority | Commission for Personal Data Protection |
| Address | Bulgaria, Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd. |
| kzld@cpdp.bg | |