Privacy Policy

It is a pleasure for us that you visit our website: www.mutaka.bg (“Website”).

We are committed to ensuring the protection of your personal data and complying with applicable data protection laws, specifically Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons in relation to the processing of personal data and on the free movement of such data and for the repeal of Directive 95/46/EC (for short “General Data Protection Regulation” or “GDPR”) and the Bulgarian Law on Personal Data Protection.By using this site or/and our services, you consent to the Processing of your Personal Data as described in this Privacy Policy.

The data administrator responsible for the data processing is “MUTAKA FINE PRODUCTS” EOOD, with headquarters and management address:

Any reference to “we” or “us” in this data protection information should be considered a reference to the aforementioned legal entity.

We take the protection of your personal data and the legal obligations that serve to protect them very seriously. The legal provisions require full transparency in the processing of personal data. This Privacy Policy therefore explains to you in detail which personal data we process when you use the Website or other subpages referring thereto or our other online presentations in social networks.

In order to ensure compliance with applicable data protection laws, we process your personal data only on the basis of applicable law, based on lawful authorization or if you have declared your consent to this. This also applies to the processing of personal data for marketing purposes. The personal data is protected by appropriate technical and organisational measures (e.g. pseudonymisation, encryption).

Depending on the functionality of the Website and the services you use, the following personal data may be collected and processed:

1. To access and browse our Website: Your IP address
2. To make contact with us through some of the communication channels indicated on our Website: the personal data contained in your message and which you have provided to us.
3. To respond to your request made through some of the communication channels indicated on our Website: first and last name, email, telephone and postal address (if provided by you).

1. We process personal data contained in log files to enable you to use our Website; this processing is based on Art. 6, para. 1, letter “f” of the GDPR for the purposes of our legitimate interest in managing the Website, as well as on the basis of your explicit consent given by pressing the “I agree” button after reading, familiarizing yourself with and accepting this Privacy Policy.
   We process data collected with cookies and anonymized user profiles, as well as data obtained from inquiries and/or orders placed, to carry out direct marketing and send you content tailored to your interests, as well as for market research.
2. This processing is carried out only and solely on the basis of your explicit consent, given by pressing the “I agree” button, after reading, familiarizing yourself with and accepting this Privacy Policy.
3. We process your personal data in order to be able to respond to your inquiries made through any of the functionalities of our Website. This type of processing is carried out only and solely on the basis of your explicit consent, given by pressing the “I agree” button, after reading, familiarizing yourself with and accepting this Privacy Policy.
4. We process your personal data so that we can organize the fulfillment of an order placed by you through the Website. In this case, we will process the data collected in connection with the the conclusion and execution of the contracts with you and execution of the order on the basis of Art. 6, para. 1, letter “b” of the GDPR.
5. We may only process data related to your use of the Website necessary in order to comply with the legal obligations we have; such processing is based on art. 6, para. 1, letter “c” of the GDPR.
6. Only in if necessary, we may process personal data (in addition to processing for the purposes and on the grounds stated above) for the purposes of our legitimate interests or the legitimate interests of third parties based on Art. 6, para. 1, letter “f” of the GDPR. Legitimate interests may include:
   6.1. Legal protection in court and extrajudicial disputes and
   6.2. Prevention and investigation of crimes and other cases provided for in the applicable legislation.

We inform you that in cases where the processing of personal data is done based on your consent, you have the right to withdraw your consent at any time without giving reasons by simply contacting us through one of the channels contact information listed on the first page of this Privacy Policy.

In order to access and browse our Website, we collect the minimum required set of personal data necessary for this, namely: Your IP address.

Some sections of our Website require mandatory submission of additional personal data, such as three names, telephone, postal address and email. This is because without these additional personal data, we cannot provide the services you have requested in the best possible way.

The provision of additional personal data is mandatory when making an inquiry, request/order, as well as when concluding a contract.

If it is necessary to collect additional data, we will inform you whether the provision of such information is based on a legal or contractual obligation. Where possible, we indicate which information may be provided voluntarily and is not based on a legal or contractual obligation or is not necessary for the purposes of performing the contract.

Your personal data is usually processed within our company. Depending on the categories of data, access to your personal data is permitted only to certain departments. These departments include in particular the units responsible for our electronic inquiries and our IT department. The  access to personal data is limited to the functions and extent necessary for the relevant purpose of its processing.

If and to the extent permitted by law, we may transfer your personal data to recipients outside of our company. Such external recipients may include:

• related companies of the group of “MUTAKA FINE PRODUCTS” EOOD, to which we can transfer personal data for the purposes of internal administration of activity data;
• service providers providing certain services based on specific contracts with us, which may involve the processing of personal data, as well as approved subcontractors of our service providers;
• central or local government bodies, to the extent that we are obliged to transfer your personal data based on a legal obligation imposed on us.

In connection with the management of our Website, we generally do not use automated decision-making (including profiling) within the meaning of Art. 22 of the GDPR. If we start implementing such processes in the future, we will inform you separately in accordance with applicable legal provisions.

We inform you that on this Website we use certain analysis methods and have integrated functions of third parties (“social plug-ins”).

1. Log files: When you visit the Website, our web server automatically stores the domain name or IP address of the requesting computer (usually your Internet service provider’s computer), including the date, time and duration of your visit, the subpages/URLs visited and information about the application(s) and terminal(s) you use to view our pages.
2. Cookies: To make our Website as user-friendly as possible, we use so-called “cookies”, like many other website operators. “Cookies” are small text files that are stored in your browser. These files help us recognize certain browsing preferences of our visitors and design our Website accordingly. Most of the cookies we use are session cookies. They are automatically deleted at the end of your visit. However, we also use permanent cookies. They serve to improve user targeting. Our cookies do not help identify you on third-party websites. You can set your browser to inform you about the creation of cookies so that their use is completely transparent to you. You can also refuse to accept cookies through your browser settings. However, refusing to accept cookies may prevent you from using all of our Website’s features. We use the following types of cookies:

(i) Category: Necessary (2)

Necessary cookies help make a website usable by enabling basic functions like page navigation and access to secure areas of the website. The website cannot function properly without these cookies.

(ii) Category: Preferences (1)

Preference cookies enable a website to remember information that changes the way the website behaves or looks, like your preferred language or the region that you are in.

(iii) Category: Statistics (5)

Statistic cookies help website owners to understand how visitors interact with websites by collecting and reporting information anonymously.

(iv) Category: Marketing (3)

Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third party advertisers.

3. Website Analysis via Google Analytics: In order to continuously improve our Website, we use Google Analytics, a web analysis service of Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA (“Google”). Google Analytics uses “cookies”, which are stored on your computer and allow analysis of the use of the Website. The information generated by the cookies about your use of this Website is usually sent to a Google server in Europe (or in a member state of the European Economic Area) to anonymize the IP address, so that all personal characteristics are excluded. Only after it has been anonymized is the abbreviated IP address transferred to a Google server in the USA and stored there. Only in exceptional cases is it necessary to transfer and store the full IP address on a Google server in the USA. This Website uses Google Analytics with an extension for the anonymous collection of IP addresses (so-called IP masking). On our behalf, Google will use the collected information to evaluate the use of the Website, compile reports on the Website activity and provide other services related to the use of the Website. The IP address transmitted by your browser in the context of Google Analytics is not combined with other Google data. You can refuse the use of cookies by selecting the appropriate settings in your browser. We would like to point out, however, that in this case you may not be able to fully use all the features of the Website. You can also prevent Google from collecting the data generated by cookies related to the use of the Website (including your IP address) and processing this data by downloading and installing the browser plug-in available from the following link: http: //tools.google.com/dlpage/gaoptout?hl=en.Alternatively, you can use the link below to prevent data from being sent to Google or processed by Google: To opt out, please click here. An opt-out cookie is created to prevent your data from being collected when you visit this Website in the future. Additional information on data protection in Google Analytics can be found at
   https://www.google.com/analytics/terms/bg.html and at https://support.google.com/analytics/answer/6004245?hl= bg

4. For emails received by you, we analyze the data generated during the delivery and retrieval of those emails in aggregate form (delivery rate, open rate, click rate, conversion rate, unsubscribe rate, wait rate), to analyze the success and use of emails. On the other hand, we also evaluate the data generated when accessing and using these e-mails (opening time, clicks on hyperlinks, downloaded documents) in order to provide you with personalized information on this basis in future e-mail newsletters that report Your interests and needs.

Personal data is usually processed within the European Union or the European Economic Area.

We do not intend to transfer personal data to other countries (“third countries”).

Information may be transferred to recipients in so-called “third countries” only in connection with the use of service providers for the provision of web analytics services, such as Google for example. “Third countries” means countries outside the European Union or the Agreement on the European Economic Area.

If the transferred information contains personal data, we ensure that, prior to such transfer, the necessary adequate level of data protection is provided in the relevant third country or with the recipient in that third country. This may be based on a decision by the European Commission regarding the adequate level of data protection in a particular third country as a whole. Alternatively, the transfer of data may be based on the so-called “EU Standard Contractual Clauses” agreed with the recipient, or if the recipients are in the US – based on compliance with the terms of the privacy protection program between USA and the EU, as well as the Standard Contractual Clauses adopted by the EU. We will be happy to provide you with further information on suitable and relevant safeguards to maintain an appropriate level of data protection upon request; contact details can be found at the beginning of this Privacy Policy. Information about participants in the US-EU Privacy Shield Program can be found at www.privacyshield.gov/list.

We store your personal data for the period of fulfillment of the purposes for which they were collected, refraining from further processing, unless this is in the interest of the data subjects and their explicit consent has been obtained. We may continue to store the data if there is a legal obligation to do so (e.g. to comply with a legal obligation to store data, for example in the case of a contract with a data subject, for the purpose of processing and retaining accounting information, etc.). The personal data shall be deleted, and without the need for the data subject to take any action in this regard, as soon as their further retention is no longer necessary for the purposes for which the data were collected or otherwise processed, or if their further retention is not permitted by law, or upon exercise by the data subject of the right to withdraw consent, “right to be forgotten” and upon request to delete the data.

With regard to the aforementioned processing, we regularly:

• delete the log data within a period of seven days, if further storage is not necessary for the purposes provided by law, such as the detection of abuse and the detection and elimination of technical malfunctions;
• delete the data processed in the context of the online order after the expiration of the statutory processing and storage periods;
• delete the data processed in the context of creating a profile of a professional, immediately after deleting the profile itself

If the storage of personal data is required to comply with a legal obligation, this data should be kept until the moment when the obligation to fulfill that obligation ceases. In this case, personal data is stored in such a way that access to it is as limited as possible and it is protected with the necessary technical means.

You as the data subject have the right at any time:

• to request access to your personal data stored with us, article 15 of GDPR;
• in cases where the processing is based on consent, to withdraw your consent to the processing of personal data at any time. In this case, please note that the withdrawal of consent does not affect the lawfulness of the processing for the period before the withdrawal;
• to request correction of incorrect personal data, art. 16 of the GDPR;
• to request deletion of your personal data, Art. 17 of the GDPR;
• to request restriction of the processing of your personal data, Art. 18 of the GDPR;
• exercise the right to data portability, Art. 20 of the GDPR;
• object to the processing of your personal data, Art. 21 of the GDPR.

You can express your wish to exercise the aforementioned rights to us by notifying us via the contact details provided on the first page of this Privacy Notice.

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for supervising us is:

In the event that you wish to lodge a complaint regarding the processing of your personal data by us, you may do so at the contact details provided at the beginning of this Privacy Policy.