Privacy notice

Information about the Data controller:

Legal name 5 Avenue EOOD
UIN/BULSTAT 175035393
Seat and registered office 11  Slavishte Str. , entr. B, floor 5, fl. 16A, Sofia 1421
Address of correspondence 11  Slavishte Str. , entr. B, floor 5, fl. 16A, Sofia 1421
Telephone +359 898 430 880
E-mail dpo@5-avenue.com
Website https://oneconic.com/

Information about the Supervisory authority

Legal name Commission for personal data protection
Seat and registered office 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Address of correspondence 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Telephone +359 2 91 53 518
Website www.cpdp.bg 

5 Avenue EOOD (hereinafter referred to as “Controller” or “the Company”) carries out its activity in accordance with the Law on personal data protection and Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. This document is meant to provide you with detailed information on the types of personal data we use, the ways we process it, your rights regarding your personal data and other relevant information.

The basis for the collection, processing and storage of your personal data

Art. 1. (1) The Controller collects and processes your personal data regarding the use of the online shop https://oneconic.com, the conclusion of contracts with the Company under Art. 6, para. 1, Regulation (EU) 2016/679, and in particular under the following:

  • Obtained explicit consent from you as a client;
  • Performance of The Company’s obligations under a Contract with you;
  • Processing is necessary for compliance with a legal obligation to which The Company is subject;
  • Processing is necessary for the purposes of the legitimate interests pursued by The Company or by a third person.

Objectives and principles in the course of collection, processing and storage of your personal data

Art. 2. (1) We collect and process the personal data which you provide regarding the use of the online shop https://oneconic.com, the conclusion of contracts with the Company, including the following purposes:

  • creating a user account and ensuring full functionality for the usage of the online shop;
  • placing orders and purchasing goods;
  • individualisation of a party to a contract;
  • accounting purposes;
  • statistical purposes;
  • protection of information security;
  • securing the performance of the contract for provision of the service concerned;
  • attendance at events and training seminars, organized by the Company;
  • participation in games, lotteries, advertising campaigns;
  • sending newsletters if you have given your consent;

(2) We adhere to the following Principles in the course of processing of your personal data:

  • lawfulness, fairness and transparency;
  • purpose limitation of the processing personal data;
  • data minimization;
  • accuracy;
  • storage limitation;
  • integrity and confidentiality.

(3) In the course of processing and storage of personal data, The Company is entitled to process and keep personal data for the purposes of protection of the following legitimate interests:
• to perform its obligations towards the National revenue agency, the Ministry of the Interior and other state and municipal bodies.

What kind of data do we collect, process and keep?

Art. 3. The Company carries out the following operations with the personal data you provide for the following purposes:

  • Conclusion and execution of a commercial transaction or contract with a client – the purpose of the operation is conclusion and execution of a contract with a commercial partner or client and ensures its administration. In some cases, the purpose of the transaction may also be to protect the legitimate interests of the company in executing the transaction. Taking into consideration the limited scope of the collected data and the fact that some of the data is collected by publicly accessible sources, carrying out an impact assessment is not necessary for the current operation.
  • Registration of a user in the online store and execution of a sale/purchase agreement – the purpose of this operation is creation of an account for using the e-store for buying goods and receiving newsletters in case of expressed consent. Providing contact details for the delivery of the purchased goods. Taking into consideration the limited scope of the collected data, carrying out an impact assessment is not necessary for the current operation.
  • Sending newsletters – the purpose of this operation is administrating the process of sending newsletters to the clients who have expressed consent. Taking into consideration the limited scope of the collected data, carrying out an impact assessment is not necessary for the current operation.
  • Exercising the right of withdrawal or making complaint – the purpose of this operation is to administer the process of sending purchased goods to the clients. Taking into consideration the limited scope of the collected data, carrying out an impact assessment is not necessary for the current operation.
  • Registration of a participant in events and sending information or prizes – the purpose of this operation is to administer the process of registering participants in events and games, and sending prizes from held games. Taking into consideration the limited scope of the collected data, carrying out an impact assessment is not necessary for the current operation.
  • Request for the delivery of a product, which is not available – the purpose of this operation is establishing a contact with an individual for delivering a product, that is not available at the moment. Taking into consideration the limited scope of the collected data, carrying out an impact assessment is not necessary for the current operation.

Art. 4. (1) The Controller processes the following categories of personal data for the following purposes and on the following grounds:

  • Data for registration and receiving newsletters (names, e-mail)
    • Purpose for collecting the data:
      1. Establishing contact with the user and sending information to him,
      2. for the purpose of registering the user in the online store, and:
      3. for sending a newsletter.
    • Ground for processing Your personal data – When accepting the General Terms and registering in the online shop or when making an order without registration, or when concluding to a written contract, between the Controller and You a contractual relationship is established, on which ground we process Your personal data – Art. 6, para. 1, letter (b) GDPR. Your Data necessary for sending newsletters is processed under the ground of given explicit consent.– Art.6 , para. 1, letter (a) GDPR
  • Data for receiving a newsletter (names, e-mail)
    • Purpose for collecting the data:
      1. for sending newsletter.
    • Ground for processing your Personal data – Your Data necessary for sending a newsletter is processed on the ground of given explicit consent – Art.6 , para 1, letter (a) GDPR.
  • Data for making delivery (names, phone number, e-mail, address)
    • Purpose for collecting the data: Performing controller’s obligations under a distance sale/purchase contract and delivery of purchased goods, including when exercising a right to return and replace or right of withdrawal from purchased goods.
    • Ground for processing your data – When accepting the General Terms and registering in the online shop or when making an order without registration, or when concluding a written contract, between the Controller and You a contractual relationship is established, on which ground we process Your personal data – Art. 6, para. 1, letter (b) GDPR.
  • Data from your social network profiles (the publicly accessible information from your Google+, Facebook, Instagram profiles)
    • Purpose for collecting the data:
      1. Establishing contact with the user and sending information towards the user;
      2. for the purposes of registration for games, lotteries, campaigns and etc.
    • Grounds for processing Your personal data – Your data regarding signing up for our events, games, campaigns and etc. is processed under the ground of given explicit consent, pursuant to Art. 6, para. 1, letter (a) GDPR

(2) The Company doesn’t collect and process personal data, that refers to:

  • revealing racial or ethnic origin;
  • revealing political opinions, religious or philosophical beliefs, or trade union membership;
  • genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

(3) Personal data is collected by The Company from the persons it refers to.
(4) The company is not carrying out automated decision making with data.
(5) The Company does not collect and process data of persons under the age of 14 years, except with the express consent of a parent or legal representative.

Duration of personal data storage

Art. 5. (1) The Controller stores your Personal data for a period no longer than the existence of your profile in the online store or until the withdraw of your consent. After the deletion or the successful completion, the Controller makes all reasonable efforts to erase or destroy all your personal data, without undue delay or to anonymize (to bring it in a form that does not reveal your personality).
(2) The Controller stores all your personal data provided in relation with made online orders for a period of 5 years for the purposes of protecting the legal interest of the Company in case of litigation or administrative disputes with users of the online store, as the accounting documents are stored for the legal term for storage of such data.
(3) The Controller informs you in case that the period for the storage of the personal data is necessary to be extended in regard to performing legal obligation or in regard with the legitimate interests of the Company or other.
Art. 6. The Company stores the personal data of the legal representatives of the business partners for the period of the performance of the contract, for compliance with legal obligations and for the legitimate interests of the Controller, as this period may exceed the term of the contract.

Transmission of your personal data for processing

Art. 7. (1) The Controller is allowed on its own decision to transmit all or part of your personal data to processors for the performance of the purposes of processing, with which you have agreed, with respect to the requirements of Regulation (EU) 2016/679 (GDPR).
(2) The Company informs you in case of intention to transmit part or all of your personal data to third countries or international organization.

Your rights in the course of collection, processing and storage of your personal data

Withdrawal of the consent

Art. 8. (1) If you no longer wish your personal data to be processed for all or specific purposes, you may at any time withdraw your consent by filling the form in your profile or by request in free text.
(2) The Controller may ask you to verify your identity and identify yourself with the person to whom the data relate by requesting you to enter e-mail and password access to the website on-the-spot in the Company’s office in front of our employee.
(3) The withdrawal of your consent for processing of personal data which is required for maintenance of your profile in the e-store, will automatically deactivate your account. Of course, you will still be able to browse the online shop and to make orders as a guest or to create a new account.
(4) If you have made an order which is in process of processing, the earliest moment in which you can withdraw your consent is at the successful completion of the order.

Right of access by the data subject

Art. 9. (1) You have the right to obtain from the Company confirmation as to whether or not it is processing personal data concerning you, if you are registered user, as you can at any time view all personal data you have provided in your details in your account.
(2) You have the right to obtain access to the personal data related to you, аs well as to the information regarding the collection, processing and storage of your personal data.
(3) The Company provides on your request, a copy of the processed personal data related to you in electronic or other suitable form.
(4) The provision of access to the personal data is free, but the Company keeps its right to charge administrative fee, in case of repeatability or excessiveness of the requests.

Right to rectification or completion

Art. 10. You could at any time rectify or complete inaccurate or incomplete information concerning you directly through your account or by sending us a request.

Right to erasure (“right to be forgotten”)

Art. 11. (1) You have the right to request from the Company to erase the personal data concerning you and the Company has the obligation to erase personal data without undue delay where one of the following grounds applies:

  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • you withdraw your consent on which the processing is based and where there is no other legal ground for the processing;
  • you object to the processing of personal data concerning you, including for the purposes of the direct marketing and there are no overriding legitimate grounds for the processing;
  • the personal data have been unlawfully processed;
  • the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
  • the personal data have been collected in relation to the offer of information society services.

(2) The Company is not obliged to erase the personal data if it collects and process them:

  • for exercising the right of freedom of expression and information;
  • for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  • for reasons of public interest in the area of public health;
  • for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
  • for the establishment, exercise or defense of legal claims.

(3) In case you exercise your right to be forgotten, the Company will erase all your data, except for the following information:

  • information, needed for certifying that you’ve exercised your right to be forgotten;
  • technical information about the online shop’s functioning, which cannot be related to you in any way.
  • The e-mail you used to make a registration for the online shop.

(4) You can exercise your right to erasure by filling and submitting the request form in your profile or by sending an e-mail to The Company.
(5) The company could require you to verify your identity and identify yourself with the person to whom the data relate.
(6) If you’ve made a order, which is being processed by the Company, you can only request to be forgotten no sooner than the processing of the order is successfully finished.
(7) After your data is deleted, Your account will become inactive. Of course, you will still be able to browse the online shop and to make orders as a guest or to create a new account.
(8) The Company does not erase the personal data which it has a legal obligation to store or which is necessary for proving its legitimate rights regarding claims against the Company.

Right to restriction of processing

Art. 12. You have the right to obtain from The Company restriction of processing where one of the following applies:

  • you contest the accuracy of the personal data, for a period enabling The Company to verify the accuracy of the personal data;
  • the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
  • the Company no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defense of legal claims;
  • you have objected to processing pending the verification whether the legitimate grounds of the Company override those of yours.

Right to data portability

Art. 13. (1) You have the right at any time to download or to receive in machine-readable form the personal data which are stored and processed in relation with the usage of the services of the Controller, directly from your account via the option export data or by sending request by e-mail.
(2) You can request your data to be provided by the Company directly to a controller, selected by you, when this is technically viable.

Right to receive information

Art. 14. You have the right to require The Company to inform you about all recipients, to whom your personal data, for which has been required rectification, erasure or restriction of processing, have been disclosed. The Company is allowed to refuse to provide this information if this is impossible or involves disproportionate effort.

Right to object

Art. 15. You have the right to object at any time to processing of personal data concerning you including processing for the purpose of profiling or direct marketing.

Your rights in case of personal data breach

Art. 16. (1) When The Company detects personal data breach, which is likely to result in a high risk to your rights and freedoms, The Company communicates the personal data breach to you without undue delay, as well as the measures taken or proposed to be taken by the Company.
(2) The Company is not obliged to inform you if:

  • The Company has implemented appropriate technical and organizational protection measures, and those measures were applied to the personal data affected by the personal data breach;
  • The Company has taken subsequent measures which ensure that the high risk to your rights is no longer likely to materialize;
  • it would involve disproportionate effort.

Persons, to whom your personal data is provided

Art. 17. (1) For the purpose of processing your personal data and provision of the service in its full functionality and in view of your interests, the Company is allowed to provide your personal data to the following data processors – see the list of the data processors. The described data processors comply with all requirements of legality and security in the course of processing and storage of your personal data.
Art. 18. The company does not transfer your data to third countries.
Art. 19. In case of violation of your rights according to this Privacy notice or the applicable law, you could file a complaint before the Commission for personal data protection:

Legal name Commission for personal data protection
Seat and registered office 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Address of correspondence 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Telephone +359 2 91 53 518
Website www.cpdp.bg 

Art. 20. You could exercise all of your rights related to the processing of your personal data by using the exemplary forms of The Company, attached to the Privacy notice. Of course these forms are not obligatory and you can make your requests of any form, which contains statement for that and identifies you as a proprietor of the personal data.
Art. 21. If you consent to a transfer, the Company has to describe the possible risks regarding the transfer of data to third countries when there are no adequate means of protection.

This site uses cookies to provide its functionality and to give you the best online experience. By agreeing you accept the use of cookies. Privacy Notice