Privacy Policy

Section I – General Information

As of 25 May 2018, a new data protection regulation adopted by the European Union – the General Data Protection Regulation or GDPR for short – came into force. The main purpose of the regulation is to ensure the protection of the data of individuals from all EU member states and to unify the regulations of their processing. As a personal data Administrator, NETWORK LOGIC Ltd. has taken all organizational and technical protection measures to be able to meet all the requirements of the new regulation by collecting individuals’ data only to fulfil the donation contract and/or send a newsletter with information about new services, special news offers, etc.

Art. 1. (1) Data concerning the data Administrator, as well as information under the E-commerce Act and the Consumer Protection Act:
Name: NETWORK LOGIC Ltd

UIC/BULSTAT: 201139421

Headquarters and registered office: Sofia, Vitosha district, Blvd. 425, Tsar Boris III Street,

Address for correspondence: Sofia, Vitosha district, 425, Tsar Boris III Street

Email: contact@herbawave.com

(2) Control bodies in connection with the activities of the Administrator:
Name: Personal Data Protection Commission

Headquarters and registered office: 1592, Sofia Blvd. “Prof. Tsvetan Lazarov № 2

Phone: 02 915 3 518

Email: kzld@cpdp.bg

(3) The Administrator carries out its activities following the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons about the processing of personal data and the free movement of such data.

Section II – Basis for collecting, processing, and storing your data

Art. 2. (1) The Administrator collects and processes your data in connection with the use of the web-based platform available at: https://herbawave.com to conclude a reward donation contract based on Art. 6 para. 1, Regulation (EU) 2016/679 (GDPR), and in particular on the following grounds:

Your explicit consent as a User;
Conclusion and performance of our obligations under the distance purchase contract;
Performance of the Administrator’s obligations under a contract with you;
Compliance with a legal obligation applicable to the Administrator;
For the legitimate interests of the Administrator;

Section III – Purposes and Principles for the Collection, Processing and Storage of Your Data

Art. 3 (1) The trader collects, processes and stores personal data that you provide in connection with the use of the online shop, the conclusion of a distance purchase contract, namely in the following hypotheses:

When sending an email newsletter with information about new products, special offers, promotional campaigns and discount codes, subject to your prior consent and the indication of your email address in the relevant subscription field;
Sending a response to a request made to the Merchant via the online store interface or by email;
Conclusion and execution of a distance purchase contract, including about delivery, concluded with the Merchant via the online shop interface;
Statistical and marketing needs to optimize the user experience, improve functionalities and design using cookies;

(2) In processing your data, we comply with the following principles:

Lawfulness, fairness, and transparency;
Limitation of the purposes of the processing;
Data minimization following the purposes;
Limitation of storage to achieve the purposes;
Data accuracy and timeliness;
Integrity and confidentiality of processing and ensuring its security;

(3) In processing and storing personal data, the Administrator may process and store personal data to protect its legitimate interests, such as the protection of a legal interest before the competent Bulgarian court, the performance of its obligations to the National Revenue Agency (NRA), the Ministry of the Interior (MIA) and other state and municipal authorities.

Section IV – What types of personal data does the Administrator collect, process, and store?

Art. 4. (1) The Administrator shall carry out the following operations with the personal data provided by you for the following purposes:

Your data (name and surname, telephone, e-mail, address, etc.)

Purposes for which the data is collected:

Providing feedback to the User about responding to their requests;
Registration of an account in the online store;
Execution of a distance purchase contract for the goods requested:

Grounds for processing your data:

By accepting the terms and conditions and registering in the online store or placing an order through the “Order as a guest” option, a contractual relationship is established between the Merchant and the User, on which basis personal data is processed – Art. 1 (b) GDPR.

Delivery data (names, telephone, address, etc.)

Purpose for which the data is collected:

Fulfilment of the Merchant’s obligation to deliver the ordered goods by transmitting the data to a third-party freight forwarder

Grounds for processing your data:

Upon acceptance of the General Terms and Conditions and the Privacy Policy, at the time of concluding the contract by registering in the e-shop or placing an order via the “Order as a guest” option, a contractual relationship is created based on which we process your data – Art. 6, para. 1 (b) GDPR.

Bank transaction data (debit/credit card number, CVV, geolocation, IP address)

The purpose for which the data is collected:

The data is collected to make a banking transaction (money transfer) from a user’s account to a contractor’s account to enter into a reward donation contract;

Reason for processing your data:

By accepting the terms and conditions and the privacy policy of the platform, upon registration of an account on the platform, a contractual relationship is established between the Administrator and you, based on which your data is processed – Art. 1 (b) GDPR. Your data for sending the newsletter as well as for sending a message via the contact form are processed based on your explicit consent – Art. 6 para. 1 (a) GDPR.

User experience data (number of orders, products ordered, frequency of visits, last visit, time spent on site, products viewed)

Purpose for which the data is collected:

Optimization of the content and design of individual pages, to personalize the conditions for selling goods remotely, to increase customer satisfaction with the Merchant, and overall improvement of the services provided. The information is anonymized and encrypted and on this basis, no specific user and their individualizing data can be accessed unless they are a registered user.
We may use COOKIES, WEB BEACONS, TRACKING PIXELS, and OTHER TRACKING TECHNOLOGIES on the Site to improve your experience. You can reject or remove cookies. Such action could affect the functionality of the Site. You cannot decline web beacons, but you can make them ineffective by declining all cookies or changing your browser settings to notify you when a cookie is tendered so that you can accept or decline cookies individually.

Reason for processing your data:

Upon acceptance of the General Terms and Conditions, the Privacy Policy or consent to the use of cookies at the time of logging in to the website, respectively subsequent consent when performing a certain action in the online store on which basis we process your data – Art. 6 para. 1 (a) GDPR.

Section V – Retention period of your data

Art. 7 (1) The trader shall keep your data which he has collected only for the period necessary to achieve the purposes set out in this Policy, and where he is entitled or obliged by law to keep it for a longer period.

(2) The time limits that we observe or are required to observe are as follows:

Your individually identifiable personal data – up to 5 years;
Delivery date – up to 5 years;
User experience data – up to 2 years from the last visit to the website;

(2) The Administrator shall store your data provided in connection with the conclusion of a contract for the publication of promoted listings for services to protect the Administrator’s legal interests in the event of legal or administrative disputes with users of the Platform, as well as in compliance with the statutory retention period for accounting documents evidencing the concluded contracts.

(3) The Administrator shall notify you by email to the address you have provided if the data retention period needs to be extended to comply with a legal obligation or because of the Administrator’s legitimate interests, as well as in the event of a request to use a service or functionality on the Platform after the expiry of the 5 years from the initial consent given.

Art. 8. The Administrator shall store the personal data of the legal representatives of its business partners for the duration of the performance of the contract, to comply with the legitimate interests and legal obligations of the Administrator, and this duration may exceed the duration of the contract concluded.

Section VI – Transfer of your data for processing

Art. 9. (1) The Administrator may, at its discretion, transfer some or all of your data to processors for the fulfilment of the processing purposes to which you have consented, subject to the requirements of Regulation (EU) 2016/679 (GDPR).

(2) The Administrator shall not transfer some or all of your data to third countries or international organizations unless you have been expressly informed of this.

(3) Your data is only stored on the territory of the European Union. If your data is transferred to a third party that processes it outside the European Union, you will be explicitly notified before the transfer or allowed to explicitly consent to or oppose the transfer.

(4) Your data in connection with the banking transaction is stored and processed solely by PayPal. The Administrator does not store and process the data referred to in Article 4 (1) (3). We collect financial data, such as information related to your payment method, when you purchase, order, return, exchange, or request information about our services from the Site. We store limited, if any, financial information that we collect from you. All other financial information is stored by our payment processor – PayPal. We encourage you to review their privacy policy and contact them directly if you have questions.

Section VII – Your rights in the collection, processing, and storage of your data.

Art. 10. (1) If you do not wish all or part of your data to continue to be processed by the Company for any or all of the processing purposes, you may withdraw your consent to the processing at any time by completing the form to be found in the “Applications” section.

(2) The Administrator has the right to request verification of the identity and identity of the data subject.

(3) By withdrawing your consent to the processing of personal data that is mandatory for the creation and maintenance of a platform account, your account will become inactive. You may continue to use the Platform, but you will not be able to use its functionalities;

(4) You may withdraw your consent to the processing of your data for direct marketing purposes at any time.

(5) The withdrawal of consent does not affect the lawfulness of the processing of personal data that the Administrator has carried out up to that point.

Right of access

Art. 11. (1) You have the right to request and obtain from the Administrator confirmation of whether personal data relating to you are being processed, and you may at any time view in your profile if you are a registered contractor, the data we process about you.

(2) You have the right to access the data relating to you and the information relating to the collection, processing, and storage of your data.

(3) The Administrator shall provide you, upon request, with a copy of the personal data processed relating to you in electronic or other appropriate form.

(4) Providing access to the data is free of charge, but the Administrator reserves the right to charge an administrative fee in the event of repetitive or excessive requests.

(5) The email address of the individual engaged in a distance purchase arrangement as a client shall be retained for marketing purposes, specifically for the dissemination of communications pertaining to prevailing discounts and promotions, for a duration not exceeding two years from the date of the most recent order. Subsequent to this timeframe, the email address will be automatically expunged from the database within the email distribution software.

Right to rectification or completion

Art. 12. You may rectify or complete inaccurate or incomplete personal data relating to you directly through your account on the website or by completing the form that you will find in the “Applications” section.

Right to erasure (“being forgotten”)

Art. 13. (1) You have the right to ask the Data Administrator to erase some or all of the personal data relating to you, and the Data Administrator should erase them without undue delay where one of the following grounds applies:

the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
you withdraw your consent on which the processing is based and there is no other legal basis for the processing;
You object to the processing of the personal data relating to you, including for direct marketing purposes, and there are no lawful grounds for the processing which override;
the personal data have been unlawfully processed;
the personal data must be erased to comply with a legal obligation under EU or Member State law to which the Administrator is subject;
the personal data has been collected in connection with the provision of information society services and you no longer wish to use it;

(2) The Administrator is not obliged to erase the personal data if it stores and processes them:

for the exercise of the right to freedom of expression and the right to information;
to comply with a legal obligation requiring processing provided for in EU or Member State law applicable to the Administrator or for the performance of a task carried out in the public interest;
the establishment, exercise, or defence of legal claims.
To protect its legal interests from the possibility of being held financially liable.

(3) If you exercise your right to be forgotten, the Company will delete all of your data except for the following information:

information necessary to verify that your right to be forgotten has been exercised – email, IP address;
technical information about the functioning of the platform, which information cannot be linked in any way to your person;

(4) To exercise your right to be forgotten, you need to take the following steps:

Submit a request by email by completing and submitting the form you will find in the “Applications” section.
Provide a unique identification code to act, which will be sent by email to the email address associated with the registration made on the Platform;
Identify yourself as the account holder;

(5) Once we have verified the identity of the person who made the request and the person to whom the data relates following the above steps, we will delete any data we process about you per paragraph 3.

(6) By deleting your data, your account will become inactive. You may continue to use the Platform, but you will not be able to enter into reward donation contracts;

(7) The Administrator does not delete data that it has a legal obligation to keep, including for the defence of legal claims made against it or to prove its rights.

Right to restriction

Art. 14. You have the right to require the Administrator to restrict the processing of data relating to you where:

you contest the accuracy of the personal data, for a period that allows the Administrator to verify the accuracy of the personal data;
the processing is unlawful, but you do not wish the personal data to be erased, but only for its use to be restricted;
The Administrator no longer needs the personal data for the processing, but you require it for the establishment, exercise, or defence of legal claims;
You have objected to the processing pending verification that the Administrator’s legitimate grounds override your interests.

(2) If you exercise your right to restriction, the Company will cease processing your data but will not remove the posts, comments, reviews, and ratings you have made on the Platform.

Right to portability

Art. 15. (1) If you have given your consent to the processing of your data or the processing is necessary for the performance of the contract with the Administrator, or if your data are processed in an automated manner, you may after having legitimized yourself to the Administrator:

request the Administrator to provide you with your data in a readable format and transfer it to another Administrator;
ask the Administrator to transfer your data directly to an Administrator designated by you, where this is technically feasible.

(2) You may, at any time, download or obtain in a machine-readable format the data that is stored and processed about you in connection with your use of the Administrator’s services, directly through your account via the data export option or by email request after completing the form that you will find in the “Applications” section.

Right to receive information

Art. 16. You may request the Data Administrator to inform you of all recipients to whom the personal data for which rectification, erasure, or restriction of processing has been requested has been disclosed. The Administrator may refuse to provide this information only if it would be impossible or would require a disproportionate effort.

Right to object

Art. 17. You may object at any time to the processing of personal data concerning you by the Administrator, including if it is processed for profiling or direct marketing purposes.

Your rights in the event of a personal data breach

Art. 18. (1) If the Administrator becomes aware of a breach of the security of your data which may pose a high risk to your rights and freedoms, he shall notify you without undue delay of the breach and of the measures which have been taken or are to be taken.

(2) The Administrator is not obliged to notify you if: it has taken appropriate technical and organizational measures to protect the data affected by the breach; it has subsequently taken measures to ensure that the breach will not result in a high risk to your rights; notification would require a disproportionate effort.

Section VIII Persons who have access to your data

Art. 19. (1) to process your data provide the service in its full functionality and view your interests, the Administrator may provide your data to the following processors:

Processors:

Employees of NETWORK LOGIC Ltd who are responsible for processing requests;
Employees in the accounting and legal department;
Hosting service provider & technical department

Purposes of processing personal data:

Processing of contractor data for account registration;
Processing of accounting records, in fulfilment of the Administrator’s obligations under Bulgarian law;
Provision of information society services;
Protection of the legitimate interests of the Administrator;

(2) Said data processors shall comply with all legality and security requirements in the processing and storage of personal data.

Art. 20. (1) The Administrator shall not transfer your data to third countries unless you expressly agree. If the consent relates to a transfer, the Data Administrator shall describe the possible risks of the transfer of the data to third countries in the absence of an adequate protection solution and appropriate means of protection.

(2) As a general rule, your data is stored and processed throughout the European Union and the European Economic Area (EEA). If your data is transferred outside the European Union or the EEA, the transfer will be subject to any of the following safeguards:

Binding corporate rules from the relevant supervisory authority;
Based on standard contractual terms adopted by the European Commission;
An approved code of conduct or certification mechanism in the presence of legally binding and enforceable obligations on the third-party processor.

(3) If we determine that one of these measures is not sufficient to provide an adequate level of protection, on a case-by-case basis, we will adopt additional technical and/or organizational security measures following the recommendations of the European Commission. You can contact us at any time using the contact details listed above to find out more about the countries to which we transfer your data and the safeguards we have in place in respect of these transfers.

(4)The administrator uses the MailChimp software in order to optimize the processes related to sending automatic emails in the presence of an incomplete order, as well as those with marketing content in the presence of new products or promotional terms and discounts for the purchase of available products. In view of this, some personal data is transferred to the territory of the United States of America. In case you do not wish to receive such automatic emails, you can unsubscribe from them via the “Unsubscribe” button available in each email. To learn more about the rules according to which the software stores your data, you can visit their privacy policy.

Section IX – Annexes

Art. 21 (1) You can exercise all your rights regarding the protection of your data through the forms attached below or through the functionalities in your profile.

Withdrawal of consent form for processing purposes – Annex 1
Request “to be forgotten” – to delete personal data relating to me – Annex 2
Request for the portability of personal data – Annex 3
Request for rectification of data – Annex 4

(2) These forms are optional and you may make your requests in any form that contains a statement to that effect and identifies you as the data holder, provided that you clearly state your specific wishes about the processing and storage of your data.

This privacy policy is accepted and effective as of 01.06.2024