DATA PROTECTION POLICY AND COMPULSORY INFORMATION ON THE RIGHTS OF PERSONS FOR THE PROTECTION OF PERSONAL DATA General information

As of May 25, 2018, a new General Data Protection Regulation - Regulation (EU) 2016/679 or the so-called GDPR (General Data Protection Regulation) adopted by the European Union, which is directly applicable on the territory of the European Union, including the territory of the Republic of Bulgaria (The regulation). The Regulation aims to ensure the protection of the data of individuals by and in all EU Member States and to harmonize the regulations for their processing.

Information about administrators of personal data of the ANDREWS group of trading companies

The Andrews Group of Companies trade goods with the ANDREWS / or ANDREWS FASHION STUDIO trademark and jointly process personal data of customers, includes the following companies, personal data controllers, namely:ANDREWS FASHION EOOD, entered in the Commercial register  at the Registry Agency with EIK 130945603; ANDREWS GOLD EOOD entered in the Commercial register  at the Registry Agency with EIK: 202616167; ANDREWS INTERNATIONAL EOOD, entered in the Commercial register  at the Registry Agency with EIK: 202067891; ANDREWS LIFESTYLE EOOD entered in the Commercial register  at the Registry Agency with EIK: 202174368; “ANDREWS LOOKS EOOD entered in the Commercial register  at the Registry Agency with EIK: 202219799; “ANDREWS PLATINUM EOOD entered in the Commercial register  at the Registry Agency with EIK: 202615762; “ANDREWS PREMIUM EOOD entered in the Commercial register  at the Registry Agency with EIK: 202219685; “ANDREWS SILVER EOOD entered in the Commercial register  at the Registry Agency with EIK: 202616142; “ANDREWS STORES EOOD entered in the Commercial register  at the Registry Agency with EIK: 202174382; „DV ELEGANS EOOD, entered in the Commercial register  at the Registry Agency with EIK: 175227900; „ANDREWS RETAIL EOOD, entered in the Commercial register  at the Registry Agency with EIK: 202067989; „ANDREWS LOOKS EOOD, entered in the Commercial register  at the Registry Agency with EIK: 202219799; „ANDREWS CLUB EOOD entered in the Commercial register  at the Registry Agency with EIK: 202219532.  Contact information about all the data controllers listed is available at Sofia, 47a Sitnyakovo Blvd.; http://andrews.bg/; e-mail: office@andrews.bg

The above-listed companies – data controllers, which constitute the Andrews Group of Companies and operate shops trading goods bearing the trademark ANDREWS / or ANDREWS FASHION STUDIO, jointly and separately collect, store and process your personal data (personal data of customers). The Andrews Group of Companies, respectively the aforementioned companies, process personal data in a lawful, conscientious and transparent way, with respect to personal data.

The contact you make with each of the above listed personal data controllers will be considered and accepted as contact with administrators together and with each of the administrators, insofar as the said administrators jointly operate personal data of customers and users of merchandise bearing the commercial brand ANDREWS / or ANDREWS FASHION STUDIO. 

Information about the competent supervisory authority

The Personal Data Protection Supervisory Authority in the Republic of Bulgaria is the Commission for Personal Data Protection (CPDP), with its headquarters and address: Sofia 1592, "Prof. Tsvetan Lazarov "№ 2; Telephone: 02/915 3518, Email: kzld@government.bg, kzld@cpdp.bg; Web site: www.cpdp.bgYou may make complaints to the designated CPCP, in case you believe that your personal data is processed or stored illegally.The Andrews Group of Companies, which operate commerce stores with the trademark ANDREWS / or ANDREWS FASHION STUDIO and which are mentioned above, carry out their activity of collecting, storing and processing your personal data as individuals in accordance with The Personal Data Protection Act and Regulation (EC) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of their personal data and on the free flow of such data.

Reason for collecting, processing and storing personal data

The Andrews Group of Companies, which operate shops trading goods bearing the trademark ANDREWS / ANDREWS FASHION STUDIO and which are explicitly mentioned above, collect and process your personal data in connection with and in relation to their commercial sales activity regarding goods bearing the trademark ANDREWS / or ANDREWS FASHION STUDIO on any of the following grounds:
*  Providing your data and / or receiving your consent as a real and / or potential client and / or user for collecting, storing and processing your personal data for the purposes stated herein;
* fulfillment of obligations under contracts with customers and / or consumers on behalf of the Group of Companies ANDREWS and / or any of them; for the execution of orders and / or orders for delivery of goods and in other similar cases;
* compliance with the legal obligations applicable to the ANDREWS Group of Companies mentioned above and / or to one of them.* For the purposes of the legitimate and legally defensible interests of the Group, the ANDREWS trading companies referred to above and / or any of them or a third party unless the interests or fundamental rights and freedoms of the data subject that require protection of personal data.

 The ANDREWS Group of Companies, respectively any of the aforementioned companies, is a personal data administrator concerning your data as a real and / or potential user of the ANDREWS / ANDREWS FASHION STUDIO products offered by the companies. All of these companies are joint data controllers, insofar as they operate shops trading goods that bear the ANDREWS / or ANDREWS FASHION STUDIO trademark.

Objectives and principles of collecting, processing and storing personal data

The Andrews Group of Companies, respectively, each of the companies listed above, collects, stores and processes your personal data in connection with its business activities, signing contracts with companies, as well as subscribing to our events, our programs for loyal customers, our promotions and discounts, including for purposes as follows:* Creating a customer profile to better meet your needs and needs as a real or potential customer of the Andrews Group of Companies;* individualizing parties to contracts or legal relationships in view of their implementation;
* registration of participants in games, lotteries, customer programs, issuing discount cards, issuing vouchers and / or organizing events organized by the Andrews Group of Companies or one of them;* accounting and / or statistical purposes;* sending information messages, invitations for events, customer information, information about new collections, new products, promotions, discounts, events and other customer-oriented initiatives, newsletters and catalogs with information on the products offered, etc.,like;
* Improvement and customizing  your needs by sending offers, information about events, and other products and services that may be of interest to you;The Andrews Group of Companies, respectively each of the above companies, complies with the following principles when processing your personal data:
* lawfulness, good faith, and transparency;
* limitation of processing goals to the extent necessary;
* relevance to processing goals and minimizing the collected data by collecting only data relevant to and limited to what is necessary concerning the purposes for which it is processed.
* accuracy and actuality of the data, taking all reasonable steps to ensure the timely erasure or correction of inaccurate personal data, taking into account the purposes for which they are processed;
* restriction of storage in order to achieve the objectives;
* the integrity and confidentiality of processing and ensuring an adequate level of security of personal data, including protection against unauthorized or unlawful processing and accidental loss, destruction or damage, by applying appropriate technical or organizational measures.

In the processing and storage of personal data, the Andrews Group of Companies, respectively any of the aforementioned companies, may process and store the personal data in order to protect their legitimate interests and to fulfill their legal or regulatory obligations, including, but not limited to, its obligations to the National Revenue Agency, the Ministry of Internal Affairs, Chief Directorate "Combating Organized Crime and other state and / or municipal authorities.

What types of personal data are collected, processed and stored

The Andrews Group of Companies, respectively each of the aforementioned companies, performs the following operations with personal data for the following purposes:* Registration and / or creation and administration of client profiles to provide the opportunity to apply discounts, promotions and other programs for loyal clients;
* Conclusion and execution of commercial transactions and legal relationships with clients or partners - the purpose of this operation is the conclusion and execution of orders, requests for contracts with clients and their administration;
* Sending of information messages - the purpose of this activity is to maintain an up-to-date relationship and ongoing relations with clients and to announce current customer programs, current and new products and collections, current events, promotions, discounts and other activities carried out by the Andrews Group of Companies or by any of the aforementioned companies;The Andrews Group of Companies, respectively each of the aforementioned companies, processes the following categories of your personal data:
* individualizing data (first name, surname and family name, PIN and / or date of birth, postal address, e-mail and telephone)The Andrews Group of Companies, respectively each of the companies mentioned above, do NOT perform automated decision making with data.The Andrews Group of Companies, respectively, each of the companies mentioned above DO NOT collect, store or process any personal data that:* reveal racial or ethnic origin;* disclose political, religious or philosophical beliefs or membership of trade unions;
* genetic and biometric data, health status, or data on sexual life or sexual orientation.The Andrews Group of Companies, respectively each of the companies mentioned above, do NOT collect, store and process personal data of children.

 Term of storage of your personal data

The Andrews Group of Companies, respectively, each of the aforementioned companies, processes and stores your personal data for a term:* if the data are collected, processed and stored with the consent of the person - for an unlimited period until the consent is withdrawn;* if the data are collected, processed and stored for execution of a contract, order, request or any legal relationship - up to 5 years or its execution, respectively until the termination, realization and performance of the rights and obligations thereunder, unless there is a statutory obligation to keep the data for a more extended period for accountancy or other legitimate reason and / or due to a legal act;
* if the data are collected, stored and processed on the basis of a legal or regulatory obligation - for the period up to the fulfillment of the statutory or statutory obligation or for the period provided for in the relevant norms;
* if the data are collected, stored and processed for purposes of legitimate and legally defensible interests of the Group, ANDREWS trade companies or any of them - until the realization of the protection of legitimate interests or the realization of the legitimate interests concerned; The ANDREWS group of companies, respectively any of the companies listed above, will notify you in case the data retention period is to be extended in order to meet legal obligations or legitimate interests or otherwise.
The Andrews Group of Companies, respectively each of the companies mentioned above, holds the personal data that they need to keep under the applicable law for the relevant term, which may exceed the duration of your registration. 

Transmitting your personal data for processing

The Andrews Group of Companies may, at its own discretion, transmit all or part of your personal data to processors for the purposes of processing, subject to the requirements of Regulation (EU) 2016/679.

Your rights in the collection, processing, and storage of your personal data are:

Right to delete (the right to be forgotten)

You have the right to request from the ANDREWS group of companies, respectively from each of the companies listed above, the deletion of the personal data related to you, and from the Andrews Group of Companies, respectively, of each of the aforementioned companies, has the obligation delete them without undue delay when one of the following reasons exists:
* personal data are no longer needed for the purposes for which they were collected or otherwise processed;
* You withdraw your consent on which the processing of the data is based, and there is no other legal basis for the processing;
* You object to the processing of personal data relating to you, including for the purposes of direct marketing, and there are no legitimate grounds for preserving and processing that have an advantage;
* personal data has been tampered with;
* personal data must be deleted to comply with a legal obligation under EU law or the law of a Member State that applies to the Andrews Group of Companies, respectively to any of the aforementioned companies.To exercise your right of "forgetting," you should submit to "Request for deletion of processed personal data under Regulation (EU) No 2016/679 of 27 April 2016, Section 2, Article 17.

The Andrews Group of Companies, respectively the above-mentioned companies of which it is incorporated, are not obliged to delete your personal data, ONLY in the cases explicitly referred to in Regulation (EC) No 2016/679 of 27 April 2016, i.e., only if they store and process them:
* to exercise the right to freedom of expression and the right to information;
* to comply with a legal obligation that requires treatment provided for under EU law or the law of the Member State applicable to the Administrator or for the performance of a public interest task or the exercise of the official authority conferred on it;
* for reasons of public interest in the field of public health; * for purposes of archiving in the public interest, for scientific or historical research or statistical purposes;
* for the establishment, exercise or protection of legal claims. The Andrews Group of Companies, respectively the aforementioned companies of which it consists, do not delete the data that they have a legal obligation to store, including for defense against claims brought against them or proof of rights. 

Right of limitatio

You have the right to request from the Andrews Group of Commercial Companies, respectively all or any of the above mentioned companies, of which it consists, to restrict the processing of your related data through "Application for restriction of the processing of personal data, in accordance with Regulation (EU) No 2016/679 of 27 April 2016, Section 2, Article 18 when:
* You challenge the accuracy of personal data for a period that allows the accuracy of personal data to be verified;
* processing is illegal, but you do not want your personal data to be deleted, but only their use to be limited;
*your personal data is no more needed for the purposes of processing, but you require them to establish, exercise or protect your legal claims;
* You have objected to the proceedings, pending verification whether the legal grounds of the Andrews Group or any of the aforementioned companies have an advantage over your claims and / or interests.

Right of portability

You may at any time download the data that is stored and processed for you by the Andrews Group of Companies, respectively by all or any of the aforementioned companies, by submitting to at least one of them a "Request for transfer or transfer of processed data in accordance with Regulation (EU) No 2016/679 of 27 April 2016, Section 2, Article 20.You may request from the Andrews Group of Companies, respectively from anyone or at least one of the companies listed above, to directly transfer your personal data to a designated personal data administrator when such a transfer is technically feasible.

Right to receive information

You may request from the Andrews group of companies, respectively from any or at least one of the above-mentioned companies, to inform you of all recipients to whom the personal data for which the correction, deletion or limitation of the processing is requested has been disclosed by submitting a "Request for notification of correction, deletion or limitation of the processing of personal data in accordance with Regulation (EU) No 2016/679 of 27 April 2016, Section 2, Article 19.
The provision of such information may be refused only if it can not be provided, or if the provision requires disproportionate efforts.

Right of objection

You may at any time object to the processing of personal data relating to you by the Andrews Group of Companies, respectively, of all or any of the aforementioned companies, including whether the data is processed for profiling or direct marketing purposes, by sending to at least one of the companies an "Objection to the processing of personal data in accordance with Regulation (EU) No 2016/679 of 27 April 2016, Section 2, Article 21."

Your rights in case of violation of  the security of your personal information

If the Andrews Group of Companies, or any of the above-mentioned companies, finds a breach of the security of your personal data, which may pose your rights and freedoms at high risk, the company is obliged to inform you without undue delay of the violation as well as of measures taken or to be taken in accordance with "Privacy Notice of violation of the security of personal data" in accordance with Regulation (EU) No 2016/679 of 27 April 2016, Section 2, Article 33 (1).The Andrews Group of Companies, respectively the companies mentioned above, are not required to notify you if they:
* have taken appropriate technical and organizational protection measures with respect to the data affected by the security breach;
*- have subsequently taken measures to ensure that the violation will not lead to a high risk for your rights;
*- notification would require disproportionate efforts. 

Persons your personal information is provided to

The Andrews Group of Companies, respectively the above-mentioned companies, DO NOT provide your data to third parties other than the aforementioned companies,  comprising the Andrews Group of Companies, except for keeping accounts according to the legal requirements in the Republic of Bulgaria or a legal obligation to provide information and data, including on legitimate requests from public authorities, NRA, Chief Directorate "Combating Organized Crime (CDCOC), Courts and other competent state authorities, including for statistical purposes and in other cases not inconsistent with Regulation (EU) No 2016/679 of 27 April 2016.The Andrews Group of Companies, respectively the above-mentioned companies, DO NOT transfer your data to third countries.

Right to appeal

In case of violation of your rights, under the above or applicable data protection laws, you have the right to file a complaint with the Personal Data Protection Commission whose correspondence data is listed above.You may exercise all of your rights to protect your personal data through the forms specified in this information. Of course, these forms are not mandatory, and you can make your claims in any form that contains your statement and identifies you as the data holder.
Cookie PolicyThe site of Andrews Group of Companies uses cookies that are important for its fair work. By visiting our site http://www.andrews.bg, you accept the use of cookies.  

Security measures regarding the security of personal data

The security measures in relation to  personal data that are collected, processed and stored by the Andrews Group of Companies, respectively by the aforementioned companies, are continuously updated, and the required level of security is maintained and appropriate technical and organizational measures are applied, including encryption, taking into account the achievements of technical progress, the nature, scope, context and purposes of the processing, as well as the risks of different probability and the severity of the rights and freedoms of the natural persons, while at the same maintaining and ensuring consistent confidentiality, integrity, availability and sustainability of the processing systems, respectively archiving and the  ability to promptly restore the availability and access to personal data in the event of a physical or technical incident.The assessment of the appropriate level of security shall take into account the risks associated with the processing, including accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to transferred, stored or otherwise processed personal data. The security of every type of information, including personal data, located on our infrastructure is a priority for us as a company. Data security is something we can not and do not want to compromise. We make every effort to fully comply with the new Personal Data Protection Regulation by applying adequate information security systems.