1. Introduction:

   This Privacy Notice applies to coffeemall.bg, owned and operated by Balkam Group EOOD.
   

Visitors to the coffeemall.bg website of Balkam Group EOOD fall into two categories:
   

• Unregistered: Individuals who visit the website of Balkam Group EOOD without creating an account.
   
• Registered: Visitors who register on the website of Balkam Group EOOD by entering personal data.
   

 If you wish to purchase goods from Balkam Group EOOD via our website - coffeemall.bg - it is necessary to provide and process your personal data.
 

The protection of your personal data is a priority for Balkam Group EOOD and we guarantee the highest possible level of protection.

In processing personal data, Balkam Group EOOD complies with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) - hereafter the GDPR (Regulation (EU) 2016/679) - as well as the relevant Bulgarian laws - the Personal Data Protection Act and the applicable local legal framework for data protection. Data are processed in accordance with this Privacy Notice of Balkam Group EOOD.

As a controller, Balkam Group EOOD has implemented numerous technical and organisational measures to ensure the fullest possible protection of your personal data processed through this website.

Which personal data and information are processed by the controller Balkam Group EOOD, and why they are collected and processed, is explained in this Privacy Notice for data subjects using the services of the website of Balkam Group EOOD. This Privacy Notice aims to inform you how to access and update your information. It also informs you of your rights.

 

2. Principles relating to the processing of your personal data

2.1. Balkam Group EOOD processes your personal data for the purposes of concluding sales in the online store of Balkam Group EOOD and performing the obligations arising from such sales, in compliance with the following principles:
   

a) Personal data shall be processed lawfully, fairly and in a transparent manner. The GDPR specifies that processing is lawful only if and to the extent that at least one of the following applies:

• the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
• processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
• processing is necessary for compliance with a legal obligation to which the controller is subject;
• processing is necessary in order to protect the vital interests of the data subject or of another natural person;
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

b) Personal data are collected for specified, explicit and legitimate purposes and are not further processed in a manner incompatible with those purposes.

c) The personal data collected and processed in connection with sales in the online store of Balkam Group EOOD are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

d) Personal data are accurate and, where necessary, kept up to date.

e) Personal data are erased or rectified where they are found to be inaccurate or disproportionate in relation to the purposes for which they are processed.

f) Personal data are kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.

g) Personal data are processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

2.2. Employees who process personal data undergo initial and periodic training on data protection and are acquainted with the applicable legislation.

 

3. Definitions

Our Privacy Notice must be clear and understandable. To ensure this, we would first like to explain the terminology used in it.

In this Privacy Notice, we use the following terms:
   

a) Personal data

“Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

b) Data subject

A data subject is a natural person who is identified or can be identified on the basis of certain information.

c) Processing of personal data

“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

d) Restriction of processing

“Restriction of processing” means the marking of stored personal data with the aim of limiting their processing in the future.

e) Profiling

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

f) Controller or controller responsible for processing

“Controller” or controller responsible for processing means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

g) Processor

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

h) Recipient

“Recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.

i) Third party

“Third party” means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

j) Consent

“The data subject’s consent” means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

 

4. Name and address of the controller
   

For the purposes of the GDPR (Regulation (EU) 2016/679), other data protection laws applicable in the Member States of the European Union and other provisions related to data protection, the controller is:

Balkam Group EOOD, UIC 202680807, in its capacity as a Personal Data Controller, registered in the “Register of Personal Data Controllers and their registers” under identification No. 414517 and as evidenced by a Certificate issued on 11.02.2015 by the Chair of the Commission for Personal Data Protection, receives personal data from the data subjects.

Balkam Group EOOD
9 Slivnitsa Blvd.,
1324 Sofia, Bulgaria
Tel.: +359 2 925 0509
E-mail: [office@spetema.com](mailto:office@spetema.com)

 

5. Cookies

The website of Balkam Group EOOD uses “cookies.”

“Cookies” are text files which, when you visit our website through your internet browser, are placed on your device. When you visit it again, the cookie enables our website to recognise your device. Thus, cookies allow us to recognise our users on our website. The purpose of this recognition is to make it easier for users to utilise our website. With the help of cookies, the information and offers on our website can be optimised with the user in mind. A user of a website that employs cookies, for example, does not need to enter access data every time they visit, because the cookie is stored on the user’s computer system and the website takes over this function. Another example is the shopping cart cookie in an online store. The online store remembers the items that the customer has placed in the virtual shopping cart via a cookie.

You can, at any time, refuse all cookies or have your browser notify you when a cookie is sent by using the appropriate setting in your internet browser. In addition, cookies already set can be deleted at any time via the internet browser or other software programs. This is possible in all popular internet browsers. If you deactivate the setting of cookies in your internet browser, some functions or services of the website may not function properly without cookies.

 

6. Social networks

Your access to social networks such as Facebook, Google+, LinkedIn, YouTube and similar platforms requires a separate registration and acceptance of the terms and conditions of those sites. Balkam Group EOOD is not responsible for the protection of your personal data when accepting those terms and conditions. Please review the terms and conditions of those sites in detail.

 

7. Collection and processing of data

If you order a product, we will ask you for your personal data so that we can process your order and deliver the goods to you.

When you register on our website, we will retain the data you provide to facilitate your purchases from our website. By creating an account in our store, you will have access to a faster checkout process, be able to save your personal settings, and view previous orders.

Registered individuals are free to change at any time the personal data provided during registration and ordering.

If you need to contact us in another way to place an order (e.g., by phone, email, or in person at a retail location), we will also collect information about you through those channels so that we can process your order and deliver the goods.

• Personal data processed by Balkam Group EOOD:We process the following categories of personal data provided by you and necessary for identification and performance of the contractual obligations of Balkam Group EOOD:

(1) for physical identity: your first name and surname;
Names, address and other data of an authorised representative, as listed in the power of attorney authorising them to represent the data subject before Balkam Group EOOD;

(2) contact data: your address — for delivery, invoicing, for sending repaired or replaced goods, and for correspondence (street, number, block, entrance, floor, apartment; district; postal code, locality name, country or other: e.g., shipment to a courier company’s post office), email address, contact telephone;

(3) bank account information — data collected when making a payment to Balkam Group EOOD or for a refund by Balkam Group EOOD of the price paid in the legally established period for returning an online purchase or in case a product cannot be repaired or replaced upon a justified complaint (bank account information is not mandatory, since the data subject may choose cash on delivery or cash payment (in person at a retail location of Balkam Group EOOD));

(4) your access profile data — your username for Coffeemall.bg, password, order history;

(5) data from your social network profiles (publicly available information from your Google+, Facebook profiles).

Legal basis for processing your personal data — by accepting the general terms and conditions and registering in the online store via a social network profile, a contractual relationship is created between the Controller and you, on the basis of which we process your personal data — Art. 6(1)(b) GDPR.
You can always choose which personal data you wish to provide to us (if you wish to provide any at all). However, if you want to place an order, we require (at a minimum) your first and last name, delivery address, contact phone number, and email. If you choose not to provide them, we will not be able to process your order and deliver the goods.

• Data provided by you through the use of a device (your computer, tablet, phone or other device):

When you visit (access) our website, we automatically collect information, part of which may be personal data. This information includes data such as (1) your Internet Protocol address (IP address), (2) the date and time of access to our website, (3) the types and versions of browser used, (4) information about the device’s operating system, (5) your language settings, (6) the internet service provider of the accessing system, (7) browsing history, (8) the webpage from which the accessing system reaches our website (the so-called referrers).

Balkam Group EOOD does not draw conclusions about you when using these data. This information is necessary for the purposes of:

(1) properly presenting the content of our site;

(2) optimising the content of our site;

(3) ensuring the long-term viability of our IT systems and website technology; and

(4) protecting the functioning of the site, for example protection against cyberattacks and, where necessary, enabling the investigation of criminal offences. The legal basis for processing the IP address is Article 6(1)(f) GDPR. Our legitimate interest is determined by the purposes listed above for processing these data. They will not be transferred to third parties unless there is a legal obligation to disclose the data or the transfer serves the purposes of criminal prosecution.

• The following data, prepared and generated by Balkam Group EOOD in the course of selling goods, are processed:

(1) order number, customer number, invoice information and the amounts of the liabilities contained therein;

(2) data necessary for preparing invoices for deliveries, as well as for proving their authenticity - type, quantity and value of the purchased goods;

(3) information about the payment method you choose,

(4) payments made and due;

(5) information on amendments, additions or cancellations of orders, reporting defects, obtaining information and assistance in relation to purchased products.

 

8. Provision of personal data by the data subject to the controller as a contractual or legal obligation. Possible consequences of failure to provide personal data.

We clarify that the provision of personal data may be partially required by law (e.g., tax regulations) or may result from contractual provisions (e.g., information about the contractual partner). For example, the data subject must provide us with personal data when a contract is concluded with them. Failure to provide personal data would result in the contract with the natural person not being concluded and performed.

Before providing their personal data, the data subject may contact our contact person. Our contact person will explain to the data subject whether the provision of personal data is required by law or contract or is necessary for the conclusion of the contract.

 

9. The purpose of processing your personal data is to accept your purchase orders and to carry out sales in the online store based on those orders. Your personal data are processed on the following legal bases:

a) to establish your identity and conclude sales;

b) to use the data collected about you to perform the contractual obligations of Balkam Group EOOD arising from the sale of goods:
   

• activities related to accepting orders placed in the online store of Balkam Group EOOD (i.e., through this website) and dispatching the ordered goods (delivery to the purchaser);
• contacting individuals by phone or electronically, sending correspondence related to order fulfilment;
• processing withdrawal from the transaction (purchase);
• corrections of amounts due where there is a basis for this;
• making payments by the customer or refunding the amount paid to the customer;
• handling and responding to inquiries, requests, complaints, suggestions or grievances;
• keeping accounting records of deliveries made;
• updating the personal data provided or information about purchases made by the customer;
• warranty servicing of products;
• processing by processors — assignment, reporting, acceptance, settlements;

c) compliance with legal obligations:

• to comply with the requirements of the Accounting Act, the Tax and Social Insurance Procedure Code, and applicable legislation (for issuing invoices, credit and debit notes);
• to ensure control by the revenue administration;
• to provide information about the customer and purchases made by them upon request/inquiry/inspection by a competent authority;
• to provide information upon request of the Commission for Consumer Protection in connection with obligations under the Consumer Protection Act;
• to provide information to the Commission for Personal Data Protection in connection with obligations under the data protection legal framework - Regulation (EU) 2016/679 of 27 April 2016, the Personal Data Protection Act.

10. Except where your personal data are processed for compliance with a legal obligation, for the performance of the controller’s contractual obligation under a contract to which you are a party, or to take steps at your request prior to entering into a contract, or are processed to protect the vital interests of you or another natural person, or to protect the controller’s legitimate interest where it does not conflict with the legitimate interests of the natural person, your personal data may be processed on the basis of your explicit consent (e.g., for direct marketing). If you have given such consent, you may withdraw it at any time.

Balkam Group EOOD uses your personal data solely for the purpose of accepting purchase orders, carrying out sales in the online store of Balkam Group EOOD based on those orders, and performing Balkam Group EOOD’s contractual obligations arising from the sale of goods. Balkam Group EOOD has no right and will not use the data provided for this purpose for other purposes, such as direct marketing. Consent is a separate legal basis for processing your personal data, and the purpose of the processing is specified in the consent (e.g., for direct marketing) and is not covered by the purpose set out in this Privacy Notice for data subjects making purchases through the website of Balkam Group EOOD. The controller, Balkam Group EOOD, ensures technical conditions for consent to be given as a freely expressed, specific, informed and unambiguous indication of the data subject’s wishes, by a statement or by a clear affirmative action signifying their agreement to the processing of personal data relating to them. The controller provides technical conditions that ensure that withdrawal of consent is as easy as giving it. The request for consent, as well as the option to withdraw it, are presented in clear language, in a way that clearly distinguishes it from other matters, in an intelligible and easily accessible form.

 

11. Your personal data may be provided to the following categories of third parties and public authorities:
   

11.1. Processors who process personal data on behalf of and on assignment from Balkam Group EOOD on the basis of a written agreement, or who have direct or indirect access to your personal data:

• courier and transport companies for the performance of contractual obligations to deliver purchased goods and accompanying documents (invoices and warranty cards on paper); for the transfer of repaired or replaced goods under warranty service; as well as letters and other correspondence;
  entities providing service and maintenance for sold products;
• entities maintaining equipment and software used to process your personal data; entities performing installation and/or maintenance activities at the address where the service is provided; banks for servicing your payments;
• entities providing services for organising, storing, indexing and destroying archives on paper and/or electronic media; individuals engaged under civil contracts by Balkam Group EOOD to support online sales, logistics, delivery, etc.;
• service providers in various fields - consultants, experts, lawyers - in connection with the online sale of goods, their delivery and complaints regarding purchased products.

Personal data are provided to processors only where there is a justified reason and on the basis of a written arrangement requiring recipients to ensure an adequate level of protection.

Processors are not permitted to process the personal data provided to them for purposes other than the performance of the work assigned by Balkam Group EOOD. Processors are obliged to comply with all instructions of Balkam Group EOOD.

Balkam Group EOOD takes the necessary measures to ensure that the engaged processors strictly comply with data protection legislation and the instructions of Balkam Group EOOD, and that they have implemented appropriate technical and organisational measures to protect personal data.

11.2. Your personal data may be provided to competent public authorities for the performance of their statutory obligations under the applicable laws and secondary legislation - courts, prosecution, investigative authorities, the Ministry of Interior, audit authorities - the National Revenue Agency, theNational Social Security Institute, supervisory authorities - the Commission for Consumer Protection, the Commission for Personal Data Protection, etc., when they lawfully request the data in connection with the performance of their powers.

 

12. Period for which your personal data will be stored 

The controller processes and stores your personal data only for the period necessary to achieve the purposes specified in this Privacy Notice, or to comply with legal requirements established by European legislation or by laws or secondary legislation to which Balkam Group EOOD is subject.

We will retain your personal data only as long as necessary. We maintain specific policies and procedures for record management and storage so that personal data are deleted after a reasonable period, according to the following retention criteria:

•  We retain your data while we have an ongoing relationship with you.
• We will retain your data as long as necessary to provide services to you.
• We retain your data as long as necessary to achieve compliance with our legal and contractual obligations.

After the expiry of the retention periods, personal data are deleted/destroyed (using an applicable method - e.g., shredding, incineration or permanent deletion from electronic media, documented by minutes prepared by a commission appointed by order of the Manager), unless:

• they are needed for pending court, arbitration, administrative or enforcement proceedings, or upon receipt of your complaint that must be reviewed by Balkam Group EOOD;
• you have exercised your right to request restriction of the processing of your personal data.

 

13. Your rights

You have the following rights regarding your personal data:

a) Right to confirmation

You have the right to obtain from the controller, Balkam Group EOOD, confirmation as to whether or not personal data concerning you are being processed. If you wish to exercise this right to confirmation, you may contact our contact person or another employee at any time.

b) Right of access

You have the right to obtain from the controller, Balkam Group EOOD, free information at any time about your personal data being processed, as well as a copy of this information. In addition, you have the right to receive access and an explanation regarding the processing of your personal data, which includes the following information:

• the purposes of the processing;
• the categories of personal data concerning you;
• the recipients or categories of recipients to whom your personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
• where possible, the envisaged period for which your personal data will be stored, or, if not possible, the criteria used to determine that period;
• the existence of the right to request rectification or erasure of personal data or restriction of processing of personal data concerning you, or to object to such processing;
• the right to lodge a complaint with a supervisory authority;
• where the personal data are not collected from you, any available information as to their source;
• the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.
• Where your personal data are transferred to a third country or an international organisation, you have the right to be informed of the appropriate safeguards relating to the transfer.

If you wish to exercise this right of access, you may contact our contact person or another employee of Balkam Group EOOD at any time.
The explanation regarding processed data includes the information that Balkam Group EOOD provides to you through this Privacy Notice.

Upon your request, Balkam Group EOOD may provide you with a copy of your personal data undergoing processing.

Providing access to your personal data must not adversely affect the rights and freedoms of third parties or lead to a breach of a legal obligation of Balkam Group EOOD.

Where your requests for access are manifestly unfounded or excessive, in particular because of their repetitive character, Balkam Group EOOD may charge a reasonable fee based on the administrative costs of providing the information or refuse to act on your request for access.
Balkam Group EOOD will assess on a case-by-case basis whether a request is manifestly unfounded or excessive.
In case of refusal to provide access to personal data, Balkam Group EOOD will state its reasons and inform you of your right to lodge a complaint with the CPDP (Commission for Personal Data Protection).

c) Right to rectification

You have the right to obtain from the controller, Balkam Group EOOD, without undue delay the rectification of inaccurate or incomplete personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by providing a supplementary statement.
Where a request for rectification of personal data is granted, Balkam Group EOOD will notify other recipients to whom the data have been disclosed (e.g., service providers, public authorities) so that they can reflect the changes.
If you wish to exercise this right to rectification, you may contact our contact person or another employee of the controller at any time.

d) Right to erasure (“right to be forgotten”)

You have the right, granted by European legislation, to obtain from the controller, Balkam Group EOOD, the erasure of personal data concerning you without undue delay, and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• you withdraw your consent on which the processing is based, and there is no other legal ground for the processing;
• you object to the processing and there are no overriding legitimate grounds for the processing;
• you object to the processing of your personal data for direct marketing purposes;
• your personal data have been unlawfully processed;
• your personal data must be erased for compliance with a legal obligation of the controller, Balkam Group EOOD;
• your personal data have been collected in relation to the offer of information society services to a child within the meaning of Article 8(1) of Regulation (EU) 2016/679.

 

Balkam Group EOOD is not obliged to erase personal data to the extent that processing is necessary:

• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation of Balkam Group EOOD;
• for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) of Regulation (EU) 2016/679;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of Regulation (EU) 2016/679, in so far as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
• for the establishment, exercise or defence of legal claims.

If any of the above grounds apply and you wish to have personal data stored by Balkam Group EOOD erased, you may contact our contact person or another employee of the controller at any time.

e) Right to restriction of processing

You have the right to obtain from the controller, Balkam Group EOOD, restriction of processing where:

• you contest the accuracy of your personal data, for a period enabling the controller to verify the accuracy of the personal data;
• the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
• the controller no longer needs the personal data for the purposes of the processing…

This Privacy Notice (policy) of Balkam Group EOOD was last updated on 31.10.2025.