I. GENERAL INFORMATION

1. Data Controller

We would like to provide you with information about how we collect and process your personal data on aya-estate.com.

The data controller of the Site (hereinafter also referred to as "We", "Us") is Seewines JSC, with UIC 202972213, based in the town of. Sofia and management address "Vitosha" district, bul. "Bulgaria", 106, in. D, which is responsible for the protection of your personal data.

To contact us:

from "Seewines" JSC, with UIC 202972213, based in the town of. Sofia and management address "Vitosha" district, bul. "Bulgaria", 106, in. D, in. Contact phone: +359882387197 , contact e-mail: contact@ayaestatevineyards.com

It is of the utmost importance that the information we hold about you is accurate and up to date. Please let us know if at any time there is a change in your personal information to update your personal details in your profile.

Please note - by submitting your personal data, you confirm that you are over 18 years of age. If this is not the case, you should contact us immediately so that we can take action to delete it.

2. What data we collect about you, for what purpose and on what basis we process it

Personal data is any information that can identify an individual. Anonymous data is not included in this category. We process the following categories of personal data:

.

Please note - where we are required to collect personal data by law or under the terms of a contract between us and you do not provide this data to us on request, we may not be able to perform the contract (for example, to supply you with goods or services). If you do not provide us with the requested data, we may have to cancel the product you have ordered, but if we do, we will notify you in good time.

We will only use your personal data for the purpose for which it was collected or, if necessary, for a purpose similar in purpose to the main purpose. If we need to use your data for an unrelated new purpose, we will notify you, setting out the legal reasons for our actions.

We may process your personal data without your knowledge or consent, but only to the extent permitted by law. We do not carry out automated decision making or automated profiling.

4. Methods of collecting your personal data:

- Provided to us personally by you (for example, by filling in forms on our website or by sending emails);

- Automatic collection of certain data obtained from you when you use our website, through the use of cookies and similar technologies. Please see our cookie policy for more details here.

- We may receive data from third parties such as: analytics providers (e.g. Google) based outside the EU; advertising networks (e.g. Facebook) based outside the EU; search information providers (e.g. Google) based outside the EU; technical, payment and delivery service providers, information brokers or aggregators.

- The legal justification for processing your personal data for marketing communications purposes is: your consent or our legitimate interests (for example - to expand our business).

In accordance with data protection and electronic communications laws, we may send you marketing communications if:

(A) you make a purchase, register on our site or make an enquiry to us about our goods or services; or

(B) you have consented to receive marketing communications, in either case you have not expressly opted out of receiving such communications. Under the law, if you are a legal entity, we may send you marketing emails without your consent. In this case, you may also opt-out of receiving marketing emails from us at any time.

Before we share your personal data with third parties for their marketing purposes, we will ask for your explicit consent.

You may request that we stop sending marketing communications to you at any time by logging into the website and your profile, and adding, or unchecking the relevant boxes/options to adjust your marketing preferences.

Please note - if you opt-out of receiving marketing communications, this opt-out does not apply to personal data provided as a result of other transactions such as purchases, warranty records, etc.

5. Sharing your personal data

We may share your personal data with the following parties:

- Service providers who provide IT services and system administration;

- Professional advisers including lawyers, bankers, auditors, accountants and insurers;

- Government bodies who require us to report on processing;

- Courier companies;

- Third parties who acquire or merge parts of our business or assets.

We require all third parties to whom we transfer your data to respect the security of your personal data and treat it in accordance with the law. Third parties may only process your personal data for specified purposes and in accordance with our instructions.

6. Data security

We have security measures in place to prevent accidental loss, use, alteration, disclosure or access to your personal data without permission. We only provide access to your personal data to those employees and partners who have a business need to use such data. They are instructed to process your personal data according to our instructions and to comply with confidentiality rules.

We have a procedure for dealing with suspected leaks of your personal data and will notify you, and the relevant regulators, of such breaches if and when necessary.

7. Data retention

We will retain your personal data for as long as is necessary to fulfil the purposes for which we collected it or to satisfy any legal, accounting or reporting requirements.

When deciding how long to keep this data, we consider its quantity, nature and sensitivity, the potential risk of unauthorised use or disclosure and the purposes of the processing, and whether these can be achieved by other means and legal requirements.

Please note - tax laws require us to retain basic information about our customers (such as contact, identity, financial and transaction data) for up to ten years after you cease to be our customer.

In certain circumstances, we may make your personal data anonymous for research or statistical purposes, and in such cases we may use this information indefinitely and without notice to you.

8. Data retention period

Personal data is kept for the periods necessary to achieve the purposes for which it was collected. Once the purposes for which the personal data was collected have been achieved, we will destroy it immediately.

We will take all necessary technical and organisational measures to destroy data that is no longer necessary, except where there is a legal basis to process it for a longer period of time; where you have made a request to restrict processing, in accordance with your rights detailed below; or in order to be compatible with the original purpose for processing, of which you will be informed in due course.

We retain the personal data collected for the following periods:

(a) where the data is processed on the basis of a distance contract for an order of goods, for a period of 5 years, which period shall commence from the date of termination of the distance contract for an order of goods.

(b) where the data are processed on the basis of consent, until the consent is expressly withdrawn.

c) where the data are processed for the protection of the exercise of the Company's rights and interests which reasonably override the interests of individuals - until the right is extinguished and/or the interest is no longer relevant.

After the expiry of the aforementioned periods, if there is no other basis for processing the data, it will be deleted. In order to obtain and analyze information related to the products and services you use and to improve service, the Company may delete only part of the data. In these cases, it continues to store such part of the data that does not allow individuals to be subsequently identified.

9. Third Party Links

This website may include links to other third party websites, plugins and applications. Clicking on or activating these links may allow third parties to collect or share data about you.

We do not control these websites and accordingly are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of each website you visit.

10. Cookies

You can set your browser to refuse all or some cookies or to alert you when websites set or access cookies. If you disable or refuse cookies, please be aware that some parts of this website may become inaccessible or may not function properly. For more information about the cookies we use, please see here.

II. YOUR RIGHTS

As the subject of data that we process, you have rights, the content of which is set out in full below.

You should note that the provision of personal data is voluntary - it is necessary to enter into a contract with the Company. If the data is not provided, the Company will not be able to provide a product or service.

We will comply with your requests without delay, within up to 30 calendar days of your request. With our decision, we grant or deny access and/or the information requested by the requester, but we always give reasons for our response. For this purpose, a link to this Policy is posted on the Company's web site in a clearly visible location.

Requests concerning the exercise of your rights shall be submitted to:

- in person or by a person expressly authorised by you, by notarised power of attorney at the Company's registered office.

- electronically by sending an e-mail to: ---

- by calling ---

The exercise of the rights is free of charge and covers all structured and unstructured data as well as all databases maintained by the Company.

Exceptions to the time limit for the satisfaction of rights and the free of charge principle are allowed for requests from the same customer for data with a frequency greater than 3 times a year and requiring the mobilization of significant administrative resources on the part of the Company. In this case we may charge a reasonable fee in view of the administrative costs incurred.

Where the data subject submits a request by electronic means, the information shall, where possible, be provided by electronic means unless the data subject has requested otherwise.

Where the Company has a reasonable concern about the identity of the individual making a request to exercise his or her rights under this paragraph, the person directly responsible shall immediately consult the Data Protection Officer in order to carry out the customer identification.

You should also bear in mind that the withdrawal of consents given does not affect the lawfulness of the processing of your personal data prior to the withdrawal. Notwithstanding a withdrawal of consent, your personal data may still be processed by the Company if any of the other grounds for data processing set out in this Policy apply.

You have the following rights:

1. Right to information

As a data subject, you have the right to obtain information about important features of the processing of your personal data, including but not limited to its purpose, duration and basis, recipients and categories of recipients of personal data, etc.

In accordance with applicable data privacy law, you have the rights below and we undertake to respond to any request you make within 1 month of receipt of the request and without charge. In the event of any difficulty in complying with such requests in a timely manner, the time for compliance may be extended by a further 2 months, which will be notified to you within 1 month of receipt of the request.

2. Right of access

You may request information about what personal data we process about you and whether we process such data. You can request access to this data.

We will provide you with an extract of the personal data that is being processed. We may charge a reasonable fee based on administrative costs for additional extracts. Where you make a request by electronic means, where possible we will provide the information in a commonly used electronic form unless you have requested otherwise.

3.  Right of correction

If we process incomplete or inaccurate personal data from you, you may request its correction or completion at any time.

4.  Right to erasure

You may request the erasure of your personal data in the following cases:

- the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;

- you withdraw your consent on which the processing is based and there is no other legal basis for the processing;

- you consider that the personal data have been unlawfully processed.

Please note that there may be other reasons that prevent the immediate erasure of your data, such as statutory retention obligations, pending proceedings, the establishment, exercise or defence of legal claims, etc.

5.  Right to restriction of processing

You have the right to request restriction of processing if:

- you contest the accuracy of the personal data, for a period that allows us to verify the accuracy of the personal data;

- the processing is unlawful, but you do not want the personal data to be erased, but request instead a restriction on its use;

- we no longer need the personal data for the purposes of the processing but you require it for the establishment, exercise or defence of legal claims;

- you have objected to the processing pending verification that our legitimate grounds for processing the data override your interests.

If a restriction of processing is requested, we will inform you before the restriction of processing is lifted.

6.  Right to data portability

You can ask us to provide you with the personal data we process about you in a format that can be easily read by a computer and transferred to another controller. This only applies where

- the processing of the specific data is based on your consent or in connection with the conclusion and performance of a distance contract for the ordering of goods; and

- the processing is carried out by automated means.

7.  Right to object

You have the right, at any time and on grounds relating to your particular situation, to object to processing of your personal data which is based on a legitimate interest - the grounds are set out in the table above.

Where you have given your consent to processing for direct marketing purposes, you have the right to object to processing of personal data at any time, without providing any grounds.

8. Right to lodge a complaint

If you believe that we have violated applicable data protection law in the processing of your data and as a result have affected your rights, please contact us.

Of course, you also have the right to lodge a complaint with the Data Protection Commission, which is the supervisory authority in the field of data protection, at. 1592 Sofia Blvd. "1595 Prof. Tsvetan Lazarov No. , tel. 02/91-53-518, e-mail: kzld@cpdp.bg.

All requests, as well as additional clarifications and information related to the exercise of your rights, can be requested directly to us by contacting us at the contacts indicated.

This Policy was adopted on 10.05.2024.