PRIVACY POLICY
CALASSI respects your privacy and is committed to handling your personal information responsibly, transparently and in accordance with applicable data-protection law, including the General Data Protection Regulation (GDPR) where applicable.
This Privacy Policy explains what personal information we collect when you visit our website, place an order, contact us or otherwise interact with CALASSI, why we use it and what rights you may have.
The legal entity responsible for operating CALASSI and acting as data controller is identified in our Legal Notice.
INFORMATION WE COLLECT
Depending on how you interact with CALASSI, we may collect information including:
- your name;
- billing and delivery address;
- email address;
- telephone number;
- order and transaction information;
- products purchased or requested;
- correspondence and information you provide when contacting us;
- company and professional information where relevant to a business enquiry;
- technical information such as IP address, browser, device and website interaction data;
- cookie and consent preferences; and
- other information necessary to provide the service you request.
We do not normally receive or store your complete payment-card details when payment is processed directly by an authorised payment provider.
HOW WE USE YOUR INFORMATION
We may process personal information in order to:
- process, confirm and fulfil orders;
- arrange payment, shipping and delivery;
- communicate with you about an order;
- provide customer service;
- manage returns, refunds, complaints and product issues;
- respond to enquiries and collaboration requests;
- maintain appropriate business, accounting and tax records;
- protect our website, customers and business against fraud, misuse and security threats;
- improve the operation and performance of our website;
- understand how our website and services are used, where permitted;
- comply with legal and regulatory obligations; and
- send marketing communications where you have consented or where another lawful basis permits us to do so.
We do not use personal information for purposes that are incompatible with the purposes for which it was collected.
LEGAL BASES FOR PROCESSING
Where the GDPR applies, we process personal information only where we have an appropriate legal basis.
Depending on the circumstances, this may include:
Performance of a contract — where processing is necessary to process and fulfil your order, arrange delivery, handle a return or otherwise provide a service you requested.
Legal obligation — where we must retain or process information to comply with accounting, tax, consumer-protection or other applicable legal requirements.
Legitimate interests — where processing is reasonably necessary for the operation, security and improvement of our business or services, provided those interests are not overridden by your rights and interests.
Consent — where you have freely given consent for a particular purpose, for example certain marketing communications or non-essential cookies where consent is required.
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
ORDERS & PAYMENTS
When you place an order, we process the information necessary to enter into and perform the purchase contract with you.
This may include your contact details, billing and delivery information, products ordered and relevant transaction information.
Payments are handled through payment services available through our Shopify store. Payment providers may process information independently in accordance with their own privacy notices and legal obligations.
SHOPIFY
Our online store is hosted using Shopify.
Shopify provides the ecommerce infrastructure that allows us to display products, process orders and operate our online store.
In providing these services, Shopify may process personal information relating to visitors and customers on our behalf or for purposes described in its own privacy documentation, as applicable.
SHIPPING & DELIVERY
To fulfil your order, relevant personal information may be provided to shipping, courier, logistics and fulfilment providers.
This will normally include information such as your name, delivery address, telephone number, email address and information necessary to identify and deliver your shipment.
We only provide information reasonably necessary for the relevant service.
SERVICE PROVIDERS
We may use trusted third-party providers to support the operation of CALASSI.
Depending on the services we use, these may include providers of:
- ecommerce infrastructure;
- payment processing;
- shipping and logistics;
- website hosting and technical services;
- email services;
- analytics;
- marketing tools;
- fraud prevention and security;
- professional accounting, legal or other business services.
These providers receive personal information only where reasonably necessary for their services or where otherwise permitted or required by law.
INTERNATIONAL DATA TRANSFERS
Some service providers used to operate our website or fulfil our services may process personal information outside Bulgaria or the European Economic Area.
Where GDPR requirements apply to such transfers, appropriate legal mechanisms and safeguards will be used where required.
These may include an adequacy decision of the European Commission or appropriate contractual safeguards.
MARKETING COMMUNICATIONS
If you choose to receive news, product releases, invitations or other marketing communications from CALASSI, we may use the contact information you provide for this purpose.
Where consent is required, marketing will be sent on the basis of that consent.
You may unsubscribe at any time using the unsubscribe option included in the communication or by contacting us.
Withdrawing from marketing communications does not affect service messages necessary to administer an order or respond to a request.
COOKIES
Our website uses cookies and similar technologies for functions including operation of the store, remembering preferences and, where permitted, analytics and marketing.
Non-essential technologies requiring consent will be used in accordance with your cookie choices where applicable.
More information is available in our Cookie Policy.
HOW LONG WE KEEP INFORMATION
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and for any additional period required by applicable legal, accounting, tax, warranty, dispute-resolution or record-keeping obligations.
Different categories of information may therefore have different retention periods.
When personal information is no longer required, it will be deleted, anonymised or otherwise handled in accordance with applicable law.
SECURITY
We take reasonable technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.
No online system or method of electronic transmission can, however, be guaranteed to be completely secure.
YOUR RIGHTS
Depending on where you live and the applicable law, you may have rights relating to your personal information.
Under the GDPR, these may include the right to:
- obtain information about how your personal data is processed;
- request access to your personal data;
- request correction of inaccurate or incomplete information;
- request erasure in certain circumstances;
- request restriction of processing in certain circumstances;
- object to certain processing;
- receive certain personal data in a portable format where applicable; and
- withdraw consent at any time where processing is based on consent.
These rights are subject to the conditions and exceptions provided by applicable law.
DIRECT MARKETING
You have the right to object at any time to the processing of your personal data for direct marketing purposes.
If you object to direct marketing, we will stop using your personal data for that purpose as required by applicable law.
COMPLAINTS
If you have concerns about the way we process your personal information, we encourage you to contact us so that we can address them.
Where the GDPR applies, you also have the right to lodge a complaint with a competent data-protection supervisory authority.
If CALASSI's data controller is established in Bulgaria, the relevant Bulgarian supervisory authority is the Commission for Personal Data Protection, without prejudice to any right you may have to approach another competent supervisory authority.
CHILDREN
CALASSI is not intended to collect personal information from children.
If we become aware that personal information has been provided by a child in circumstances where the processing is not lawful, we will take appropriate steps in accordance with applicable law.
CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy when our services, technologies, legal obligations or data-processing practices change.
The current version will be published on this website.
CONTACT
For questions about this Privacy Policy or to exercise a data-protection right, please contact CALASSI through our Contact page.
Information identifying the data controller and its contact details is available in our Legal Notice.