PRIVACY POLICY WEBSITE
1. Purpose and scope of the Privacy Policy (Introduction)
We, BOX NOW OOD, with headquarters and address of management Sofia 1000, Sredets District, 10 Tsar Osvoboditel blvd., floor 3 registered and entered in the Register of Commercial Companies at the Registration Agency with UIC 206892501, represented by Andrej Vyskrabka, citizen of Slovakia, as legal representative, managing and representing the company (“Box Now”, “we”, “us” or “our”), are the owners of the https://boxnow.bg website (the “Website”). In operating the Website we process your personal data in our capacity as personal data controller, as defined in the General Data Protection Regulation (EU) 2016/679 (the “GDPR”). We are committed to protecting your privacy in accordance with applicable data protection laws. When we write “you”, we mean you as our customer, website visitor or other relevant third party such as the contact persons of a company or other organisation we are doing business with and the like. The purpose of this Privacy Policy is to explain how we collect and use your personal data as well as how you can exercise your rights.
Any information you as user of the Website provide is received, stored and managed by us in line with this Privacy Policy.
We may update this Privacy Policy from time to time without prior notice to you. If we make changes, we will notify you by revising the date at the top of the policy in cases where the changes are not substantial or by providing more prominent notice for substantial changes, as appropriate.
By accessing, browsing or otherwise using the Website you confirm that you have read and understood this Privacy Policy, and for this purpose we use the Privacy Policy consent pop-up. If you do not agree with any part of this Privacy Policy, you must not use the Website.
2. How we collect information?
BOX NOW OOD is a postal operator providing courier services on the territory of the Republic of Bulgaria and international courier services.
We may collect personal data from you when you use services on our Website (Courier Services and other additional services under Atricle 4(2) of the General Terms and Conditions), correspond with us by post, email or telephone, create an account on our Website, request information or assistance from us, subscribe for a newsletter or other marketing communication from us, or otherwise use the Website. We may also automatically collect technical and usage data about your equipment, browsing actions and patterns when you interact with our Website. We collect this personal data by using cookies, server logs and other similar technologies.
If you do not provide certain information when requested, we may not be able to fulfil our obligations to you or respond to your requests, thereby preventing us from providing you with the highest level of service possible. We may also be prevented from complying with our legal obligations (such as our accounting and tax requirements). In cases where we collect your consent, the processing of your personal data will be completely voluntary and your refusal to consent would not lead to any adverse consequences.
3. What information do we collect?
The information we collect may include:
The use of certain features on our website requires registration and access passwords. Upon registration you provide the following personal data: full name, UCN, address, phone number, email address. This data will be used for purposes of the performance of the services you order.
When you order services, which Box Now provides in the capacity of a postal operator, we collect and process the following personal data - data for the sender and the recipient of each parcel or service: General information and contact details of Customer (sender) or Customer (recipient), such as name, phone number, email address, postal address; account name and account password. The information is necessary as it allows us to execute the requested service, to prepare and issue the documentation relating to the transportation of the parcels, to make contact with you at any time if it is necessary for the successful, accurate and timely performance of the service, and to review and respond to inquiries, complaints and other requests.
Data in bill of lading completed by the Customer required for the accurate performance of the service: names, mobile phone number and/or e-mail address of the Customer (sender) and of the Customer (recipient), and APM on his/her choice. Depending on the service used (for example payment on delivery) or in cases provided for by the law, BOX NOW may require provision of an address or additional identification data of the Customer (sender) and the Customer (recipient) of the shipment.
Unique security code (PIN) provided to the Customer - sent to the mobile phone number and/or e‑mail and/or an instant messaging application profile (including, but not limited to, Viber) indicated by the Customer. BOX NOW uses Customer’s mobile number, email address and instant messaging application profile (including, but not limited to, Viber) to send the PIN related to the Acceptance/delivery of the shipment, to inform about the progress of the dispatch of the shipment and as well as to provide shipment related documents, such as an invoice, or other payment records.
Data in shipment tracking system of BOX NOW, from which all stages of processing of the shipment (tracking) are visible.
The following data: (i) with respect to APM to APM delivery - confirmation sent by BOX NOW to the Customer (sender) by email or SMS for accepting the parcel; (ii) with respect to address to APM delivery - confirmation sent by BOX NOW to the Customer (sender)’s email address.
Payment information or billing information in connection with your use of our services, bank details for debit and credit cards (credit and debit card numbers from online transactions are not saved and stored) and other required date in case of a Cash on Delivery, payment of compensations on the basis of claims, etc.
The use of Box Now's services by e-shops entails the collection and processing of the absolutely necessary data of users, for the service of their order (such as their full name and contact details, email address). Each user, if it chooses Box Now's service for the delivery of its order, receives an electronic notification regarding the number of their order and can use the search and tracking service through the service available on our Website.
When we receive an inquiry from you submitted through any of our contact forms, the contact information will be used by us to contact you and provide the information or assistance needed.
We collect and process history of all orders made and all services rendered for the purposes of statistical and marketing analysis, testing of systems, maintenance and development, as well as for reviewing and responding to complaints, disputes or claims.
Some of the data, which you make available to us, we may use in order to respond to information requests from national regulators (CRC, CCP, CPDP) in connection with complaints or other proceedings brought before these authorities, or to provide to other State authorities or law enforcement agencies for the purposes of administrative controls, security controls, prevention and detection of offences and crimes.
Information Automatically Collected
We automatically collect certain information from you when you access the Website, including the following:
Identifiers, such as IP address and identifiers associated with browser cookies, web beacons, and similar tracking technologies.
Internet or Other Electronic Network Activity Information, such as information about your browser type, operating system, pages accessed on our Website, links clicked, and time spent on the Website.
Geolocation Data, such as your IP address that can reveal your general location.
We use this information to tailor the content of our website and to enhance your customer service experience. More information on the use of cookies can be found in the Cookie Policy.
4. How do we use your personal data and on what legal basis?
We may use information about you for various business and commercial purposes, including to:
· Provide services you request, process transactions and send you related information – necessary to enter into and perform our contract with you;
· Provide customer support and respond to your comments, questions and requests – necessary to enter into and perform our contract with you and also for our mutual legitimate interest to provide you with the requested assistance;
· Notify you of services, offers, promotions, events and features that may be of interest to you (marketing purposes) – on the basis of your express consent.
· Manage your online account(s) and provide required updates, security alerts and administrative messages – necessary for the performance of our contractual obligations under the Terms and Conditions;
· Detect and prevent fraud and ensure the security of the Website and our operations – necessary for the purposes of our legitimate interest to protect our business;
· Comply with our legal obligations – e.g. for accounting and tax purposes;
· Your personal data collected for the above purposes may be also processed for our protection against any legal claims by you or by third parties, as well as to establish and exercise our legitimate rights – necessary in view of the principles laid down in the applicable legislation on the right of defence against legal claims and of the protection of legitimate rights and interests, as well as our related legitimate interest to exercise the rights related to any legal claims, as provided for in the applicable legislation;
· We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for such further purpose, we will notify you and we will explain the legal basis which allows us to do so.
By visiting and browsing this Website, you are invited to provide your explicit consent to the processing and sharing of your personal data through the use of cookie technologies, through the relevant pop-up window and the available settings. You are free to withdraw your consent at any time by modifying the respective consent settings, without affecting the lawfulness of the processing of your data based on it until then. Regarding the information automatically collected from your browsing on our website through the absolutely necessary cookies and on the basis of our legitimate interest for the proper functioning of our website, please refrain from visiting it if you do not wish the collection and processing of this information. The information you submit to us in the relevant contact form is provided on the basis of your explicit consent. Your consent can be withdrawn at any time, without affecting the legality of the processing of your data up to that point, by sending a request to the email address specified below. The data you provide in the context of ordering products and drawing up a sales contract with online stores are collected in the context of servicing your contractual relationship with the store (sales contract). The use of the order tracking system available on our Website is carried out with your consent, which is provided by positive action (use of the service).
5. To whom do we disclose your personal data?
Box Now OOD will never share, sell or rent your information to third parties for their direct marketing purposes.
We may disclose information collected from and about you as follows (subject to applicable laws):
· With vendors, consultants and other service providers who use the information on our behalf solely to carry out our instructions and for no other purpose (e.g. website developer and Support Company, accounting firm, our subcontractors and partners in the course of the performance of our service etc.). These providers will act only on our instructions, will be subject to prior verification and will assume contractual obligations containing strict clauses regarding the protection of personal data. We strive to ensure that these third parties use personal data only for lawful purposes in accordance with this Privacy Policy;
· To comply with a request for information by law enforcement, or to the extent required by applicable law, regulation or legal process; (to the extent that we are required to do so by law) in connection with any legal proceedings or prospective legal proceedings; and in order to establish, exercise or defend our legal rights;
· If we believe there has been a violation of the Website Terms and Conditions, any user agreements or policies, or to protect the rights, property and safety of Box Now OOD or a third party;
· With your consent or at your direction.
Except as provided in this Privacy Policy, we will not provide your personal data to third parties.
6. Where do we store and transfer your personal data?
Personal data that we collect may be stored and processed in and transferred between any of the countries in which we operate, in order to enable us to use your personal data in accordance with this Privacy Policy.
Your personal data may be stored and transferred to countries which might not necessarily have data protection laws equivalent to those in force in the European Economic Area.
However, we will take all reasonable technical, organisational and legal measures to ensure that your personal data is securely processed, providing an adequate level of protection compared to the level of protection offered within the European Economic Area.
7. How do we protect your personal data?
Security is extremely important to us. We maintain appropriate technical and organisational measures to protect your personal data against accidental, unlawful or unauthorized destruction, loss, alteration, disclosure or access. Where appropriate, we use encryption and other technologies that can assist in securing the information you provide.
8. How long do we keep your personal data?
We will only save your personal data as long as necessary in order for us to achieve the purpose it was collected for or as required in order to comply with any mandatory retention periods under applicable law.
If you withdraw your consent to the collection and processing of your personal data where such consent is requested, we will delete your data from our electronic and physical records, unless the retention of such data becomes necessary to comply with a legal obligation or to exercise, establish or defend our rights or legitimate interests before judicial, tax or other authorities.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
9. Your rights
Under the GDPR you have the following rights:
· Right of access
You are entitled to obtain confirmation from us if your personal data is processed and, if so, to obtain a copy of your personal data being processed by us, as well as information on the processing. Please note that your right of access is not absolute, insofar as restricted by the rights and freedoms of others. For additional copies requested by you, we may impose a reasonable fee with respect to our administrative costs.
· Right to rectification
You are entitled to request from us to rectify your personal data that are inaccurate, and the completion of your personal data that are incomplete.
· Right to erasure
In some cases, you may be entitled to ask us to erase your personal data. This will include, for example, such cases where the personal data are no longer required for the purposes for which they were collected; if personal data have been processed unlawfully; if you exercise your right to object; etc.
· Right to restriction of processing
In some cases, you may be entitled to ask us to restrict the processing of your personal data, for example, if you want to determine the accuracy or the reason for their processing. The restricted processing usually comes down to simply storing your personal data, and any other processing is suspended.
· Right to data portability
In cases where the processing of your personal data is based on your consent or on a contractual necessity and to the extent that your personal data are processed automatically, you are entitled to obtain all such personal data that you have provided to us, in a structured, commonly used and machine readable format, and at your request we will submit these data to third parties where this is technically feasible.
· Right to file a complaint
If you find that in the processing of your personal data we have violated the applicable legislation on the protection of personal data, you are entitled to file a complaint with a competent supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. For the Republic of Bulgaria, the competent supervisory authority is the Commission on Personal Data Protection.
· Right to withdraw your consent
If we process any of your personal data based on your consent, you may recall your consent at any time.
· Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on our legitimate interests as explained above. We will no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
Where your personal data are processed for direct marketing purposes, you have the right to object at any time. In case of such objection we will no longer process your personal data for marketing purposes. In practice, you will usually expressly agree in advance to our use of your personal data for marketing purposes, and we will provide you with an opportunity to opt-out of the use of your personal data for marketing purposes. You can also manage your subscriptions by logging into your user account on our website, instruct us not to use your personal data for marketing purposes by email at any time or by following an “unsubscribe” link in our marketing messages.
10. Exercise of your rights
To exercise your rights related to our processing of your personal data, please contact us using any of the options specified below (under section “Contact us“). We will respond to your comments, questions and requests within one month of receiving them. If necessary, this period may be extended by another two months, taking into account the complexity and the number of requests, and you will be informed accordingly within the initial period of one month.
Please note that in some cases your rights are limited – for example, if we prove that we have a legal basis to process your personal data, such rights may be unenforceable.
We may need to require additional information from you in connection with your request, so that we can verify your identity and that you have the corresponding right. This is an additional security measure to ensure that your personal data will not be disclosed to any third parties who are not entitled to receive them, as well as to be able to process your request.
We will perform the actions related to the satisfaction of your rights above free of charge, except if your demands are clearly unfounded or excessive, in particular due to their repeatability – in such cases we may impose a reasonable charge, with a view to our administrative costs, or may refuse to take action on your request.
11. Policy Amendments
We keep this Privacy Policy under review and we may update it from time to time by posting a new version on our Website. You should check this page occasionally to ensure you are happy with any changes.
12. Contact
Questions, comments and requests regarding this Cookies Policy are welcomed and should be addressed to support@boxnow.bg or Sofia 1000, Sredets District, 10 Tsar Osvoboditel blvd., floor 3.