Privacy Policy for Westgate.bg

This Privacy Policy governs your use of products, services, content, features, technologies, and other offerings provided by INVICTA EOOD.

Where the terms “we”, “us”, or “our” are used in this Privacy Policy, they refer to INVICTA EOOD, the company acting as the controller of your personal data.

By clicking a button or confirming a checkbox labeled “I agree” or “Confirm”, which you hereby acknowledge as your ordinary electronic signature pursuant to Article 3, item 10 of Regulation (EU) No 910/2014, you express your consent to be bound by this Privacy Policy.

By accepting this Privacy Policy, you expressly agree to the use and disclosure of your personal information by us and authorize us to perform these actions in the manner described herein.

1. General Provisions

1.1.

This Privacy Policy forms an integral part of the Terms of Use of westgate.bg.

We, meaning INVICTA EOOD, place great importance on the protection of our clients’ personal data. Through this Privacy Policy, we inform the Client about the collection, use, and processing of personal data when registering for or using our services and all their related components.

All personal data of clients is collected, processed, and stored in accordance with the principles established by applicable legislation and Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR).

1.2.

You are required to read this Privacy Policy carefully in order to become familiar with the policies and practices applied to the Client’s personal data, how such data will be used, and how we will handle it. If you do not agree with this Privacy Policy, you should not use our Services (as defined in the agreement with you).

By providing us with your personal data and maintaining contractual relations with us after reviewing this Privacy Policy, we will consider that you have agreed to the collection, use, and disclosure of your personal data in accordance with this Privacy Policy, unless you notify us otherwise.

2. Information We Collect

We process three main categories of personal data, depending on the legal basis for their processing:

2.1. Information processed for the performance of contractual obligations

We request and collect the following information when you wish to use our services. This information is necessary for the proper and lawful execution of the contract. Without it, we will not be able to provide the requested services.

• Name of the person placing the order for the product/service
• Name of the person receiving the product/service
• Phone number
• Email address
• Delivery address

2.2. Information processed based on your consent or the consent of third parties

You may choose to provide us with additional information about yourself or other persons. If you provide personal data of third parties, you declare that you have obtained their consent to disclose such data.

Such personal data is processed based on your consent or the consent of the relevant third party and may include:

Any information disclosed by you in connection with initiated communication between us for customer support purposes

Additional personal data such as contact details or alternative delivery addresses requested for additional services

Data related to your complaints – we are required to maintain a register of complaints and collect relevant data

2.3. Information processed based on legal obligations and legitimate interests

When you use our services and websites, you agree that we may collect information automatically, including information considered personal data (such as IP addresses). This information is necessary to fulfill legal obligations and our legitimate interests in improving functionality and service conditions:

Data from official identification documents, where applicable, for issuing tax invoices and enabling VAT or duty refunds

Service usage information, including orders placed

Access data automatically collected, including IP addresses, access timestamps, browser information, and other identifiers

Cookies: We use cookies and similar technologies to provide services conveniently. For more information, please review our Cookie Policy

Payment card data (where applicable): We do not have access to your card details. These are processed securely and automatically by the integrated Virtual POS and used by the financial institution to process the transaction

3. How We Use the Information We Collect

We use, store, and process information, including personal data, solely for the purpose of providing our services to end users. We do not use your personal data for profiling, marketing, or similar purposes.

In the future, we may implement systems to process information in order to improve website functionality, customer support, communication efficiency, and the security of our online services.

4. Conditions for Sharing Personal Data

4.1. With Your Consent

Where you have provided consent, we may share your personal data in accordance with that consent, for example, for warranty services provided by third parties.

4.2. Sharing Within Our Corporate Group

For the purpose of fulfilling our obligations related to providing goods and services, we may share certain personal data among members of our corporate group.

4.3. Sharing with Third Parties

We may share personal data with third parties for lawful fulfillment of our obligations, including:

4.3.1. Warranty services

Sharing names and contact details with subcontractors providing warranty services.

4.3.2. Accounting and tax compliance

Sharing identification data with accounting service providers for invoicing and tax compliance.

4.3.3. Delivery of goods and services

Sharing names, contact details, and delivery addresses with courier companies.

4.3.4. Online content provision

Hosting and online service providers automatically collect access data such as IP addresses and usage behavior.

4.3.5. Card payment processing

Our acquiring financial institution processes card payment data (PAN, CVC, name, expiration date) when card payment functionality is used.

5. Data Retention Period

We retain personal data in accordance with statutory minimum retention requirements.

Where no legal retention requirement applies, data is retained no longer than necessary to cover the statutory limitation periods for potential legal claims.

6. Compliance with Legal Obligations

We may disclose information, including personal data, to courts, law enforcement authorities, government bodies, or other authorized entities where required or permitted by law for:

• Compliance with legal obligations
• Legal proceedings and defense against claims
• Responding to lawful requests related to investigations
• Enforcing our Terms and contractual relationships
• Protecting rights, property, or personal safety

7. Data Transfers Outside the European Economic Area (EEA)

We work with various service providers globally. This may require transferring, storing, or processing data outside the EEA.

In such cases, we ensure appropriate safeguards are in place, including adequacy decisions by the European Commission where applicable. Additional information may be provided upon request.

8. Your Rights

You may exercise any of the rights listed below by contacting us at reservations@westgate.bg
. We may request identity verification before processing your request.

8.1. Right of Access

You have the right to access, receive, and transfer your personal data. Requests are processed within one month unless complexity requires extension.

You may:

• Receive a copy in a structured, commonly used, machine-readable format
• Transfer data between controllers
• Store data for personal use
• Request unrestricted transfer

Requests may be refused if manifestly unfounded or excessive.

8.2. Right to Rectification

You may request correction of inaccurate or incomplete data. Requests are processed within one month unless extended due to complexity.

8.3. Right to Erasure (“Right to Be Forgotten”)

You may request deletion of your personal data, subject to legal obligations preventing erasure.

8.4. Right to Restriction of Processing

You may request restriction of processing of your personal data, subject to legal limitations.

8.5. Right to Object

You may object to automated processing and request human intervention.

8.6. Right to Withdraw Consent

Where processing is based on consent, you may withdraw it at any time. Processing will cease unless another lawful basis applies.

9. Security

We continuously implement administrative, technical, and physical safeguards, including encryption, pseudonymization, firewalls, and access controls. If you suspect unauthorized access, please contact us immediately.

10. Amendments to the Privacy Policy

We reserve the right to amend this Privacy Policy at any time. Updated versions will be published on our website and will take effect unless you object to the changes.