Personal Data Privacy Policy

8.1. Riotone Ltd, as an Administrator within the meaning of the law, collects personal data from individuals visiting the website online shop, and in this regard undertakes to ensure the confidentiality and protection of the personal data provided by the customers/users.
Our Personal Data Privacy Policy generally governs the way in which personal data are collected, how they are used, the conditions under which they may be disclosed to third parties, and the way they are stored.

8.2. Any customer who uses the website and the services provided through it is deemed to be aware of this Policy and is committed to complying with it.

8.3. What kind of personal data are collected:
We collect only those personal data of the customers that are appropriate, necessary, related to the purposes being processed (“data minimizing”), which does not include a special category of personal data (“sensitive data”). The personal information that is collected includes the name, address, e-mail address, phone number, and IP address.

8.4. The personal data, which we collect in connection with the services offered by it through the website online shop are always processed only for the specific purpose due to which the data are provided by the customers/users and are not processed in a way incompatible with these purposes.

8.5. Riotone Ltd processing the personal data provided, shall ensure an appropriate level of security and protection against unauthorized or unlawful processing and against loss, destruction or damage by applying appropriate technical and organizational measures to that effect.

8.6. Basis for processing personal data
Riotone Ltd shall process the personal data on a legitimate basis because the personal data are provided by customers in connection with the goods and services offered through the website within the framework of a contract for purchase and sale or when necessary to fulfill the conditions governing the use of the platform/website of online shop. The main reason for the processing of personal data is the execution of a contract for purchase and sale when the customers make a purchase; when registering on online shop and/or when using any of our services or features, although there are other reasons that allow the Administrator to process them, such as his or her interest in answering the enquiries of customers, or based on the consent they give about the possibility to receive advertising messages.

8.7. Purposes for which personal data are processed
Riotone Ltd shall process personal data of its customers:
– for administering the registration of users at the online shop;
– for subsequent development, implementation and realization of the contract for purchase and sale, which is being concluded between the Administrator and the customers through the website of the online shop;
– to provide information directly related to the goods that customers request;
– to receive advertising messages about our proposals/offers/articles addressed to customers;
– when using re-marketing through trusted sites, including Facebook;
– when we require the opinion of our customers regarding the offered goods;
– when performing statistical analyzes and other analyzes of the services offered through the online shop;
– to notify changes to our General Terms, Privacy Policy, or our services.

8.8. How personal data are collected:
Customers provide their personal data voluntarily when using our website For example, when sending a request for a particular article or service, or during the process of ordering the goods offered by Riotone Ltd through the online shop, and in particular when the customer/user fills in his or her personal data, which is a condition for access to certain features or services on the platform. The specified fields, which are indicated as mandatory for filling in, are the information the Administrator needs in order to conclude a contract for purchase and sale, to execute the delivery of the goods and for implementing the rights of the parties to the contract.
By providing the personal data under the previous point, the user agrees to receive by e-mail a confirmation of order and information for sending the order by courier. The user’s personal data shall only be used for the purpose of administering the particular order.
Upon consent to receive advertising messages, the user agrees to receive by e-mail current promotions, commercial offers.

8.9. Term of personal data storage:
Riotone Ltd, as an administrator, shall perform all necessary actions to protect and store personal data for the period during which the personal data are stored only to the extent and as long as it is necessary for the respective activity for which the data are provided, subject to the requirements and deadlines provided for in the applicable and effective regulations in the Republic of Bulgaria but for not more than 7 years. Upon expiry of this term, the customer/user’s personal data shall be destroyed.
The data provided for marketing purposes shall be retained until users notify that they no longer wish to receive the relevant information from us. Once the data processing goals have been met, the administrator destroys the data.

8.10. Access to personal data provided by users
Riotone Ltd, as an administrator of personal data, undertakes not to sell, provide or share for marketing purposes to third parties the personal data provided. Only authorized persons shall have access to these data.
Riotone Ltd shall provide personal information for the personal data of its customers to third-party service providers, subcontractors and other related organizations solely for the purposes of performing service activities for the customers/users, which they have given their explicit consent for.
The user’s personal data shall not be disclosed to third parties without the prior consent of the customer until the date of destruction, unless required by a statutory instrument or lawful order of a body of public authority. However, when third-party service providers are used, only the personal information needed to provide the service for which data are provided by customers/users shall be disclosed. The third-party recipients, whom Riotone Ltd works with, are mainly service providers through which it provides the goods purchased by customers. They shall use the personal data submitted to them to provide information and fulfill their obligations arising in that relation under contracts with them.
The provision of personal data to state institutions can only take place in the cases provided by the law and in a volume that does not exceed the purposes for which they have been requested.
The employees of Riotone Ltd guarantee and undertake to respect the confidentiality of the personal data of the users.

8.11. Right of access, correction or deletion of personal data
Customers/Users are entitled at any time to request:
1. Access to their personal data, collected in the process of providing and using the services, including: confirmation of whether we process the personal data provided to us, what data categories are, the purposes of such processing, and the recipients to whom the data are disclosed.
2. Correction of the personal data, which the customers/users have provided, when the data are inaccurate.
3. Deletion of the personal data, when they are no longer necessary for the purposes for which they have been collected or otherwise processed and there is no other legal basis for the processing than the consent on which the processing of the personal data is based, and when the data have been unlawfully processed. Withdrawal of consent shall not affect the lawfulness of the processing based on what has been given prior to its withdrawal.

8.12. To perform the abovementioned actions of access provision, correction and deletion of personal data is only possible when the user requests this by a written application addressed to the Administrator, which should contain:
1. Name, address and other identification data of the individual concerned;
2. Description of the request;
3. Preferred form for providing information;
4. Signature, date of filing, correspondence address and contact telephone;
5. Notarized Letter of Attorney when filed by an authorized person.
The application shall be sent to the address where the Administrator’s registered office is located, by registered mail or courier.
The Administrator shall notify the decision to execute the requested action or the refusal to do so within one month of application receipt. The notification hereof shall be sent by mail with a return receipt or can be received personally against signature.

8.13. Right of objection
In the cases provided by the law, each user has the right:
p. 1. to file an objection before the Administrator against the processing of the personal data relating to him/her, provided there is a legal ground for doing so. When the objection is justified, the personal data of the person concerned can not be processed anymore;
p. 2. to make an objection against the processing of personal data for the purposes of direct marketing;
p. 3. to be notified before his or her personal data are to be disclosed to third parties for the first time or used on user’s behalf for the purposes under the preceding paragraph of this article, providing the user with the opportunity to make an objection against such disclosure or use.
p. 4. Each user can complain about the way his or her personal data are processed by contacting us on tel. +359876227378
p. 5. In all cases when the customer/user considers that his or her data are being processed unlawfully or the response does not satisfy the request, the customer/user may contact the competent authority for personal data protection – the Personal Data Protection Commission. The Personal Data Protection Commission is the supervisory authority exercising legal control over the processing of personal data.

8.14. You may send any questions related to this Policy to e-mail