Privacy policy
Privacy Policy – Biotrade.shopping
Introduction
We respect your privacy and take our obligations under the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679) very seriously.
This Privacy Policy explains how Biotrade collects, uses, stores and protects your personal data when you visit and shop on biotrade.shopping, a Shopify-powered e‑commerce website available to customers across the European Economic Area (EEA).
This Policy is designed to help you understand:
what personal data we process;
why and on what legal basis we process it;
who receives your data;
how long we keep it; and
what rights you have and how to exercise them.
Appropriate technical and organizational security measures are applied to all personal data processing activities.
This Privacy Policy applies to NJ Global Ltd and Biotrade Cosmeceuticals Ltd, operating under the trademark Biotrade Cosmeceuticals, jointly referred to as “Biotrade”, “we”, “us” or “our”.
1. Who is responsible for your personal data?
The joint data controllers for the processing of your personal data are:
1. NJ Global Ltd
Company number (UIC): 204823481
VAT number: BG204823481
Registered address: 24 Vartopo Str., 1797 Sofia, Bulgaria
2. Biotrade Cosmeceuticals Ltd
Company number (UIC): 204785746
Registered address:
24 Vartopo Str., 1797 Sofia, Bulgaria
These entities jointly operate the commercial activities under the Biotrade Cosmeceuticals brand, including sales through this website.
For all questions related to personal data processing, you may contact us at:
📧 office@biotrade.bg
📬 24 Vartopo Str., 1797 Sofia, Bulgaria
2. Data Protection Officer (DPO)
We have appointed a Data Protection Officer (DPO) who supports us in ensuring lawful, transparent and secure processing of personal data.
You can contact our DPO at: privacy@biotrade.bg
3. Purposes of processing and legal basis
3.1 Online purchases and order fulfilment
When you place an order on our website, we process your personal data in order to conclude and perform a distance sales contract.
Categories of data:
Name
Shipping and billing address
Email address
Telephone number
Payment-related data (processed securely by payment providers)
Legal basis:
Article 6(1)(b) GDPR – performance of a contract
3.2 Customer support and product consultation
When contacting our customer support team, you may voluntarily provide additional information in order to receive assistance or product recommendations.
If you choose to share information related to your skin condition or health (including photos), such data is considered special category data.
Legal basis:
Article 6(1)(b) GDPR – contract facilitation
Article 6(1)(f) GDPR – legitimate interest (customer support quality)
Article 9(2)(a) GDPR – explicit consent for health-related data
Health-related data is processed only with your explicit consent and solely for the purpose requested.
3.3 Email marketing of similar products
If you purchase products from us, we may send you marketing communications about similar products, unless you object.
Legal basis:
Article 6(1)(f) GDPR – legitimate interest
You may object at any time using the unsubscribe link in each message.
3.4 Newsletter and other marketing communications
We will send newsletters and other marketing messages only after obtaining your explicit consent.
Legal basis:
Article 6(1)(a) GDPR – consent
You may withdraw your consent at any time.
3.5 User account creation
Creating a customer account allows you to:
track orders;
view purchase history;
manage personal details;
communicate with us more easily.
Legal basis:
Article 6(1)(b) GDPR
3.6 Internal statistics and analytics
Certain aggregated and non-identifying data (e.g. purchase history, location, age group) may be used for internal statistical analysis.
Legal basis:
Article 6(1)(f) GDPR – legitimate interest in business optimisation
3.7 Legal obligations and communication with authorities
We may process personal data when required by law or when cooperating with public authorities.
Legal basis:
Article 6(1)(c) GDPR – legal obligation
3.8 Complaints, disputes and legal claims
Data related to orders and payments may be stored to defend or exercise legal claims.
Legal basis:
Article 6(1)(f) GDPR – legitimate interest
3.9 Security and fraud prevention
Video surveillance may be used in our business premises for security purposes.
Legal basis:
Article 6(1)(f) GDPR – legitimate interest
4. Recipients of your personal data
Your personal data may be shared with:
Payment service providers (e.g. Shopify Payments, PayPal, banks)
Courier and fulfilment companies
IT and cloud service providers, including Shopify Inc.
Marketing and analytics platforms (with consent where required)
Accounting firms and legal advisors
Public authorities, when legally required
All processors act under contractual obligations in accordance with Article 28 GDPR.
5. Data retention periods
Account data: stored until account deletion
Order and transaction data: stored for 5 years after the last purchase
Marketing data: until consent is withdrawn
Legal records: as required by applicable law
6. Your rights under GDPR
You have the right to:
Access your personal data
Rectify inaccurate data
Request erasure (right to be forgotten)
Restrict processing
Object to processing
Data portability
Withdraw consent at any time
7. How to exercise your rights
Requests may be sent to:
office@biotrade.bg
privacy@biotrade.bg
We will respond within one month.
8. Supervisory authority
Our lead supervisory authority is the Personal Data Protection Commission (Bulgaria).
You also have the right to lodge a complaint with your local EU supervisory authority.
9. Obligation to provide personal data
Providing personal data is voluntary but necessary for order processing and delivery.
10. Automated decision-making
We do not use automated decision-making within the meaning of Article 22 GDPR.
11. Transfers outside the EU
Where personal data is transferred outside the EU/EEA, we apply appropriate safeguards, including:
Standard Contractual Clauses (SCCs)
EU–US Data Privacy Framework (where applicable)
Recipients may include:
Shopify Inc.
Google LLC
Meta Platforms, Inc.
The Rocket Science Group LLC (Mailchimp)
12. Final provisions
This Privacy Policy is effective as of 14 January 2025.
We reserve the right to update this Policy. Any material changes will be communicated via the website or email.
