This Privacy Policy explains how we collect, use and protect your personal data when you visit our website and contact us. We comply with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and the Bulgarian Personal Data Protection Act.
1. Who controls your data
The data controller is:
- ▸MARGIMART Ltd. ("МАРГИМАРТ" ООД)
- ▸Company ID (ЕИК): 207853234
- ▸Address: 4B General Kolev Str., 5800 Pleven, Bulgaria
- ▸Email: margimart.ltd@gmail.com
- ▸Website: https://www.bohosandwich.com
2. What personal data we collect
2.1. Data you provide through the contact and catering forms
- Name
- Email address
- Event details (e.g. type, date, number of guests, budget)
- The content of your message
2.2. Data collected automatically
When you consent to analytics cookies, Google Analytics processes limited technical information — approximate location (city/country level), device and browser type, pages visited and interactions. This data is used in aggregate and is not intended to directly identify you.
3. Purposes and legal bases for processing
- •Responding to your enquiries (contact and catering) — basis: taking steps at your request prior to entering a contract, and our legitimate interest in answering enquiries (Art. 6(1)(b) and (f) GDPR).
- •Website analytics and improvement via Google Analytics — basis: your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
- •Website security and maintenance — basis: our legitimate interest in keeping the service secure and operational (Art. 6(1)(f) GDPR).
4. Cookies
Our website uses cookies. Analytics cookies load only after your consent. Details of the specific cookies, their providers and durations are set out in our Cookie Policy. Cookie Policy.
5. When and with whom do we share your data
We may share your data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with our third parties, which are designed to help safeguard your personal information. They cannot do anything with your personal information unless we have instructed them to do it, and they will not share your personal information with any other organisation.
The categories of third parties we may share personal information with:
- Website Hosting Service Providers
- Data Storage Service Providers
- Data Analytics Services
We may also share or transfer your information in connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business.
6. Transfers outside the EU/EEA
Some of our providers are based in or process data in the USA. In such cases, transfers rely on appropriate GDPR safeguards — the European Commission's Standard Contractual Clauses and/or certification under the EU–US Data Privacy Framework.
7. Google Analytics
We may share your information with Google Analytics to track and analyze the use of the Services. To opt out of being tracked by Google Analytics across the Services, visit https://tools.google.com/dlpage/gaoptout. For more information on the privacy practices of Google, please visit the Google Privacy & Terms page.
8. Retention period
- •Contact and catering form enquiries — kept for up to 12 months after our last communication, unless a contractual relationship arises that requires a longer period, or the law provides otherwise.
- •Analytics data — according to the retention settings configured in Google Analytics.
9. Your rights
Under the GDPR you have the right to:
- access your personal data;
- request correction of inaccurate data;
- request erasure of your data ("right to be forgotten");
- request restriction of processing;
- object to processing based on legitimate interest;
- data portability;
- withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.
To exercise your rights, contact us at margimart.ltd@gmail.com.
10. Security
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. The website uses an encrypted connection (HTTPS).
11. Children's data
The website is not directed at children and we do not knowingly collect personal data from persons under 14. If you believe we have received such data, please contact us so we can delete it.
12. Changes to this policy
We may update this policy from time to time. The current version is always available on this website, with its effective date stated.