Privacy Policy

1. Who Processes the Data

The controller of personal data collected via the Naturonica website is:

КХАРИСМА ЕООД (in Latin script: QHARISMA Ltd.), UIC 208651837, VAT BG208651837, registered office: Bulgaria, 1000 Sofia, Vazrazhdane District, 40 Aleksandar Stamboliyski Blvd., fl. 4, apt. 9.

When we refer to "we", "Naturonica", or "controller" in this policy, it refers specifically to this legal entity. The full legal details of the company are also published on the Legal Notice page.

The sole public contact address for personal data inquiries is: feed@naturonica.com, namely feed@naturonica.com. A telephone number is not published on the website: telephone contact takes place after you have submitted a callback request yourself. The permanent written communication channel is the specified email address.

This policy is addressed to website visitors from the European Union and the European Economic Area (EEA). If the legislation of your country of residence provides for additional mandatory consumer protection, it applies in the relevant part.

2. What Data We Process and Why Form Fields Are Mandatory

When you fill out a request form on the website, we process the data specified in it.

The fields "Name", "Phone", "Email", and "Country" are mandatory to submit a request. The phone number is required to contact you and agree on the terms of a possible order. The email address is required to send you written confirmation and mandatory order information on a durable medium, as required by EU consumer protection legislation for distance contracts. Both channels are used for different purposes and do not substitute for one another.

The country is indicated to determine whether the selected product is available in your region and which delivery terms apply.

The fields "Product of interest" and "Comments" are optional; leaving them blank does not affect the processing of the request.

Without the mandatory fields, the request cannot be submitted and processed: the form technically does not allow submitting a request without name, phone, email, and country. If you are not willing to provide this data, feedback from our side is not possible, and the request is not accepted.

Submitting the form is a request for terms, not a purchase: it does not imply payment and does not create a purchase contract at the moment of submission. If a contract is concluded, this occurs later, by telephone, with written confirmation by email.

When you visit the website, we may also process technical data (IP address, device and browser type, selected interface language) — see Section 5 and the Cookie Policy document for details.

We do not request special categories of personal data: health information, diagnoses, examination results, and similar data. Please do not provide such data in the free-text "Comments" field. If they nevertheless appear in a message, we do not use them as medical advice and will limit processing to the minimum necessary extent, including deleting excessive data.

3. Purposes for Which We Use Data

We use personal data received through the request form to:

• contact you by the specified telephone number to discuss product availability and the terms of a possible order;
• send request confirmation, pre-contractual information, and confirmation of the concluded contract, including information on the right of withdrawal and the model withdrawal form, to the specified email address;
• record the request in the request tracking system;
• arrange delivery of goods, including transferring necessary data to fulfillment and courier services at the cash-on-delivery (COD) stage;
• ensure the security and technical operation of the website;
• comply with legal obligations, including consumer protection obligations;
• protect the legitimate rights of the controller.

We do not use email or telephone for promotional newsletters and repeat commercial calls without separate consent — see Section 4 for details.

4. Legal Bases

• First call regarding your request. Legal basis — Art. 6(1)(b) GDPR: processing is necessary to take steps at your request prior to entering into a contract, as well as your request for a callback itself.
• Repeat commercial calls not related to a specific request are made only with separate consent. For consumers in Spain: since June 29, 2023, under Ley 11/2022, commercial calls to a consumer without prior consent are prohibited. We document the "you requested a call yourself" model: date and time of the request, IP address, consent checkbox text, and the policy version in effect at the time of the request.
• Email is not used for marketing mailings without separate consent distinct from consent to process the request itself.
• Compliance with a legal obligation — specifically, the retention of pre-contractual and contractual information pursuant to consumer protection legislation.
• Legitimate interest — ensuring the operation and security of the website, prevention of abuse.

Familiarization with this policy does not in itself constitute consent where the law requires separate consent.

5. To Whom We Transfer Data

We do not sell personal data to third parties.

When you submit a request, we process it according to the following purpose-specific framework. Data may be transferred to the following recipients, to each only to the extent necessary for their task:

• call center and its operators — to call you back and agree on terms;
• telephony and call routing provider ITGLOBAL;
• request management system — to register and process the inquiry;
• transactional email provider (SMTP/ESP) — to send confirmation emails to your email;
• fulfillment partner and courier service — only at the delivery stage for cash-on-delivery (COD), to the extent necessary for delivery;
• hosting provider and website technical infrastructure, including nginx;
• Cloudflare network — for website protection and traffic delivery;
• anti-spam and abuse prevention tools on the website infrastructure, if applied.

We explicitly clarify: telephone conversations are not recorded; audio recordings of calls are not stored.

If the list of recipients changes, we will update this policy.

6. Data Transfers Outside the EEA

Some providers, including Cloudflare, may process data on servers outside the European Economic Area. In this case, the transfer takes place only on the basis of a lawful mechanism: an adequacy decision by the European Commission or standard contractual clauses (SCC) approved by the European Commission, with supplementary safeguards where necessary.

7. Retention Periods

• Data on requests and inquiries (name, phone, email, country, product, comments): generally up to 12 months after the last substantive contact with you.
• Request confirmation, pre-contractual information, and right-of-withdrawal information sent to email: retained for at least 3 months as evidence of fulfilling the obligation to provide information on a durable medium pursuant to Art. 8(7) of Directive 2011/83/EU. This retention period is not superseded or shortened by the general 12-month retention period for requests.
• Partner and B2B inquiries: generally up to 24 months.
• Data required to be stored by law (for example, for tax or accounting purposes): for the period established by applicable law.
• Technical security logs: only as long as necessary to detect failures and abuse.

If you request the erasure of data earlier, we will do so unless otherwise required by law, such as the mandatory retention of contractual documents.

8. Your Rights

Where the GDPR applies to you, you may:

• request access to your personal data;
• demand the rectification of inaccurate data;
• demand the erasure of data;
• restrict processing;
• object to processing based on legitimate interests;
• receive data in a portable format;
• withdraw consent if processing is based on it, without affecting the lawfulness of processing prior to withdrawal;
• lodge a complaint with a data protection supervisory authority.

To exercise your rights, write to feed@naturonica.com, namely feed@naturonica.com. We may request reasonable proof of identity to prevent disclosure of data to third parties.

The personal data protection supervisory authority at the place of establishment of the controller is the Commission for Personal Data Protection (CPDP / КЗЛД), Republic of Bulgaria. You may also contact the supervisory authority of the country where you reside, work, or where you believe an infringement has occurred.

9. Automated Decision-Making

We do not make decisions that have legal or otherwise significant effects on you solely based on automated processing, including profiling.

10. Security

We implement reasonable technical and organizational measures to protect data from unauthorized access, alteration, disclosure, and loss. Completely eliminating risks during data transmission via the internet is impossible, but we strive to mitigate them.

11. Children

The website and request form are not intended for independent use by children. We do not knowingly collect personal data of individuals below the age at which applicable law permits independently consenting to data processing.

12. Policy Changes

We may update this policy if the website, providers, or legal requirements change. The current version is always published on this page with the specified update date.

13. Contact Information

For inquiries regarding personal data processing, write to feed@naturonica.com, namely feed@naturonica.com.

Legal details of the controller: Legal Notice. More on cookies: Cookie Policy. Website terms: Terms of Use.