Privacy Policy

Privacy and personal data protection are our priorities. This policy outlines the key principles and rules applicable to our processing of any personal information collected from or provided by you. Even though ONVOCADO's clients are typically legal entities, meaning the data they provide is not subject to protection under Regulation (EU) 2016/679 and the Personal Data Protection Act concerning the protection of individuals in relation to the processing of personal data and its free movement, we comply with the aforementioned Regulation and Law regarding the processing of your data considering the potential use of the platform/website (onvocado.com and all its subdomains) by individuals who might provide data that could be considered personal (e.g., email address, phone number).

We are a commercial company that owns, manages, and controls the website  www.onvocado.com  (and all its subdomains), through which we offer services for creating graphic pop-up windows (widgets) containing user-generated content, aimed at gathering and/or providing information to the clients of the users' websites. When we say "we," we mean "ONVOCADO" LLC, UIC 206902340, based in Bulgaria, Sofia, Oborishte St. No. 36, acting as data controllers and/or processors under the Personal Data Protection Act and the General Data Protection Regulation (EU) 2016/679.

3.1 We may collect (online on our website www.onvocado.com or via email) and process the following data:

• Information you provide when filling out the contact form on our website www.onvocado.com, such as your name, country, and email address.
• Information you provide when registering as a user on our website www.onvocado.com, called the "Platform," by creating a personal account through our registration form on the platform, such as your name, email address, online identifier, country, and phone number.
• Information you provide if you choose to create an account and use our platform by granting us access to a third-party social media service like Google, specifically your Google account, such as your name, address, email, online identifier, activities, contact list, and any other data contained in your Google account.
• Data from your visits to our platform, including but not limited to usage data, location, previous visits, and other communication data.
• We may ask you to complete surveys for research purposes, though participation is never mandatory.
• We may also request information when you report a problem related to our platform.
• We anonymize, collect, use, and share aggregated information for statistical and research purposes that do not identify you in any way.
• If you contact us, we may retain a record of our correspondence for security reasons.

3.2 If we enter into a transaction with you for using the platform and ONVOCADO's services by creating a valid account, we will collect personally identifiable information, including your name and contact details – email address and online identifier. Depending on your subscription type (free or paid), additional personal information, including address, VAT registration number, and bank card details, may be required.

4.1 Based on your explicit consent given through the contact form or registration forms on our platform, we process your data for the following purposes:

• To provide you access to the platform and ONVOCADO's products and services you requested or information about them.
• To provide and maintain our services and monitor their usage.
• To manage your account on our platform and your registration as a user of the platform, giving you access to functionalities available only to registered users.
• To fulfill a contract for access to the platform and services.
• To respond to your inquiries/requests with personalized information and offers regarding our services.
• To inform you of changes in our services and in some cases, to contact you with information about services that may interest you via email or phone (see the "Marketing" section below for more information). This information is entirely voluntary, and you can withdraw your consent at any time (see Section 11 for more information about your rights).

4.2 Based on our legitimate interests in administering our platform/website and interacting with users, we may collect information about you to:

• Ensure that our website content is presented most effectively for you and your device.
• Enable you to participate in the interactive features of our services if you choose to use them.
• Maintain the security of our website.

4.3 In some cases, there may be legal requirements for the data we need to collect when entering into transactions/contracts, for accounting and tax purposes (names, address, VAT registration number, and signature of the representative individual). If you do not provide this information, we may not be able to conclude and fulfill the relevant contract.

4.4 If you have a registered account on our platform or have provided your contact details, we may send you marketing messages related to the platform and our services based on your consent to promote and improve our services and expand access to them for our current and potential future clients and partners. You can opt-out of such information and marketing messages by clicking "unsubscribe" at the bottom of each marketing message or by emailing us with "No marketing information" at support@onvocado.com. For more information about marketing, see Section 6 below.

5.1 When you visit our platform/website www.onvocado.com, we may collect information about your device used to access the site, including, where applicable, your IP address, operating system, browser type for system administration, and to pass aggregated information to our advertisers. This is statistical data about the actions and searches of our site users and does not identify you or individual users.

5.2 For the same reason, we may obtain information about your general internet usage using a cookie file stored on your device's hard drive. Cookies are small text files containing information transferred to your device's hard drive. They help us improve our website and provide better and more personalized services. Cookies enable us to:

• Estimate visitor numbers and usage patterns.
• Store information about your preferences, allowing us to develop our platform/website according to your specific interests.
• Speed up your searches.
• Recognize you when you return to our platform/website.

5.3 You can refuse to accept cookies by activating the settings on your browser that allow you to refuse cookies. If you select these settings, access to certain parts of our platform/website may be impossible or limited.

6.1 We would like to provide you with information about our services that may interest you, which is why we may contact you (by phone or other electronic means, such as SMS or email).

6.2 If you are a corporate client/partner/user, we will send marketing messages to your organization's email address unless you have opted out of receiving marketing messages. We will provide you with an opportunity to opt out of future marketing messages the first time we contact you. You can opt-out of our marketing messages at any time by clicking "unsubscribe" at the bottom of each of our marketing messages or by contacting us at support@onvocado.com.

6.3 If you are an individual, we will send marketing messages to your personal email addresses (emails) or SMS only when the marketing messages relate to services or opportunities similar to those we have already offered, those you have shown interest in, or services you have contacted us about and have explicitly consented to be informed about.

6.4 You have the right to ask us not to process your personal information for marketing purposes. Before collecting your data, we will inform you if we intend to use it for marketing purposes or disclose it to third parties for this purpose. You can exercise your right to prevent such processing by ticking certain boxes on the form we use to collect your data. You can also exercise your right to opt-out at any time by clicking "unsubscribe" in each of our marketing messages or by contacting us by email at support@onvocado.com or at our business address.

7.1 All information you provide is stored on our secure servers. When we have given you (or you have chosen) a password to access your account on the platform, which allows you access to certain parts of it, you are responsible for keeping it confidential and not sharing it with anyone.

7.2 If you choose to share your data with us electronically, you should be aware that ONVOCADO's emails are encrypted using SSL technology, ensuring secure data transmission. Unfortunately, data transmission via other channels, such as social networks (Facebook, Instagram, etc.), is not completely secure, and we cannot guarantee the security of the information you provide in this way. Any such provision of information via unsecured channels is at your own risk. Therefore, we advise you to contact us and provide your personal information only through our website and the emails listed there or in this privacy policy.

7.3 After receiving your data, we will apply strict organizational and technical measures to prevent unauthorized access to it and to ensure its security, confidentiality, and integrity. All documents and devices containing personal data are stored in restricted-access areas within the ONVOCADO LLC office. Our information systems and databases are also highly protected against external risks, and we use strict organizational and technical measures to prevent potential breaches.

8.1 Depending on the purpose for which we collected your data, the retention period may vary, but in all cases, it will not exceed the necessary period for processing the specific data, including accounting or other legal requirements.

8.2 We generally retain your data for 5 (five) years after our last contact/correspondence with you or after the termination of the relationship established by a transaction between us to protect against complaints or claims.

8.3 When we use your data for marketing communication, we will retain your data for 5 (five) years and delete it immediately upon your request.

9.1 We may disclose your personal data to any of the third parties listed below, acting as data processors based on contracts with us, requiring them to strictly comply with applicable data protection legislation and process your data securely and confidentially:

• Providers of internet, hosting, and maintenance and payment services, including:
  • Providers of IT software and system maintenance services, including:
  • Providers of email services, marketing platforms, event invitations, payment processing, accounting, legal services, etc.
  • Providers of services for monitoring and analyzing the use of the platform and ONVOCADO's services.

Our current providers include:

• Heroku: Data hosting service that allows the platform to function and be distributed and provides ready infrastructure for performing specific functions or parts of the services. Geographically distributed servers in the USA and Germany. For more information on Heroku's privacy practices, please visit Heroku's privacy policy at https://www.salesforce.com/company/privacy/.
• Stripe: Payment processing service; Collected data: Name, Address, Email, Phone, Credit card details; Processing location: USA. For more information on Stripe's privacy practices, please visit Stripe's privacy policy at Stripe Privacy Policy.
• Google Analytics: Service for analyzing user consumption and improving services. Collected anonymized data: cookies and usage data. Processing location: USA. For more information on Google's privacy practices, please visit Google's privacy and terms page: Google Privacy & Terms.
• MailChimp: Email and marketing automation service; Collected data: email address, first name, last name of the user. For more information on Mailchimp's privacy practices, please visit their privacy and terms page: https://www.intuit.com/privacy/statement/

9.2 We may need to disclose your personal information to third parties when our legitimate business interests require it or when there are legal obligations to do so:

• When we are legally obliged to disclose your data to public authorities.
• When transferring a business or assets, we may need to disclose your data to a potential buyer or seller.
• When ONVOCADO LLC or parts of its business and assets are acquired by a third party, in which case all the company's personal data will be part of the transfer transaction.
• When we have a contract in your interest with a third party or are legally required to disclose your personal data to enforce and execute applicable terms and agreements and protect the rights, integrity, property, and security of the Group Companies, employees, customers, partners, etc.

9.3 The personal data collected from you may be transferred and/or stored on computers and servers outside your country, where data protection laws may differ from those of your jurisdiction, including countries outside the European Union (EU) and the European Economic Area (EEA).

9.4 If you request a service through our platform, this may necessitate transferring your data outside the EU and EEA, and your consent to this privacy policy, including through your account registration on the platform, constitutes your explicit consent to the aforementioned transfer.

9.5 While we do our best to ensure the security of your data and its processing following applicable Bulgarian and European data protection legislation, you should be aware that some of these third parties may not always provide an adequate level of data protection corresponding to your guaranteed EU rights. Therefore, the transfer may involve some risks. This is why we disclose your personal information in the above scenario only when:

• There is a European Commission decision on the adequate level of data protection for the specific third party.
• The transfer is necessary for the execution of a contract between us or the execution of pre-contractual relations based on your requests.
• The data transfer is necessary for the conclusion or execution of a contract between us and a third party in your interest.
• The transfer is necessary for the conclusion or execution of a contract between us and a third party for your benefit.

When the data recipient is based in the USA and certified under the EU-US Privacy Shield, ensuring adequate data protection measures. For more information, contact us at support@onvocado.com.

10.1 In addition to the right to be informed about how we use your personal data (as outlined in this privacy policy), you have the following data protection rights that you can exercise for free:

• Right to object: You can object to our processing of your data by contacting us at the provided email address and phone number, giving specific information about your objection.
• Right to access: You can request access to a copy of your personal data we hold, along with information on the exact data we process, its purpose, who we share it with, how long we store it, and whether it was used in automated decision-making.
• Right to withdraw consent: If you have given us consent to use your personal data, e.g., for marketing messages, you can withdraw it anytime by clicking "unsubscribe" at the bottom of each marketing email or contacting us at the above email address.
• Right to rectification: You can request us to correct or complete any inaccurate or incomplete personal information we hold about you.
• Right to erasure: You can request the deletion of your personal data in certain cases, such as when we no longer need it, when you have withdrawn your consent, or when we have no legal basis to retain it.
• Right to data portability: When we process your data based on a contract and it is automated, you can request that we provide you or a third party with your personal data in a structured, commonly used, machine-readable format for easy transfer to other service providers.
• Right to restrict processing: In certain cases, you can request us to restrict processing your personal data, such as when you have requested its deletion or objected to its use by us.
• Complaints and grievances: You can file a complaint regarding our processing of your data by contacting us (at the provided email address) or filing a complaint with the regulatory authority for Bulgaria: Commission for Personal Data Protection (www.cpdp.bg).

10.2 You should note that some of your rights listed above may only be exercised in specific cases, depending on the circumstances, and there may be exceptions, making it impossible to fulfill every request. If we receive a request to exercise your rights, we may ask you to verify your identity before proceeding with your request to ensure your data's protection and security.

This privacy policy will be regularly reviewed, and we will update it whenever there is a change in how we process your personal data. If we make changes to this policy, we will publish the updated version on our website (www.onvocado.com).

For any questions related to the Privacy Policy and the protection of your personal information, you can contact us at support@onvocado.com or at our business address listed above.