Privacy and Personal Data Protection Policy
The security of your personal data is of the utmost importance to us. We act in your best interest and are transparent about how we process your personal data. Therefore, this document is intended to inform you about the personal data we collect, who processes it and how, the purposes for which we use it, how long we store it, and the security measures we have implemented to protect it. This policy applies to all information we process in connection with the operation of the website https://nik.bg/
Who are we?
We are NIK ELECTRONICS OOD, UIC 127072968, with our registered office and headquarters at 11B Bruxelles Blvd., Slatina District, Sofia 1592. We act as a personal data controller and, in this capacity, are responsible for the processing and storage of your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation) and Bulgarian legislation.
You can contact the Controller at 11B Bruxelles Blvd., Slatina District, Sofia 1592, or via email at office.bg@nik.group
As a data controller, we are committed to processing and protecting your personal data as an individual in accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation) and this privacy policy. Please read it carefully and familiarize yourself with your rights.
In what cases do we process your personal data through https://nik.group/?
We process your personal data when:
● you submit a request for a price quote via the electronic form regarding the goods and services offered on the website;
● you ask a general question and/or share your opinions, comments, and observations regarding the website using the contact form available at (…link to be inserted);
● you subscribe to our newsletter;
● you apply for a job opening at www.nik.bg/careers/open-positions (in this case, the Privacy Policy for candidates applies, available at www.nik.bg/careers-privacy-policy;
● you use services offered by third parties through plugins and cookies that operate on https://nik.group/ (for more information, please consult our Cookie Policy);
● you use services through an application or platform, including data generated by connected products (agricultural machinery and sensors).
What categories of personal data do we process?
Requests for price quotes regarding the goods and services offered:
When requesting a price quote for the goods and services offered, we ask you to provide:
● full name;
● email address;
● contact phone number;
● city/town.
At your discretion, you may also provide other personal data included in your request.
Contact
If you decide to contact us using the provided feedback form, which you can find in the "Contact" section, you are required to provide:
● full name;
● email address;
● contact phone number;
● city.
At your discretion, you may also provide other personal data contained in your message.
Newsletter subscription
If you subscribe to our newsletter to receive current news related to NIK, current and future promotions, and information about new products and services, you must provide:
● email address.
What are the purposes of processing your personal data?
Your personal data may be used:
● to provide you with the necessary customer service by responding to the price quote request you sent for the products and services we offer;
● to respond to your inquiries submitted via the contact form;
● for direct marketing purposes, by providing you with information about services, products, promotions, and/or information from "NIK ELECTRONICS" OOD and/or its partners;
● when necessary, for the purpose of official proceedings such as civil cases, administrative investigations, etc.;
● for other purposes, when applicable law requires us to perform such processing.
On what legal grounds do we process your personal data?
Personal data is collected and processed in accordance with the grounds provided for in the General Data Protection Regulation.
Art. 6(1)(b) of the General Data Protection Regulation – "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract"
These are cases of personal data processing (full name, email address, contact phone number, city) when submitting price quote requests for certain products and services and when submitting requests of the same and/or different nature from the "Contact" section of the website.
Art. 6(1)(c) of the General Data Protection Regulation – "processing is necessary for compliance with a legal obligation to which the controller is subject"
In certain cases, it is necessary to process personal data in connection with the Company's legal obligations, including the Company's obligations as a "data holder" to ensure access to data generated by connected products (agricultural machinery and software) for you as a user or for third parties indicated by you, in accordance with Art. 4 and Art. 5 of Regulation (EU) 2023/2854 (Data Act).
Art. 6(1)(f) of the General Data Protection Regulation – "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child"
In certain cases, personal data (email address, name, contact phone number) may be processed based on legitimate interests, with the Company complying with the limitations of the General Data Protection Regulation when processing on such grounds.
Art. 6(1)(a) of the General Data Protection Regulation – "the data subject has given consent to the processing of his or her personal data for one or more specific purposes"
Based on freely given, specific, informed, and unambiguous consent, personal data (email address) is processed when subscribing to our newsletter. You have the right to withdraw your consent at any time. When we use your personal data for direct marketing purposes, commercial newsletters, and marketing communications regarding products, services, promotions, and/or other offers that we believe may be of interest to you, you may object to direct marketing at any time. You can exercise these rights:
● upon receiving an email, by clicking once on the unsubscribe link for advertising messages. The link is always in a visible place and its purpose is clear;
● through a request to withdraw consent for direct marketing purposes
Do we use cookies?
To improve the quality of the services and products offered on the website, we use cookies. More information regarding the use and management of cookies is available in our Cookie Policy.
Who can personal data be provided to?
● Competent public authorities, in the execution of legal provisions;
● Companies providing services to the Controller for IT maintenance and security of IT systems;
● Third parties indicated by you, in the exercise of your right to portability and access;
● Subcontractors – persons who process personal data.
How long do we store your personal data?
The Company stores personal data for the minimum period necessary:
● necessary in accordance with the law;
● necessary for the performance of a contract (including an order) and related liability;
● necessary to achieve the purpose for which the data was collected and processed; or
● until the individual requests their deletion or objects to processing based on "consent," after which they are destroyed without undue delay.
In all cases, NIK ELECTRONICS OOD ensures that a review of the collected and processed personal data is conducted at least once a year, and any data falling under the aforementioned criteria is deleted without undue delay.
How do we process children's personal data?
The use of our services by persons under the age of 18 is permitted only with the express consent of a parent, guardian, or custodian (the person exercising parental responsibility).
What are your rights as a data subject?
You have the following rights, for which the Controller will provide you with support at any time:
● The right to information
You have the right to be informed, at the time your personal data is collected, about what data the Controller is collecting, who will process it, for what purposes, and on what legal grounds.
● The right of access
You have the right at any time to request access to the personal data that the Controller stores about you. You also have the right to request a free copy of the personal data currently being processed.
● The right to rectification
You have the right to request that your personal data be rectified to ensure it is current and accurate.
● The right to erasure (the "right to be forgotten")
You have the right to request the deletion of your personal data once it is no longer necessary for the purposes for which it was processed or once the legal grounds for processing have ceased.
● The right to restriction of processing
In certain cases, you have the right to request the restriction of the processing of your personal data.
● The right to data portability
You may request to receive your personal data in a structured, commonly used, and machine-readable format (i.e., in a digital format), and you may also request the transfer of your data to another controller of your choosing, where technically feasible.
● The right to withdraw consent
When the processing of your personal data is based on consent, you may withdraw it at any time. In such cases, the Controller is required to cease processing your personal data for the future.
● The right to lodge a complaint
You have the right to defend your rights through the Commission for Personal Data Protection (CPDP). The CPDP is an independent state body that oversees the legality of personal data processing activities. You may submit complaints to the CPDP in person or by mail to the following address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.; or electronically to the CPDP email address: kzld@cpdp.bg. More information about the procedure can be found on the website: https://www.cpdp.bg/.
How can you exercise your rights?
You may exercise any of the listed rights by sending a written, informal notice to the following address: Sofia, postal code 1592, Slatina district, 11B Bruxelles Blvd., or via email to office.bg@nik.group, with the subject line "Personal Information Request."
The notification must contain at least the following: name, address, description of the request, preferred form of communication, and the actions requested under Articles 15-22 of Regulation (EU) 2016/679, signature, date of submission, and correspondence address. If the request is submitted by an authorized representative, a power of attorney must also be attached.
What measures have we taken to protect your personal data?
The Controller understands the importance of ensuring your personal data is processed correctly and protected. The Controller's team has implemented appropriate technical and organizational measures to protect your personal data.
We use appropriate business systems and procedures to protect and secure the personal data you provide to us. We employ security procedures and technical and physical restrictions on access to and use of personal data on our servers. Only authorized personnel have access to personal data in the course of their work related to providing a service to the respective client/user.
These measures ensure, among other things, compliance with the principles set out for the processing of personal data, guaranteeing that your personal data are:
● Processed lawfully, fairly, and in a transparent manner in relation to you as the data subject ("lawfulness, fairness, and transparency");
● Collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes ("purpose limitation");
● Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed ("data minimization");
● Accurate and, where necessary, kept up to date. We have taken all reasonable steps to ensure that inaccurate personal data are erased or rectified without delay, having regard to the purposes for which they are processed ("accuracy");
● Kept in a form which permits identification of the data subject for no longer than is necessary for the purposes for which the personal data are processed ("storage limitation");
● Processed in a manner that ensures an appropriate level of security for personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, by implementing appropriate technical or organizational measures ("integrity and confidentiality");
● The Controller is responsible for and able to demonstrate compliance with the fundamental principles relating to the processing of personal data ("accountability").
When can we change this Policy?
We may update this Privacy Policy from time to time. You can always find the most current version on this webpage. If we make changes that directly impact you, we will notify you before taking any further action.
Privacy and Personal Data Protection Policy version dated (04)/(21)/2026.
