This Privacy Policy explains how we collect, use and protect your personal data when you visit our website and place orders. We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act.
Data controller
The controller of your personal data is:
- ITOPIA EOOD
- Company ID (EIK): 201573325
- VAT No.: BG201573325
- Manager (representative): Evgeni Borislavov Iliev
- Address: Bulgaria, Sofia 1505, 18 Aleko Konstantinov St., floor 4, ap. 15
- Contact: via the contact details provided on the site.
What data we collect
- Identification and contact data - first and last name, email address, phone.
- Account data - username, password (in encrypted form), security settings (two-factor authentication/passkey).
- Order and delivery data - delivery address, selected courier office, order contents, order history.
- Invoicing data - where an invoice is requested: company name, company ID/VAT number, responsible person, address.
- Payment data - the selected payment method and payment status. We do not store full bank card details - they are processed by a licensed payment service provider.
- Correspondence - messages, enquiries, claims, reviews and communication with our service department.
- Technical data - IP address, device and browser type, cookies and identifiers, website usage data.
Purposes and legal grounds
We process your data on the following grounds under Art. 6 of the GDPR:
- Performance of a contract - processing and delivery of orders, account registration and maintenance, warranty and service handling, returns and claims.
- Legal obligation - issuing and keeping accounting and tax documents, fulfilling consumer rights.
- Legitimate interest - fraud and abuse prevention, website security, service improvement and handling correspondence.
- Consent - analytics and marketing cookies, notifications and newsletter, where you have requested them. Consent can be withdrawn at any time.
Recipients of the data
We share personal data only to the extent necessary, with the following categories of recipients:
- Courier companies (e.g. Speedy) - to deliver your orders.
- Payment service providers - a bank/card operator for card and bank transfer payments, and DSK Bank for purchases in installments.
- Accounting and legal advisers - to fulfil our legal obligations.
- IT service providers - hosting, support and website security, acting as data processors on our instructions.
- Analytics and marketing providers - only with your consent.
- Competent public authorities - where required by law.
Cookies and tracking
We use cookies and similar technologies so the site can function, to remember your cart and session, and (only with your consent) for traffic analysis and marketing. Strictly necessary cookies do not require consent. Analytics and marketing tools are loaded only after you give consent via the cookie banner, and you can change or withdraw your consent at any time from the cookie settings.
With your consent, we use the following third-party tools:
- Google Analytics (Google Ireland Ltd.) - analysis of site traffic and user behaviour.
- Google Ads (Google Ireland Ltd.) - advertising performance measurement (conversions) and remarketing.
- Meta Pixel (Meta Platforms Ireland Ltd.) - measurement and targeting of ads on Facebook and Instagram.
- Umami - privacy-friendly, anonymous traffic statistics.
- Microsoft Clarity (Microsoft Ireland) - usability analysis via heatmaps and session recordings (cursor movement, clicks and scrolling), to help us improve the site.
Some of these providers may also process data outside the European Union under appropriate safeguards (see the "International data transfers" section).
Retention period
- Order-related and accounting data - for the statutory periods (up to 10 years for accounting records and financial statements).
- Account data - while you maintain a registration with us; on a deletion request we remove the data, except what we are required to keep by law.
- Warranty and service data - for the warranty term and the applicable limitation periods.
- Data processed on the basis of consent - until consent is withdrawn.
International data transfers
As a rule, we process your data within the European Union. Where providers we use (for example analytics or marketing tools) transfer data outside the EU/EEA, this is done with appropriate safeguards under the GDPR - an adequacy decision or standard contractual clauses.
Your rights
As a data subject you have the right to access, rectification, erasure, restriction of processing, data portability, objection, and to withdraw consent at any time. To exercise your rights, contact us using the contact details on the site.
Data security
We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss or disclosure, including password encryption and secure data transfer.
Automated decision-making
We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.
Right to lodge a complaint
If you believe that the processing of your personal data breaches the law, you have the right to lodge a complaint with the supervisory authority:
- Commission for Personal Data Protection (CPDP)
- Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
- website: cpdp.bg
Changes to this policy
We may update this Privacy Policy from time to time. The current version is always available on this page.
Contact
For questions about the processing of your personal data, please contact us using the contact details provided on the site.