Personal Data Protection Policy (GDPR)

This policy governs the processing of personal data by the operator of the online store prodai.store, carrying out business activities under the trade name "Prodai BG", with its place of business in Yambol, 49 Druzhba St., and a retail location in Burgas, 51 Transportna Blvd. (below Hotel Avenue), email: info@prodai.bg, phone: +359 883 420 440 and +359 897 715 106.

1. Personal Data Controller

"Prodai BG" processes personal data in its capacity as a controller within the meaning of Regulation (EU) 2016/679 and the Bulgarian Personal Data Protection Act.

2. What Personal Data We Process

• first and last name;
• telephone number;
• email address;
• delivery and/or billing address;
• data relating to orders, complaints, returns, and correspondence;
• payment information, to the extent necessary to confirm payment;
• IP address, device data, logs, and information collected through cookies.

3. Purposes of Processing

• accepting, processing, and fulfilling orders;
• delivering goods through courier partners;
• issuing accounting documents and complying with legal obligations;
• handling complaints, warranties, service requests, and contract withdrawal;
• communicating with customers by phone, email, or through the website;
• improving the security and functionality of the website;
• sending marketing communications only where there is a valid legal basis.

4. Legal Grounds

• Article 6(1)(b) of Regulation (EU) 2016/679 - performance of a contract or steps taken prior to entering into a contract;
• Article 6(1)(c) - compliance with a legal obligation, including accounting and tax obligations;
• Article 6(1)(a) - consent, where required, for example for marketing communications;
• Article 6(1)(f) - legitimate interest in protecting the website, preventing abuse, defending legal claims, and improving customer service.

5. Recipients of Personal Data

• courier and logistics companies for delivery purposes;
• payment service providers, including Stripe, when paying by card;
• accounting, hosting, IT, and technical service providers acting under contract and subject to the necessary security measures;
• competent public authorities where required by law.

6. Retention Periods

• order data and accounting documents - for the periods required under applicable tax and accounting laws;
• data relating to complaints and warranty claims - until the case is closed and for the duration of the applicable limitation period;
• marketing data processed on the basis of consent - until consent is withdrawn;
• technical logs and security data - for a reasonable period necessary to protect the website and prevent abuse.

7. Rights of Data Subjects

Every individual has the right of access, rectification, erasure, restriction of processing, data portability, objection to processing, as well as the right to withdraw consent where processing is based on consent.

Requests may be submitted to info@prodai.bg. Where necessary, we may request additional information to verify identity.

8. Cookies

The website uses cookies and similar technologies for the normal operation of the website, retaining cart contents, security, traffic analysis, and improving the user experience. Cookies that are not strictly necessary are used only where there is an applicable legal basis.

9. Security

We apply appropriate technical and organizational measures to protect personal data, including restricted access, protected communications, access control, and internal procedures to minimize the risk of unauthorized access, loss, or unlawful disclosure.

10. Complaints

If you believe that your rights have been violated, you may contact us at info@prodai.bg or lodge a complaint with the Commission for Personal Data Protection.

11. Contact on Data Protection Matters

For questions related to the processing of personal data, you may contact "Prodai BG" at info@prodai.bg, phone +359 883 420 440 and +359 897 715 106.

12. Applicable Law

This policy shall be interpreted and applied in accordance with Regulation (EU) 2016/679, the Bulgarian Personal Data Protection Act, and all other applicable Bulgarian and European legislation.