Privacy policy — FEROL EOOD

1. Data controller

The controller of personal data is FEROL EOOD, company number 207766092, 137A Filip Kutev St., Lozenets District, Sofia 1407, Republic of Bulgaria.

Questions about the processing of personal data, and requests to exercise data subject rights, should be sent to [email protected] marked “Personal data”. Requests are handled by the company's manager.

The company does not carry out processing on a scale that requires the designation of a data protection officer under Regulation 2016/679. Should that requirement arise, details of the person designated will be published in this document.

2. What data is processed

We process the minimum needed for business dealings:

Enquiry form data: company name, contact person's name, email address, phone number, the content of the enquiry and the items you listed.
Correspondence data: information you provide while discussing a supply, including contact details of responsible staff on your side.
Contract performance data: counterparty details and information about delivery and settlement contained in the accounting documents.
Technical data: what is needed for the site to function. Analytics tools are loaded only where you have consented — see the Cookie policy.

We do not request or deliberately process special categories of personal data within the meaning of Article 9 of Regulation 2016/679. Please do not include such information in the text of an enquiry.

3. Purposes and legal bases

Purposes of processing and legal bases
Purpose	Basis under the GDPR
Handling a trade enquiry and preparing a quotation	Art. 6(1)(b) — steps prior to entering a contract
Concluding and performing a supply contract	Art. 6(1)(b) — performance of a contract
Accounting and tax records, retention of source documents	Art. 6(1)(c) — compliance with a legal obligation
Business correspondence with existing and prospective counterparties	Art. 6(1)(f) — legitimate interest in conducting business
Establishing, exercising or defending legal claims	Art. 6(1)(f) — legitimate interest
Analytics cookies on the site	Art. 6(1)(a) — consent, withdrawable at any time

Providing the data in the enquiry form is voluntary, but without it we cannot prepare a reply.

4. Retention periods

Enquiries that did not lead to a transaction: up to 12 months from the last contact, after which the data is deleted.
Data on concluded contracts: for the term of the contract and thereafter within the general limitation period applicable under Bulgarian law.
Accounting and tax documents: for the periods set by the Accountancy Act and the tax legislation of the Republic of Bulgaria.
Consent to analytics cookies: until withdrawn or until the corresponding browser entry expires.

Once the retention period ends, data is deleted or anonymised.

5. Recipients of data

Personal data is not sold and is not passed to third parties for marketing purposes. Access may be granted to:

communications and hosting providers acting as processors under contract;
the company's accounting and legal advisers;
transport and logistics companies, to the extent needed to deliver a consignment;
public authorities, where there is a lawful request.

6. Transfers outside the EEA

Processing takes place predominantly within the European Economic Area. If a particular operation requires a transfer beyond it, that transfer will take place only on a basis provided for in Chapter V of Regulation 2016/679 — a European Commission adequacy decision or standard contractual clauses.

7. Your rights

In relation to your personal data you have the right to:

obtain access to the data and a copy of it (Art. 15);
have inaccurate data corrected (Art. 16);
have data erased where grounds exist (Art. 17);
obtain restriction of processing (Art. 18);
receive the data in a structured format and transmit it to another controller (Art. 20);
object to processing based on legitimate interest (Art. 21);
withdraw consent at any time — withdrawal does not affect the lawfulness of processing before it was received (Art. 7(3)).

Requests should be sent to [email protected]. We reply within one month of receiving the request; in complex cases the period may be extended, with notice to the applicant.

8. Security measures

We apply organisational and technical measures proportionate to the risks of the processing: limiting who has access to data, using secure communication channels, and regularly deleting information that is no longer needed. Data sent through the site is protected by encryption provided the site is served over HTTPS.

9. Complaint to a supervisory authority

If you consider that the processing of your data infringes the law, you may lodge a complaint with the Commission for Personal Data Protection of the Republic of Bulgaria (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia, or with the supervisory authority of the EU Member State where you live or work.

10. Changes to this policy

This policy may be updated when processing operations or legal requirements change. The current version is published on this page with its date. Material changes are additionally notified to counterparties.