This Privacy Policy governs the processing of personal data by ЕВРОТРАНС ЛОДЖИСТИК БГ ЕООД (EVROTRANS LOGISTICS BG EOOD), UIC 204275580, VAT BG204275580, with registered office at: 32 Lyuben Karavelov St., Skravena (2150), Bulgaria (the “Controller,” “we,” “us”), acting as a data controller under Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act.

1. Controller Contact Details

ЕВРОТРАНС ЛОДЖИСТИК БГ ЕООД
UIC: 204275580
VAT: BG204275580
Address: 32 Lyuben Karavelov St., Skravena (2150), Bulgaria
Email: sales@garbara.bg

2. What Personal Data We Collect

When you visit garbara.bg and use our services, we may collect the following categories of personal data:

• Contact data: name, email address (when subscribing to our newsletter or sending an inquiry).
• Order data: shipping address, phone number, payment details (payments are processed entirely by Shopify, we do not store credit card data).
• Technical data: IP address, browser type, operating system, screen resolution, device data.
• Usage data: pages visited, time on site, traffic source, content interactions (only with consent).
• Age verification data: confirmation that the user is 18 or older (cookie flag).

3. Purposes and Legal Basis for Processing

We process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): processing and delivering orders, order communication, customer account management.
• Legal obligation (Art. 6(1)(c) GDPR): invoicing, tax reporting, age verification (required under Bulgarian alcohol sales law).
• Legitimate interest (Art. 6(1)(f) GDPR): maintaining site security, fraud prevention, basic shopping cart functionality.
• Consent (Art. 6(1)(a) GDPR): marketing communications, analytics cookies, marketing cookies.

4. Sharing Data with Third Parties

We share personal data with the following categories of recipients:

• Shopify Inc. (Canada/USA), e-commerce platform. Processes order, payment, and shipping data. GDPR-compliant via Standard Contractual Clauses (SCCs).
• Vercel Inc. (USA), hosting infrastructure. Processes technical data (IP address, server logs). GDPR-compliant via SCCs.
• Courier companies, for order delivery (name, address, phone).
• Public authorities, when required by law (tax, accounting).

We do not sell personal data to third parties.

5. International Data Transfers

Some of our service providers (Shopify, Vercel) are based outside the European Union. Data transfers to them are carried out with appropriate safeguards under Art. 46 GDPR, Standard Contractual Clauses approved by the European Commission. You may request a copy of these safeguards via the contact email above.

6. Data Retention

• Order data: 10 years (accounting requirement under Bulgarian law).
• Marketing consent: until withdrawn by you.
• Cookies: per the specific lifetime of each cookie, as detailed in our Cookie Policy.
• Server logs: up to 30 days.

7. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): obtain information about what data we process about you.
• Right to rectification (Art. 16): request correction of inaccurate data.
• Right to erasure (Art. 17): request deletion of data under certain conditions.
• Right to restriction (Art. 18): restrict processing under certain conditions.
• Right to data portability (Art. 20): receive your data in a machine-readable format.
• Right to object (Art. 21): object to processing, including for direct marketing.
• Right to withdraw consent (Art. 7(3)): at any time, without affecting the lawfulness of prior processing.
• Right to lodge a complaint: with the Bulgarian Commission for Personal Data Protection (CPDP), www.cpdp.bg.

To exercise your rights, contact us at sales@garbara.bg. We will respond within 30 days.

8. Data Security

We implement appropriate technical and organizational measures to protect personal data: encryption (HTTPS/TLS), restricted data access limited to authorized personnel, regular software updates. Payments are processed entirely by Shopify, we have no access to credit/debit card data.

9. Cookies

We use cookies for essential functionality (shopping cart, session, age verification, language preferences) and, with your consent, for analytics and marketing. A complete list of cookies used is available in our Cookie Policy. You can change your preferences at any time via the “Cookies” button in the bottom-left corner of the site.

10. Age Verification

Under Bulgarian law, the sale of alcohol to persons under 18 is prohibited. On your first visit to the site, we require confirmation that you are 18 or older. This confirmation is stored as a cookie for one year. No additional age-related data beyond this flag is processed.

11. Policy Changes

We reserve the right to update this policy. Material changes will be communicated via a notice on the site or by email. The date of the last update is shown at the top of this page.