EN BG

Privacy policy

Privacy and personal data protection policy.

Effective from: 08.11.2026

1. Data controller

The owner of the website and the controller of your personal data is SOFRINO BG EOOD, UIC 206254502, with registered office and address of management: 20 Chereshovo Topche St., Varna, email: yagortsofrino@gmail.com, phone: +359 884 468 448.

2. What personal data we collect and why

When you place an order through the form on our website, we collect the following data:

  • Contact details: name and phone number.
  • Email address: only if you provided it; it is optional. It is used to confirm the order and for communication.
  • Delivery details: city and delivery address (or the address of a courier office).
  • The contents of the order and the note to it, if you wrote one. The note may also contain personal data that you provided yourself.

The name and phone number are required for us to accept the order. Without them we cannot fulfil it.

Purposes of processing: accepting, processing, dispatching and delivering the goods you ordered, contacting you about the order, and handling complaints. We do not pass the form data (name, phone, email, address, note) to Google and do not use it for advertising.

When you browse the site:

  • Cloudflare, which hosts the site, processes technical data such as the IP address and browser data in order to load the pages and protect the site.
  • On the order page, Cloudflare Turnstile checks whether the form is being sent by a person rather than an automated program. For this it processes the IP address and technical browser data.
  • Visit statistics (Cloudflare Web Analytics) show only aggregate numbers and do not use cookies.
  • Only if you have consented to advertising cookies: Google receives data about your visit (see section 4 and the Cookie Policy).

3. Legal bases for processing

We process your data on the following legal bases under the General Data Protection Regulation (Regulation (EU) 2016/679):

  • Performance of a contract or pre-contractual relations (Art. 6(1)(b)): the processing is necessary to fulfil your order and deliver the goods.
  • Compliance with a legal obligation (Art. 6(1)(c)): for accounting and tax purposes (issuing invoices or sales receipts).
  • Legitimate interest (Art. 6(1)(f)): protecting the site and the order form from abuse and automated requests, and aggregate visit statistics.
  • Consent (Art. 6(1)(a)): advertising cookies and ad measurement with Google Ads. You can withdraw your consent at any time from "Cookie settings" at the bottom of every page. Withdrawal does not affect the lawfulness of processing before it.

4. Who receives the data

Each provider receives only the data it needs for its work:

  • A licensed courier company: name, address and phone. The courier processes the data in compliance with the Personal Data Protection Act.
  • Cloudflare: hosting of the site, receiving orders and protecting the form (Cloudflare Turnstile). The form data passes through Cloudflare's infrastructure and is kept there temporarily until the order is handed over to the server on which we work on it.
  • Hetzner: a server in the European Union (Finland) on which the orders are stored and which we use to work on them.
  • Google (Gmail): if we correspond by email, the correspondence goes through Google's mail service.
  • Google Ads, only with your consent: Google receives data about your visit to the site (page address, IP address, browser and device data, cookie identifiers, information on whether you came from our ad and whether you sent an order: only the order number and amount). For Google Ads, Google acts as an independent data controller. How Google uses this data: https://policies.google.com/technologies/partner-sites?hl=en

We do NOT request, collect or process bank card data, because there is no online payment on the site; payment is made on delivery.

5. Transfers of data outside the European Union

  • Google: Google may transfer data to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, and for some transfers Google uses standard contractual clauses.
  • Cloudflare is a US company; site and form data may also be processed outside the EU. Cloudflare is certified under the EU-U.S. Data Privacy Framework, and for other transfers it uses standard contractual clauses approved by the European Commission.

6. Retention period

  • We keep order data for up to 3 years after the order is fulfilled, and then delete it.
  • Data included in accounting documents is kept for the periods required by Bulgarian accounting and tax legislation (up to 10 years for accounting documents).
  • Google advertising cookies on the site's domain are kept for up to 90 days (details in the Cookie Policy). Google keeps the data it receives according to its own rules.

7. Your rights under the General Data Protection Regulation

As a user, you have the right to access, rectify, restrict the processing of or erase your data (unless the data is needed for statutory accounting purposes), the right to portability of the data you provided to us, and the right to object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time. To do so, contact us at the email given in section 1.

You also have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP), www.cpdp.bg.

8. Cookies and browser data

They are described in the Cookie Policy.