Privacy policy

Controller

The controller of personal data is „ПАО комерс“ EOOD, UIC 200601711, registered office and address of management: 5 Sv. sv Kiril i Metodiy St., Razgrad, Bulgaria.

Correspondence details and channels for requests relating to personal data are published on the Contact page.

When you submit a message through the contact form, the data you provide is processed in order to answer the message and handle the specific inquiry.

Categories of personal data

For inquiries, we process name, email, phone, message, article and quantity when provided.

For return requests, we process name, email, phone, the order number as entered, a description of the goods and the reason for return, and a bank account when one is provided. The bank account is used only to refund an amount.

For orders, we process recipient, delivery, payment and invoice data, order notes, selected articles, totals, status and status history.

For customer accounts, we process email, name, phone, password hash, email verification date, email or password change requests and marketing consent where such consent has been given.

The cart is stored on the server through a random key, together with articles, quantities, coupon and selected language. For security and diagnostics, the server may record technical data such as request address, time, page address and server response.

Purposes and legal bases

The data is used to answer inquiries, prepare quotes, accept and fulfil orders, calculate delivery, send confirmations, issue invoices, handle return requests and maintain customer accounts.

The legal bases are performance of a contract or steps prior to entering into a contract, legal obligations for accounting and tax documents, legitimate interest in security, support and protection in disputes, and consent for marketing messages. Counting visits and measuring the result of advertisements rest on legitimate interest, with the right to object at any time by choosing "Decline".

Personal data is not used for automated decision-making, behavioural advertising or sale to third parties. Unless you have objected, the counter reports aggregate numbers for pages and products, and a completed order is also reported as a conversion in Google Ads in order to measure the result of advertisements. Ad personalisation and Google advertising signals are switched off, so the data is not used for behavioural advertising or cross-site tracking.

Recipients of data

Access to personal data is given only to persons and providers necessary for the operation of the shop: the courier for delivery, accountants for invoices, the email provider, technical support and hosting.

When you choose an office through the map, the browser loads map tiles from OpenStreetMap. This is an external request from your browser and may disclose technical data such as request address and approximate network location.

Unless you have declined, visits are measured through Google Analytics (Google Ireland Limited, with possible processing by Google LLC in the United States). The service receives the page address, visit source, general technical data about the browser and a random cookie identifier. Before sending, the address is cleaned: keys from order, password reset and email verification links do not leave the site. Transfers outside the EU are made under the applicable adequacy decision for the United States or on the basis of standard contractual clauses. If "Decline" is chosen, no request is sent to Google Analytics and any cookies already created are deleted.

Unless you have declined, a completed order is reported to Google Ads (the same companies) as a conversion containing the order number and its value. Recipient details, the address and the contents of the order are not sent. The report serves only to measure the result of advertisements. If "Decline" is chosen, no such report is sent.

Personal data may also be provided to a public authority where required by law, or where necessary to protect rights in a dispute.

Retention

An abandoned cart is deleted after 30 days. Email verification keys are valid for 7 days, password reset keys for 1 hour and email change keys for 24 hours.

Orders, invoice data and correspondence relating to fulfilment are retained for the periods required under accounting, tax and consumer law. Inquiries are retained until handled and for as long as a record of the communication may reasonably be necessary.

Marketing consent is retained until it is withdrawn or until the account is deleted, unless there is a legal reason to keep a record of it.

Data in the visit counter is retained for 14 months and then deleted automatically. Counter cookies remain in the browser for up to 13 months and are removed immediately when "Decline" is chosen.

Selection helper

The site offers a selection helper that answers questions about the irrigation equipment in the catalogue. The answers come from a machine, not a person; this is stated inside the conversation, together with a warning that the answers may contain errors.

The text of the questions and answers is sent to the language model provider so that the answer can be produced. The processing takes place outside the European Union, under the applicable adequacy decision or on the basis of standard contractual clauses. The provider and model in use may change; the current state is available on request.

The conversation is not linked to a customer account or to an order. It is retained for 90 days and then deleted. The visitor address is not stored in clear form, only as an irreversible fingerprint used to limit abuse, which is deleted after 30 days.

Please do not enter personal data in the conversation. The helper does not request it and cannot process it; to reach a person, use the form on the Contact page.

Your rights

You have the rights to information, access, rectification, erasure, restriction, portability and objection where the legal conditions apply. Where processing is based on consent, consent may be withdrawn for the future.

Rights may be exercised through the details published on the Contact page. An objection to the counter is made separately and takes effect immediately, from the cookie notice or from the choice on the Cookie policy page. If you believe your personal data is processed unlawfully, you may lodge a complaint with the Bulgarian Commission for Personal Data Protection.

Security

Session and cart cookies have a limited lifetime, `httpOnly` and `sameSite: lax`; in production they are sent only over a secure connection. Passwords are not stored in plain text.

Administration access is limited to authorised users. Do not send sensitive data through the contact form unless it is necessary for the specific inquiry.