Information about the Data Controller
EVOL-T EOOD is a company registered under the Commercial Law of the Republic of Bulgaria, with UIC: 205184474, and with its registered office and management address located in the country: BULGARIA, Vratsa, 47 MIR Street.
We process your personal data on the following legal grounds:
• The contract concluded between us and you for the purpose of fulfilling our obligations under it;
• Your explicit consent – the purpose is specified for each individual case;
• A legal obligation.
In the following sections, you will find detailed information regarding the processing of your personal data based on the legal basis under which we process them.
We process your personal data in order to perform our contractual and pre-contractual obligations and to exercise our rights under the contracts entered into with you.
Purposes of the Processing:
• Establishing your identity;
• Managing and executing your request and the concluded contract;
• Preparing a proposal for contract conclusion;
• Preparing and sending an invoice for the services you use from us;
• Ensuring complete and proper service to you, as well as collecting the due amounts for the services provided;
• Keeping correspondence related to orders, processing requests, reporting issues, etc.;
• Providing notifications regarding everything related to the services you use from us;
• Detecting and/or preventing illegal actions or actions in violation of our terms for the respective services.
Data Processed Under This Legal Basis:
Based on the contract between us and you, we process information about the type and content of the contractual relationship, as well as any other information related to that contractual relationship, including:
• Contact personal data – email address, telephone, and others;
• Identification data – first and last names, delivery address, email;
• Other feedback we receive from you;
• Information regarding your actions on our website.
Processing the personal data mentioned above is mandatory for us to conclude the contract with you and to perform our contractual obligations. Without providing the above data, we would not be able to fulfill our obligations under the contract.
Provision of Personal Data to Third Parties
We may provide your personal data to third parties in order to offer you quality, fast, and comprehensive service. We do not provide your personal data to third parties until we have ensured that all technical and organizational measures have been taken to protect this data and that strict control is maintained over its processing. In such cases, we remain responsible for the confidentiality and security of your data.
We provide personal data to the following categories of recipients (data controllers):
• Postal operators and courier companies;
• Persons who, by mandate, maintain the equipment, software, and hardware used for personal data processing and necessary for the company’s operations;
• Persons providing consultancy services in various fields.
Deletion of Data Collected on This Basis:
Data collected under this basis will be deleted 5 years after the termination of the contractual relationship, regardless of whether it ends due to the expiry of the contract, cancellation, or any other reason.
It is possible that the law requires us to process your personal data. In these cases, we are obligated to process the data, for example:
• Obligations under the Law on Measures Against Money Laundering;
• Obligations related to distance selling or sales outside the business premises, as provided by the Consumer Protection Act;
• Providing information to the Consumer Protection Commission or third parties as stipulated by the Consumer Protection Act;
• Providing information to the Personal Data Protection Commission in connection with obligations under data protection legislation;
• Obligations under the Accounting Act, the Tax and Social Security Procedural Code, and other related normative acts concerning the proper maintenance of accounting records;
• Providing information to the court and third parties within legal proceedings in accordance with the applicable regulations.
Deletion of Personal Data Collected on This Basis:
Data collected pursuant to a legal obligation will be deleted after the obligation for collecting and storing the data has been fulfilled or expires. For example:
• Under the Accounting Act, data is stored and processed for 11 years;
• Obligations to provide information to the court, competent state authorities, etc., as provided by current legislation (5 years).
Provision of Data to Third Parties:
When required by law, we may provide your personal data to the competent state authority, natural or legal person.
We process your personal data on this basis only after obtaining your explicit, unequivocal, and voluntary consent. We will not impose any adverse consequences on you if you refuse the processing of your personal data.
Consent is a separate legal basis for processing your personal data, and the purpose of the processing is specified within it. It is not covered by the purposes listed in this policy. If you provide us with the corresponding consent – even after its withdrawal or the termination of any contractual relationship with you – we may prepare appropriate proposals for products/services for you by performing detailed analyses of your main personal data.
Detailed Analysis:
This is a method of processing large volumes of data using statistical models, algorithms, and other techniques, which may include the use of personal data as well as processes of pseudonymization and anonymization to extract information about trends and various statistical indicators.
Data Processed Under This Legal Basis:
On this basis, we process only the data for which you have given your explicit consent. The specific data processed is determined on a case-by-case basis. Typically, the data includes:
• Email address;
• Names;
• Address;
• Telephone number;
• IP address;
• Others.
Provision of Data to Third Parties:
On this basis, we may provide your data to marketing agencies, Facebook, Google, or similar entities.
Withdrawal of Consent:
Any consent provided can be withdrawn at any time. The withdrawal of consent does not affect the fulfillment of contractual obligations. If you withdraw your consent for the processing of your personal data for any or all of the aforementioned purposes, we will no longer use your personal data and information for those purposes. Withdrawing consent does not affect the lawfulness of the processing that was based on your consent prior to its withdrawal.
To withdraw your consent, simply use our website or our contact details.
Deletion of Data Collected on This Basis:
Data collected on this basis will be deleted upon your request or 6 months after the initial collection.
We process your data for statistical purposes; this means that the analyses yield only aggregated results, and therefore, the data is anonymous. It is impossible to identify any specific individual from this information.
Your data may also be anonymized. Anonymization is an alternative to data deletion. In the process of anonymization, all personal identifiers or elements that allow your identification are irreversibly removed. Anonymized data is not subject to legally mandated deletion since it does not constitute personal data.
For the processing of your personal data, we use partially automated algorithms and methods in order to continuously improve our products and services and to adapt our offerings to your needs in the best possible way. This process is known as profiling.
To ensure adequate protection of the company’s and our clients’ data, we apply all necessary organizational and technical measures as provided by the Personal Data Protection Act.
The company has established rules to prevent misuse and security breaches.
For maximum security during the processing, transmission, and storage of your data, we may use additional protection mechanisms such as encryption, pseudonymization, etc.
It is possible that we receive personal data about you from other users.
Every user of our website is entitled to all rights for the protection of personal data in accordance with Bulgarian legislation and the rights granted by the European Union.
You can exercise your rights via our contact form or by sending an email to our provided contact address.
Each data subject has the right to:
• Be informed about the processing of their personal data by the data controller;
• Access their own personal data;
• Rectification (if the data is inaccurate);
• Deletion of personal data (the “right to be forgotten”);
• Restriction of processing by the data controller or processor;
• Data portability between data controllers;
• Object to the processing of their personal data;
• Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects the data subject;
• Judicial or administrative protection in the event that the rights of the data subject have been violated.
A data subject may request deletion of their personal data if one of the following conditions applies:
• The personal data is no longer necessary for the purposes for which it was collected or processed in another manner;
• The data subject withdraws their consent, upon which the processing of the data is based, and there is no other legal basis for processing;
• The data subject objects to the processing and there are no legal grounds that override the data subject’s interests;
• The personal data has been processed unlawfully;
• The personal data must be deleted in order to comply with a legal obligation under Union law or the law of a Member State that applies to the data controller;
• The personal data was collected in connection with the provision of information society services to children and the consent was given by the person responsible for the child.
The data subject has the right to restrict the processing of their personal data when:
• They contest the accuracy of the personal data. In this case, the processing will be restricted for a period that allows the controller to verify the accuracy;
• The processing is unlawful, but the data subject does not want the data to be deleted, but rather restricted in its use;
• The controller no longer needs the personal data for the purposes of processing, but the data subject requires it for the establishment, exercise, or defense of legal claims;
• The data subject objects to the processing pending verification as to whether the legal grounds of the controller override the interests of the data subject.
Right to Data Portability:
The data subject has the right to receive the personal data that concerns them and that they have provided to the controller, in a structured, commonly used, and machine-readable format, and to have the right to transfer those data to another controller without any hindrance from the controller to whom the personal data were provided, provided that the processing is based on consent or a contractual obligation and is carried out by automated means.
When exercising the right to data portability, the data subject is entitled to direct transmission of the personal data from one controller to another, if technically feasible.
Right to Object:
Users have the right to object to the processing of their personal data by the controller. The data controller is obliged to cease processing unless it can demonstrate that there are compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims. In case of an objection to the processing of personal data for direct marketing purposes, the processing must cease immediately.
Right to Lodge a Complaint with the Supervisory Authority:
Every data subject has the right to lodge a complaint with the Personal Data Protection Commission or with the competent court in the event of unlawful processing of their personal data.
We maintain a register of processing activities for which we are responsible. This register contains the following information:
• The name and contact details of the data controller;
• The purposes of the processing;
• A description of the categories of data subjects and categories of personal data;
• The categories of recipients to whom the personal data have been or will be disclosed, including recipients in third countries or international organizations;
• Where possible, the prescribed time limits for deletion of the various categories of data;
• Where possible, a general description of the technical and organizational security measures.
This Privacy Policy was adopted and approved on 01.05.2024 by EVOL-T EOOD.
English 
Bulgarian