Privacy policy

Draft — to be reviewed by the merchant's legal adviser before launch.

This policy explains what personal data Sofia Lara collects, why we collect it, how long we keep it and what you can ask us to do about it.

Who controls your data

The controller is Nitex-50, trading as Sofia Lara, ul. Prof. Hristo Toprakchiev 10, Gara Iskar, 1528 Sofia, Bulgaria. Company registration details to be inserted here before launch. For anything to do with your data, write to sales@nitex50.com.

What we collect

Order details: your name, delivery and billing address, email address, telephone number and what you bought.
Payment details: the fact of a payment, the method and the last four digits of a card. We never receive the full card number.
Account details, if you choose to create an account.
Correspondence: the emails and messages you send us and our replies.
Marketing consent, if you sign up for our emails.
Technical data: IP address, browser, device and the pages you looked at on this site.

Why we use it and on what basis

To take, ship and refund your order, and to answer your questions. Basis: performance of our contract with you.
To keep tax and accounting records. Basis: our legal obligations.
To prevent fraud, to keep the site secure and to understand how the shop is used. Basis: our legitimate interest in running the business.
To send marketing emails. Basis: your consent, which you can withdraw at any time using the unsubscribe link in any email.

Who we share it with

We share only what is needed, and only with companies that process data on our instructions. That includes our ecommerce platform, our payment provider, the couriers who deliver your parcel, our email provider and our accountants. We do not sell your data and we do not share it for anyone else's marketing.

Where your data is held

Your data is held within the European Economic Area wherever possible. Where a provider processes data outside it, the transfer is covered by the European Commission's standard contractual clauses or an adequacy decision.

How long we keep it

Order and invoice records: as long as Bulgarian tax law requires.
Account data: until you ask us to delete the account.
Marketing consent: until you withdraw it, and for a short period afterwards so that we can prove you withdrew it.
Correspondence: three years from the last message.

Your rights

Under the General Data Protection Regulation you may ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, object to processing based on legitimate interest, and ask for your data in a portable format. Write to sales@nitex50.com and we will respond within one month.

Cookies

Cookies are covered separately in our cookie policy.

Complaints

If you think we have handled your data badly, tell us first. You also have the right to complain to the Bulgarian Commission for Personal Data Protection, or to the supervisory authority in the country you live in.