Privacy Policy

Last updated: 29 May 2026

This Privacy Policy explains how DVA Commerce EOOD (“we”, “us”, “our”) collects, uses, stores, and protects personal data when you visit our website or contact us. We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR) and the Bulgarian Personal Data Protection Act (Zakon za zashchita na lichnite danni — PDPA).

1. Data Controller

The data controller responsible for your personal data is:

  • Company: DVA Commerce EOOD
  • Registered address: 27 Saborny Blvd. (Odessos District), 9000 Varna, Bulgaria
  • VAT number: BG208825960
  • Email: office@dvacommerce.com
  • Phone: +35945671259

For any request relating to your personal data or this Privacy Policy, please contact us using the details above.

2. Personal Data We Collect

We collect only the personal data necessary for the purposes described below.

2.1. Website browsing

When you visit our website, our server may automatically process limited technical information required to deliver the site securely and reliably, such as IP address, browser type, device type, date and time of access, and pages viewed. We do not use analytics, advertising, or profiling tools on this website.

2.2. Contact form

If you use our contact form, we collect the information you voluntarily provide, which may include:

  • Full name
  • Email address
  • Phone number (optional)
  • Subject and message content

2.3. Direct communication

If you contact us by email or telephone, we process the personal data contained in your communication in order to respond to your enquiry.

3. Purposes and Legal Bases for Processing

We process personal data only where a legal basis under Article 6 GDPR applies:

  • Contact requests: to respond to your enquiry and manage our business relationship — legal basis: performance of pre-contractual steps (Art. 6(1)(b) GDPR) and/or legitimate interest in handling commercial communications (Art. 6(1)(f) GDPR).
  • Website operation and security: to ensure the proper functioning, availability, and security of our website — legal basis: legitimate interest (Art. 6(1)(f) GDPR).
  • Legal obligations: where required by applicable law, including Bulgarian commercial and tax legislation — legal basis: legal obligation (Art. 6(1)(c) GDPR).

Where we rely on legitimate interest, we ensure that your rights and interests are not overridden by our processing activities.

4. Cookies and Similar Technologies

We do not use cookies, tracking pixels, or similar technologies for analytics, marketing, or profiling on this website. We do not store preferences or behavioural data in your browser.

Our website may embed content from third parties — for example, a Google Maps map on the Contacts page. When you load such content, the third-party provider may process technical data (including IP address) and may use its own cookies or similar technologies under its own privacy policy. We recommend reviewing Google’s Privacy Policy for further information.

Because we do not deploy non-essential cookies ourselves, no cookie consent banner is displayed on this website.

5. Recipients and Processors

We do not sell your personal data. We may share personal data only where necessary with:

  • Hosting and IT service providers that support the operation of our website and email systems, acting as data processors under GDPR-compliant agreements where applicable;
  • Email delivery providers used to transmit messages submitted through our contact form;
  • Public authorities where required by law or a binding legal request.

All processors are required to process personal data only on our instructions and to implement appropriate security measures.

6. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place in accordance with Chapter V GDPR, such as Standard Contractual Clauses or an adequacy decision by the European Commission.

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected:

  • Contact form messages: typically up to 24 months after the last communication, unless a longer retention period is required for legal, contractual, or accounting purposes;
  • Server logs: retained for a limited period necessary for security and troubleshooting, generally not longer than 90 days;
  • Accounting and legal records: retained for the periods required under Bulgarian law.

When data is no longer needed, we securely delete or anonymise it.

8. Your Rights Under GDPR

Subject to applicable law, you have the following rights regarding your personal data:

  • Right of access — to obtain confirmation as to whether we process your data and to receive a copy;
  • Right to rectification — to request correction of inaccurate or incomplete data;
  • Right to erasure (“right to be forgotten”) — in certain circumstances;
  • Right to restriction of processing — in certain circumstances;
  • Right to data portability — where processing is based on consent or contract and carried out by automated means;
  • Right to object — to processing based on legitimate interests;
  • Right to withdraw consent — where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us at office@dvacommerce.com. We will respond within one month, as required by GDPR, which may be extended by a further two months where necessary due to complexity.

9. Right to Lodge a Complaint

If you believe that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority:

  • Commission for Personal Data Protection (CPDP)
    2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
    Website: www.cpdp.bg

We encourage you to contact us first so that we can address your concern promptly.

10. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include secure hosting, access controls, and encrypted email transmission where supported by our infrastructure.

However, no method of transmission over the Internet is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security.

11. Children’s Privacy

Our website and services are directed at businesses and professional users. We do not knowingly collect personal data from children under 16 years of age. If you believe we have collected such data, please contact us and we will delete it promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The updated version will be published on this page with a revised “Last updated” date. We encourage you to review this page periodically.

13. Contact

For questions about this Privacy Policy or your personal data, please contact:

DVA Commerce EOOD
27 Saborny Blvd. (Odessos District), 9000 Varna, Bulgaria
Email: office@dvacommerce.com
Phone: +35945671259