Privacy policy

1. WHO PROCESSES YOUR DATA

Data controller:

    OMEGA METAL EOOD (ОМЕГА МЕТАЛ ЕООД)
    UIC 200040121 · VAT No. BG200040121
    38 Hristo Botev Str., 1282 Novi Iskar, Bulgaria
    Telephone: +359 888 288 980
    E-mail: projecteletra@gmail.com

The company operates the online store eletra.bg. We are not required to
appoint a data protection officer. For any question about your personal
data, write to the address above.

2. WHAT DATA WE PROCESS

Identification and contact
    first and last name, e-mail address, telephone, delivery address and
    billing address

Order data
    items ordered, quantities, amounts, order number and date, order
    history

Payment data
    We do NOT store bank card numbers. Card payments are processed
    entirely by the payment service provider. We receive only the
    transaction outcome and limited data identifying it.

Account data (only if you create an account)
    e-mail address, hashed password, saved addresses, order history

Correspondence
    messages via the contact form, e-mail, and messages about complaints
    and returns

Technical data
    IP address, browser and device type, pages viewed. This data is
    collected by the Shopify platform.

We do not process special categories of personal data under Art. 9 GDPR.

3. WHY WE PROCESS IT, AND ON WHAT BASIS

Fulfilling your order — acceptance, processing, delivery, returns
    Basis: Art. 6(1)(b) GDPR — performance of a contract.

Creating and maintaining a customer account
    Basis: Art. 6(1)(b) GDPR — performance of a contract.

Issuing and retaining accounting and tax documents
    Basis: Art. 6(1)(c) GDPR — legal obligation (Accountancy Act, VAT
    Act, Tax and Social Insurance Procedure Code).

Receiving and handling complaints, including maintaining the register of
complaints
    Basis: Art. 6(1)(c) GDPR — legal obligation (Arts. 46 and 47
    ЗПЦСЦУПС).

Handling withdrawal from the contract and refunds
    Basis: Art. 6(1)(c) GDPR — legal obligation (чл. 50–55 ЗЗП).

Site security and fraud prevention
    Basis: Art. 6(1)(f) GDPR — our legitimate interest in protecting the
    store, our customers and ourselves against misuse.

Establishing, exercising or defending legal claims
    Basis: Art. 6(1)(f) GDPR — legitimate interest.

Marketing communications
    We currently send NO newsletter or promotional messages. If we
    start, it will be solely on the basis of your explicit, prior and
    freely given consent — Art. 6(1)(a) GDPR. Placing an order is NOT by
    itself treated as consent. Consent may be withdrawn at any time,
    without affecting the lawfulness of processing before withdrawal.

We do not carry out automated decision-making or profiling producing
legal effects for you. Our prices are not individualised on the basis of
automated decision-making.

4. WHO WE SHARE IT WITH

Shopify — platform, hosting and technical operation of the store.
    Processor. 

Payment service provider — card payment processing.
    Shopify Payments and the relevant payment institution

Carriers — for delivery and returns:
    Econt Express OOD and Speedy AD for Bulgaria;
    DHL and other international carriers for the EU/EEA.
    They receive name, address, telephone and consignment details.

Accounting services — for issuing and retaining documents.

Public authorities — only where we are required by law (NRA, КЗП, КЗЛД,
courts, investigating authorities).

We do not sell your personal data. We do not supply it to advertising
networks.

TRANSFERS OUTSIDE THE EEA
Part of Shopify's infrastructure sits outside the European Economic
Area. Where such a transfer occurs it is made on the basis of a European
Commission adequacy decision or of standard contractual clauses under
Art. 46 GDPR.

The site's fonts load from Google Fonts. In doing so your IP address
becomes known to Google LLC (USA). See the "Cookie policy".

5. HOW LONG WE KEEP IT

Accounting registers and financial statements, including invoices and
documents for tax control
    10 years, running from 1 January of the reporting period following
    the one they relate to (чл. 12, ал. 1, т. 2 ЗСч).

Other carriers of accounting information
    3 years, running from 1 January of the reporting period following
    the one they relate to (чл. 12, ал. 1, т. 3 ЗСч).

Order and contact data needed for the legal guarantee and for possible
claims
    until expiry of the two-year complaint period and the general
    five-year limitation period under чл. 110 ЗЗД.

Register of complaints
    for as long as needed to evidence compliance with our obligations
    under ЗПЦСЦУПС.

Customer account data
    for as long as the account exists. On deletion we erase the account
    data; data we are legally required to keep (such as invoices)
    remains until its own period expires.

Correspondence
    up to 3 years from the last message, unless connected to a dispute
    or claim.

Marketing consent
    until consent is withdrawn.

Once the periods expire, data is erased or anonymised.

6. YOUR RIGHTS

You have the right to:
    • obtain access to your personal data and a copy of it (Art. 15);
    • have inaccurate data corrected (Art. 16);
    • request erasure (Art. 17), to the extent we are not legally
      required to retain the data;
    • request restriction of processing (Art. 18);
    • receive your data in a structured, machine-readable format and
      transmit it to another controller (Art. 20);
    • object to processing based on legitimate interest (Art. 21);
    • withdraw consent at any time where processing is based on consent
      (Art. 7(3)).

How: write to projecteletra@gmail.com. We reply within one month. For
complex or numerous requests the period may be extended by a further two
months, and we will tell you if so. There is no charge.

RIGHT TO COMPLAIN
If you believe we process your data unlawfully, you may lodge a
complaint with:

    Commission for Personal Data Protection (КЗЛД)
    2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
    Telephone: +359 2 915 3518
    E-mail: kzld@cpdp.bg
    https://cpdp.bg

You may also complain to the supervisory authority where you reside in
the EU.

7. IS PROVIDING DATA MANDATORY

The data needed to fulfil an order — name, delivery address, contact
details — is a contractual requirement. Without it we cannot conclude or
perform the contract. Data for accounting purposes is a statutory
requirement. All other data you provide voluntarily.

8. SECURITY

The store runs over an encrypted connection (HTTPS). Access to data is
limited to those who need it. We do not store bank card data.

9. CHANGES

If this policy changes we publish the current version on this page and
update the date below. For material changes we will notify you by
appropriate means.

Last updated: 1 September 2026