Privacy and Personal Data Protection Policy

This privacy policy describes how Polkom, a manufacturer and wholesaler of garment accessories, processes the personal data of website visitors, of persons who send enquiries and of the representatives of our business customers. It has been prepared in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and the Bulgarian Personal Data Protection Act.

1. Data controller

• Controller: Polkom, Sofia, Bulgaria
• Email: info@polkom.com
• Phone: +359 876 76 60 50

For any questions relating to personal data, you can contact us using the details above.

2. What data we process

• Enquiry form data: name, company, email, phone, country and the content of the message, including attachments.
• Registration data: name, company, email address and password (stored in encrypted form).
• Data from correspondence by email, phone, WhatsApp or Viber.
• Order fulfilment data: contact person, delivery address, billing details.
• Technical data: IP address, browser and device type, pages visited and cookies.

We do not collect special categories of personal data and do not request payment card details, as the website does not accept online payments.

3. Purposes and legal bases

• Responding to an enquiry and preparing a quote – taking steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR).
• Fulfilling orders and communicating with customers – performance of a contract (Art. 6(1)(b)).
• Issuing and retaining accounting documents – legal obligation (Art. 6(1)(c)).
• Managing registered accounts, website security and preventing misuse – legitimate interest (Art. 6(1)(f)).
• Analytics and marketing cookies – consent (Art. 6(1)(a)), which may be withdrawn at any time.

4. Retention period

We retain data only for as long as necessary for the purposes for which it was collected. Data from enquiries that did not lead to a business relationship is erased once it is no longer needed for communication. Customer data is kept for the duration of the business relationship, and accounting documents for the periods required by accounting and tax legislation. You can close a registered account at any time.

5. Recipients of the data

We do not sell or disclose your personal data to third parties for marketing purposes. Data may be disclosed to:

• Shopify – the platform on which the website runs, which processes form and account data on our behalf as a processor;
• courier and transport companies – for the delivery of samples and orders;
• accounting, IT and hosting providers who support us;
• public authorities, where required by law.

6. Transfers of data outside the EU

Some providers, including Shopify, may process data outside the European Economic Area. In such cases, transfers take place subject to appropriate safeguards under the GDPR – for example a European Commission adequacy decision or standard contractual clauses.

7. Cookies

The website uses cookies – small text files stored in your browser.

• Strictly necessary cookies enable the website to function, account login and security. They do not require consent.
• Analytics cookies help us understand how the website is used and are set only after you have given your consent.
• Marketing cookies, if used, are also set only with consent.

You can change your choice via the cookie banner or your browser settings. Restricting necessary cookies may affect the functionality of the website.

8. Your rights

Under the GDPR, you have the right:

• of access to your personal data;
• to rectification of inaccurate or incomplete data;
• to erasure ("right to be forgotten") where the grounds for it apply;
• to restriction of processing;
• to data portability;
• to object to processing based on legitimate interest;
• to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise your rights, write to us at info@polkom.com. We will respond within the time limits set by the GDPR. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (www.cpdp.bg).

9. Data security

We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or alteration. The website uses an encrypted connection (HTTPS), and access to data is restricted to the staff and providers who need it.

10. Minors

The website is intended for business customers and is not directed at persons under the age of 16. We do not knowingly collect data from minors.

11. Changes to this policy

We may update this policy in the event of changes in legislation or in the way we work. The current version is published on this page. See also our General Terms and the contact page.