Privacy Policy

PRIVACY POLICY

(Notice regarding the processing of personal data)

Who are we?

Name: ROSMARY-TRADE OOD (UIC: BG117081171)
Address: Ruse, 81 Dorostol Str., Bulgaria
Data Protection Email: [email protected]
Website: www.rosmary.eu

We process your data in strict compliance with the General Data Protection Regulation (GDPR). Information security is monitored by a designated responsible person within our Company.

1. What data do we collect, why, and for how long?

We collect data when you register a profile, order as a "guest", or communicate with us:

Names, address, and phone number
- Why we process it (Purpose): To process your order and physically deliver the goods.
- Legal Basis: Performance of a contract.
- Retention Period: Until the order is fully completed.
Email address
- Why we process it (Purpose): For order confirmation, delivery status, and feedback.
- Legal Basis: Performance of a contract.
- Retention Period: Until profile deletion.
Email address (Marketing)
- Why we process it (Purpose): To send newsletters and promotions.
- Legal Basis: Your explicit consent.
- Retention Period: Until consent withdrawal (opt-out).
Personal ID (EGN)
- Why we process it (Purpose): Only if issuing an invoice to a natural person.
- Legal Basis: Legal obligation.
- Retention Period: 10 years (Accounting Act).
Bank account (IBAN)
- Why we process it (Purpose): To refund payments for returned or cancelled orders.
- Legal Basis: Performance of a contract.
- Retention Period: 10 years (Accounting Act).

2. Who do we share your data with?

Only authorized team members have access to your data. It is shared with external partners only to fulfill our service to you:

Courier companies: To deliver the parcel to your address.
IT & Accounting: Hosting providers and accountants servicing our business.

We never sell, transfer, or swap your data for marketing purposes to third parties.

3. How to manage your data (Your Rights)?

For your convenience, we have built functionalities directly into your User Profile on the website:

View and Edit: You can see and correct your names, phone number, and email.
Marketing Management: You can turn marketing notifications on and off.
Right to Erasure ("To be forgotten"): You can request the complete deletion of your profile and data.

When can we NOT delete your profile immediately?

You have an active/unsent order.
We are communicating with you regarding a product complaint.
You have unpaid debts to us or established service abuse in the last 5 years.
The data is part of issued accounting documents (invoices) that the law obliges us to keep.

In addition to your profile, you can exercise all your GDPR rights (access, portability, objection, etc.) by emailing us at [email protected]. In case of irregularities, you have the right to file a complaint with the Commission for Personal Data Protection (www.cpdp.bg).