The controller of your data is ARFA ES LTD, 3 eng. Stoimen Sarafov Str., 1000 Sofia, Bulgaria, [email protected].
What we collect and why
- To deliver your order: name, address, phone and email. These go to our warehouse system and to the courier you choose (Econt). Legal basis: the contract (GDPR art. 6(1)(b)).
- For a company invoice: the company's name, UIC, VAT number, responsible person and registered address. Legal basis: the contract and our legal obligation (GDPR art. 6(1)(b) and (c)).
- For accounting: order and payment details, kept as long as tax law requires. Legal basis: legal obligation (GDPR art. 6(1)(c)).
- If you pay by card: your email, the amount and the order number go to Stripe Payments Europe Ltd. (Dublin, Ireland), which processes the payment on its own page; your card details go to Stripe only, never to us. Legal basis: the contract (GDPR art. 6(1)(b)). Stripe's privacy policy: stripe.com/privacy.
- To answer your messages: what you write to us (by email, phone or the contact form) and how to reach you. Legal basis: our legitimate interest in answering you (GDPR art. 6(1)(f)).
We do not sell your data and we do not use advertising cookies.
Cookies
The site stores in your browser only what it needs to work — and, if you allow it, the analytics cookies of Google Analytics. Nothing optional loads before you choose in the cookie banner, and you can change your choice at any time with "Cookie settings" at the bottom of every page.
| Name | Type | Purpose | Lifetime | Category | Whose |
|---|---|---|---|---|---|
pb_consent | cookie | Remembers your cookie choice (version, allowed categories, date). | 12 months | strictly necessary | our own |
pb_edition | cookie | Remembers the country / region you picked in the footer. Only created when you pick one. | 12 months | strictly necessary | our own |
pb-cart-v1 | local storage | What is in your basket. Only created when you add something. | until you delete it | strictly necessary | our own |
_ga, _ga_* | cookie | Google Analytics 4: tells separate visitors and visits apart for aggregate statistics. | up to 2 years | analytics — only with your consent | third party: Google Ireland Ltd. |
- Analytics (Google Analytics 4): aggregate statistics on how the site is used — which pages are visited and how visitors arrive. Provider: Google Ireland Ltd.; Google may also process the data in the USA (Google LLC is certified under the EU–US Data Privacy Framework). The page address reaches Google without your order link and without any parameters other than the campaign you came from. Legal basis: your consent (GDPR art. 6(1)(a)), which you can withdraw at any time as easily as you gave it.
You can also delete or block cookies in your browser's settings; your basket will then be emptied.
How long we keep it
Order data for the period required by Bulgarian accounting law; messages for as long as needed to answer them.
Your rights
You can ask for a copy of your data, its correction or deletion, restriction or objection, and data portability. Write to [email protected]. You may also complain to the Commission for Personal Data Protection (cpdp.bg).