Privacy policy | Pambiotic

The controller of your data is ARFA ES LTD, 3 eng. Stoimen Sarafov Str., 1000 Sofia, Bulgaria, [email protected].

What we collect and why

To deliver your order: name, address, phone and email. These go to our warehouse system in Bulgaria and to the carrier that delivers the parcel (tracked post, through our shipping partner). Legal basis: the contract (GDPR art. 6(1)(b)).
For accounting: order and payment details, kept as long as tax law requires. Legal basis: legal obligation (GDPR art. 6(1)(c)).
When you pay: your email, the amount and the order number go to Stripe Payments Europe Ltd. (Dublin, Ireland), which processes the payment on its own page; your card details go to Stripe only, never to us. Legal basis: the contract (GDPR art. 6(1)(b)). Stripe's privacy policy: stripe.com/privacy.
Technical access data: when you open the site, the server and our hosting and delivery service Cloudflare process the data needed to deliver the page and protect it from abuse (for example the IP address and the time of the request). Legal basis: our legitimate interest in running the site securely (GDPR art. 6(1)(f)).
To answer your messages: what you write to us (by email, phone or the contact form) and how to reach you. Legal basis: our legitimate interest in answering you (GDPR art. 6(1)(f)).

We do not sell your data and we do not use advertising cookies.

Cookies

The site stores in your browser only what it needs to work — and, if you allow it, the analytics cookies of Google Analytics. Nothing optional loads before you choose in the cookie banner, and you can change your choice at any time with "Cookie settings" at the bottom of every page.

Cookies and browser records
Name	Type	Purpose	Lifetime	Category	Whose
`pb_consent`	cookie	Remembers your cookie choice (version, allowed categories, date).	12 months	strictly necessary	our own
`pb_edition`	cookie	Remembers the country / region you picked in the footer. Only created when you pick one.	12 months	strictly necessary	our own
`pb-cart-v1`	local storage	What is in your basket. Only created when you add something.	until you delete it	strictly necessary	our own
`_ga`, `_ga_*`	cookie	Google Analytics 4: tells separate visitors and visits apart for aggregate statistics.	up to 2 years	analytics — only with your consent	third party: Google Ireland Ltd.

Analytics (Google Analytics 4): aggregate statistics on how the site is used — which pages are visited and how visitors arrive. Provider: Google Ireland Ltd.; Google may also process the data in the USA (Google LLC is certified under the EU–US Data Privacy Framework). The page address reaches Google without your order link and without any parameters other than the campaign you came from. Legal basis: your consent (GDPR art. 6(1)(a)), which you can withdraw at any time as easily as you gave it.

You can also delete or block cookies in your browser's settings; your basket will then be emptied.

How long we keep it

Order data for the period required by Bulgarian accounting law; messages for as long as needed to answer them; technical access data only for the short time needed to run the site securely.

Your rights

You can ask for a copy of your data, its correction or deletion, restriction or objection, and data portability. Write to [email protected]. You may also complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or to the data protection authority where you live.