BG EN
Login Back to home

Legal information

Privacy policy

Last updated:

This policy explains how Distriba Ltd processes personal data through the public website distriba.bg, including the free consultation form.

Controller

The controller is Distriba Ltd (Дистриба ООД), UIC 206535410, with registered office at Geo Milev St., bl. 83, Varna, Bulgaria, represented by managing director Lyubomir Kostov Kostov (“the Company”, “we”).

Please read this policy before submitting a request or using the website’s services. If you do not agree, do not submit the form and do not use the relevant features.

Scope

This policy applies to Distriba’s public information website and to requests sent through the consultation form. It does not replace the documents for the software platform:

Personal data we process

Consultation form

When you send a request, we process:

  • name;
  • telephone number;
  • company (if provided);
  • city;
  • business type;
  • your consent confirmation;
  • when JavaScript is enabled, the page address from which the request was sent;
  • technical data needed to accept and protect the request (for example the time of submission and anti-spam checks).

Fields marked with an asterisk are required for us to accept and respond to the request. Without them we cannot process the enquiry.

Website and security

When you visit the website, the hosting or security provider may process technical data such as IP address, browser type and log records, to the extent needed for security and reliable operation. The form uses temporary browser storage (sessionStorage) to limit repeated submissions. This storage is not sent to our server and is deleted when the browser session ends.

Video

The video in the introductory section is loaded from YouTube only after you choose to watch it. Google Ireland Limited / YouTube may then process data under their own policy, including through cookies. Until then the video is not embedded automatically.

Purposes and lawful bases

We process personal data on the following bases under Article 6 of Regulation (EU) 2016/679:

  • Pre-contractual steps (Article 6(1)(b)) — to receive the consultation request, contact you and prepare a proposal for using Distriba.
  • Consent (Article 6(1)(a)) — confirmed by the checkbox in the form. You may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
  • Legal obligation (Article 6(1)(c)) — where we must retain or disclose data under accounting, tax or other applicable law, or to a competent authority.
  • Legitimate interest (Article 6(1)(f)) — protecting the website and form against abuse, spam and technical incidents, and improving our service, insofar as this does not override your rights.

We do not use form data for email marketing unless you separately give explicit consent. We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you.

Processors and recipients

We do not sell personal data. We disclose data to third parties only where needed for the purposes above, with appropriate technical and organisational measures, and under a processing agreement where required.

For the public website we use the following recipients:

  • Formspree, Inc. (United States) — a processor that receives, filters and forwards form submissions to Distriba Ltd’s configured recipient ([email protected]). Formspree’s policy: formspree.io/legal/privacy-policy. Security and GDPR information: formspree.io/security.
  • Amazon Web Services, Inc. — a sub-processor of Formspree; Formspree’s services are hosted in AWS data centres in the United States.
  • Persons engaged to maintain hosting, security, equipment, software or hardware needed to operate the website.
  • Persons providing consulting services in areas such as law, accounting and business consulting, where needed.
  • Competent public authorities, courts or third parties where the law requires disclosure.

YouTube / Google act as independent controllers for the data they collect if you choose to watch the video.

Transfers to third countries

Form submissions are processed by Formspree in the United States. This is a transfer of personal data to a third country under Articles 44 et seq. of the Regulation. Formspree states that, as a processor, it relies on the European Commission’s Standard Contractual Clauses (SCCs). If you play a YouTube video, Google may also transfer data outside the EEA under its own safeguards.

By submitting the form, you understand that the data will be transmitted to this processor outside the EEA so that we can receive and respond to your request.

Retention

  • Consultation request data and other pre-contractual correspondence — up to 12 months after the last interaction, unless a contract is concluded in the meantime.
  • If a contract is concluded — 3 or 5 years after termination, according to the applicable limitation period for claims.
  • Data for which the law requires a longer period (for example accounting records) — for the relevant statutory period, including up to 11 years under the Accountancy Act where applicable.
  • Data processed on the basis of consent — until consent is withdrawn or the period above expires, whichever is earlier, unless another legal basis for retention applies.
  • Technical security logs — for the shortest period necessary.
  • sessionStorage used to limit repeated submissions — until the browser session ends.

After the period expires, the data are deleted or anonymised, unless the law requires further retention.

Cookies

Information about cookies and similar technologies is in the separate Cookie policy.

How we protect data

We apply organisational and technical measures under the Bulgarian Personal Data Protection Act and Regulation (EU) 2016/679, including access restriction, protection of communications and measures against form abuse. Where required, we conclude a processing agreement with parties that process data on our behalf.

Your rights

You have the rights provided by Bulgarian and EU law, including:

  • to be informed;
  • access to your own data;
  • rectification of inaccurate data;
  • erasure (“right to be forgotten”) where the applicable conditions are met;
  • restriction of processing;
  • data portability, where processing is based on consent or a contract and is carried out by automated means;
  • objection to processing based on legitimate interest;
  • withdrawal of consent;
  • not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you;
  • judicial or administrative protection.

To exercise your rights, email [email protected]. Withdrawal of consent does not affect the lawfulness of processing before withdrawal and does not prevent us from meeting legal obligations that have already arisen.

Supervisory authority

You have the right to lodge a complaint with the Commission for Personal Data Protection:

Changes

We may update this policy if processing, processors or applicable law change. The current version is published on this page with the date of the last change.

Back to home