Privacy policy

1. Who processes your data

The controller of the personal data is:

• Сонел-В ЕООД
• Registered office and address of management: с. Добрич, ул. „Добруджа“ № 17, общ. Димитровград, обл. Хасково
• E-mail: office@kirev.eu
• Phone: +359 878 799 564

The company is not required to appoint a data protection officer. Questions and requests under this policy are sent to the e-mail address above.

2. What data we collect and on what legal basis

We collect only the data we need for the particular action. The public catalogue is browsed without registration and without leaving personal data.

2.1. Request to be notified when the trade platform opens

• Data: company or person's name, e-mail, phone.
• Purpose: to send you a single message when the trade area goes live.
• Legal basis: your consent — Art. 6(1)(a) GDPR. Consent is given by an explicit tick box and can be withdrawn at any time.
• Retention: until the message is sent or consent is withdrawn, but no longer than 24 months from submission. We also keep the text of the consent, the date and the IP address — this is the proof that consent was given.

2.2. Partnership request (trader registration)

• Data: company number, VAT number, company name, registered address, materially responsible person, contact person, phone, e-mail, retail outlets and towns.
• Some of this is company data rather than personal data. Personal are the names of the materially responsible person and of the contact person, along with their phone and e-mail.
• Purpose: to assess the request and to open a trade account.
• Legal basis: steps taken at the request of the data subject prior to entering into a contract — Art. 6(1)(b) GDPR.
• Retention: if approved — for the duration of the trading relationship and 5 years after it ends. If refused — 12 months, so that we can justify our decision.

2.3. Trade account and orders

• Data: sign-in details, people with access to the account, delivery addresses, the content and history of orders, documents issued.
• Purpose: fulfilling orders and managing the trading relationship.
• Legal basis: performance of a contract — Art. 6(1)(b); for accounting documents — a legal obligation under Art. 6(1)(c).
• Retention: accounting documents are kept for 10 years after the year in which they were drawn up, under the Accountancy Act; tax liabilities are extinguished by a 5-year limitation period under the Tax and Social Insurance Procedure Code. Other account data — for the duration of the relationship and 5 years after it.

2.4. Complaints

• Data: description of the non-conformity, attached photographs, correspondence.
• Purpose: reviewing and resolving the complaint.
• Legal basis: performance of a contract and a legal obligation.
• Retention: 5 years from closing the file. If a person is visible in a photograph, please do not send it — the complaint needs the product, not the person.

2.5. Server logs and security

• Data: IP address, time of the request, page address, browser type — recorded automatically by the hosting provider's server.
• Purpose: security of the site, detection of abuse and resolution of technical problems.
• Legal basis: legitimate interest — Art. 6(1)(f) GDPR. The interest is that the site works and is not used for abuse.
• Retention: up to 12 months.

3. Who we pass the data to

We do not sell data and we do not provide it for other parties' marketing. We pass it only to those who help us operate, and only as far as they need it:

• The hosting provider on whose servers the site runs.
• The company's internal management system, which holds counterparties, stock and orders.
• Accounting services — for the documents the law requires.
• A carrier or courier — only the data needed for the delivery.
• Competent authorities, where the law obliges us.

4. Transfers outside the European Union

We do not transfer personal data outside the European Union and the European Economic Area. Should this change, we will update this policy and state the basis for the transfer.

5. What rights you have

• Access — to find out what data of yours we process and to receive a copy (Art. 15).
• Rectification — to correct inaccurate or incomplete information (Art. 16).
• Erasure — where the data is no longer needed or you have withdrawn your consent (Art. 17). We cannot erase documents the law obliges us to keep.
• Restriction of processing (Art. 18).
• Portability — to receive your data in a machine-readable form (Art. 20).
• Objection to processing based on legitimate interest (Art. 21).
• Withdrawal of consent at any time — withdrawal does not affect processing carried out until then.

Rights are exercised by a plain letter to office@kirev.eu. We reply within one month. If the request is complex, the period may be extended by a further two months, of which we will inform you.

For the request to be notified when the platform opens there is a faster route as well: every message from us contains an unsubscribe link that deletes your data immediately.

6. Cookies

The site uses a small number of cookies. Which ones exactly, why, and for how long — in the Cookie Policy.

7. Automated decisions

We do not take decisions about you by automated means and we do not carry out profiling. Partnership requests are reviewed by a member of staff, not by an algorithm.

8. Right to lodge a complaint

If you believe we process your data unlawfully, you may lodge a complaint with the supervisory authority:

• Комисия за защита на личните данни
• гр. София 1592, бул. „Проф. Цветан Лазаров“ № 2
• Phone: +359 2 915 3518
• E-mail: kzld@cpdp.bg
• https://www.cpdp.bg

It would help us if you came to us first — it is faster and usually settles the matter.

9. Changes to this policy

When we change the policy, we change its version and date at the top. We announce material changes on the site. If the change affects processing based on your consent, we will ask for your consent again.