Privacy Policy
Last updated: September 2026
This Privacy Policy explains how Supergen Life EOOD ("we", "us", "our"), the data controller for this online store, collects, uses, and protects your personal data when you browse or purchase from our website. Supergen Life EOOD is a company registered in Bulgaria under EIK/BULSTAT 207561924, with its registered office in Sofia, Bulgaria. You can contact us at any time regarding your personal data at our contact email published on our Imprint page.
1. Data We Collect
- Order and fulfilment data: name, shipping/billing address, email address, phone number, order contents, and payment confirmation data (we never store full card numbers).
- Technical data: IP address, browser type and version, device information, and pages visited, collected via server logs and cookies.
- Marketing data: email address and consent records, if you opt in to our newsletter or marketing communications.
2. Why We Process Your Data (Legal Bases)
- Order fulfilment and customer service (Art. 6(1)(b) GDPR): processing your order, shipping, returns, and support.
- Legal obligations (Art. 6(1)(c) GDPR): accounting records and tax compliance, retained for the period required by Bulgarian law.
- Legitimate interests (Art. 6(1)(f) GDPR): fraud prevention, site security, and service improvement.
- Consent (Art. 6(1)(a) GDPR): marketing emails and non-essential cookies are processed only with your consent, which you may withdraw at any time.
3. Cookies
We use essential cookies to operate the store (cart, checkout, security). Analytics and marketing cookies are set only after you give consent via the cookie banner, and you can change or withdraw your choice at any time through your browser settings or the cookie banner link.
4. Sharing With Processors
To fulfil your order we share necessary data with: our e-commerce platform (Shopify), payment providers, and our logistics/shipping partners who deliver your parcel. Each processor is bound by a data-processing agreement and processes data only on our instructions.
5. Retention
Order data is kept for the period required by commercial and tax law. Marketing data is kept until you withdraw consent. Technical log data is deleted after 12 months.
6. Your Rights (GDPR)
- Access, rectification, and erasure of your personal data
- Restriction of processing and objection to processing
- Data portability
- Withdraw consent at any time
- Lodge a complaint with a supervisory authority (in Bulgaria: the Commission for Personal Data Protection, www.cpdp.bg)
To exercise any right, contact us via the email on our Imprint page. We respond within one month.
7. Data Security
We apply appropriate technical and organisational measures, including TLS encryption for all traffic and access controls, to protect your personal data.