Privacy policy

The data controller is the operator of this platform. Write to the contact address below for anything concerning your personal data.

• Account data — name, business email, telephone, preferred language, role, and the company you belong to. Accounts are created by us; there is no self-registration.
• Company data — legal name, address, VAT number, contact person and the commercial terms agreed with you.
• Transaction data — purchase requests, order confirmations, invoices, delivery and transport documents, and the messages attached to them.
• Technical data — sign-in times, and the strictly necessary cookies listed in the cookie policy. Server logs may record IP addresses for security purposes.

• Performance of a contract (Art. 6(1)(b) GDPR) — operating your account and processing your orders.
• Legal obligation (Art. 6(1)(c) GDPR) — accounting, tax and trade documentation.
• Legitimate interest (Art. 6(1)(f) GDPR) — keeping the platform secure and preventing misuse.
• Consent (Art. 6(1)(a) GDPR) — analytics and marketing cookies, only if you accept them. You may withdraw consent at any time.

Our staff, on a need-to-know basis, and the service providers who host and operate the platform for us under a data-processing agreement. We do not sell personal data and do not share it for third-party advertising.

Account data for as long as the account exists and a short period afterwards. Transaction and accounting documents for the statutory retention period. Security logs for a limited period.

You may request access to your data, correction, erasure, restriction of processing, portability, and you may object to processing based on legitimate interest. You also have the right to complain to a supervisory authority — in Bulgaria, the Commission for Personal Data Protection.

For any request concerning your personal data, write to us at non-prime.ces@borealisgroup.com.