Privacy and personal data protection policy

PRIVACY AND PERSONAL DATA PROTECTION POLICY

This Privacy Policy governs the manner in which AGEN LTD collects, processes, and stores the personal data of visitors and customers of the online store damakra.com (hereinafter referred to as the "Website"). We acknowledge our responsibility to protect your data and strictly comply with the Bulgarian Personal Data Protection Act (PDPA) and the General Data Protection Regulation (Regulation (EU) 2016/679 – GDPR).

1. DATA CONTROLLER IDENTIFICATION

The controller of the personal data collected through this Website is:

• Company Name: AGEN LTD
• Registered Address: Bulgaria, Sofia, p.c. 1220, Serdika District, Residential Quarter NPZ VOENNA RAMPA, ILIYAN TSI Blvd. No. 40zh, Building 17
• Company Registration Number (EIK/UIC): 202567738
• Email: [email protected]

2. WHAT PERSONAL DATA WE COLLECT AND WHY

We collect and process only the personal data necessary to provide our services and deliver chocolate and confectionery products. This includes:

• When placing an order (with or without registration): First and last name, delivery address, contact phone number, and email address.
• When issuing an invoice to an individual: Unified Civil Number (EGN) – only if the customer explicitly requests an invoice as an individual in accordance with the Accountancy Act.
• Payment Data: We do not store details of your payment instruments (e.g., credit/debit card numbers). This data is processed directly by licensed payment service providers and banks.
• When visiting our website (automatically collected data): IP address, information about your browser, device, and operating system, as well as data regarding your behavior on the site (via cookies for web analysis purposes).

3. LEGAL BASIS FOR DATA PROCESSING

AGEN LTD processes your personal data solely based on the following grounds:

• Performance of a contract: To process your order, dispatch the products to the requested address, and update you on the delivery status.
• Legal obligation: To fulfill our obligations under the tax and accounting legislation of the Republic of Bulgaria (issuing invoices, accounting for sales).
• Legitimate interest: To ensure the security of our Website (protection against hacker attacks and fraud) and to improve user experience.
• Explicit consent: For marketing purposes (e.g., sending an email newsletter with promotions and new products), provided you have explicitly given your consent.

4. WITH WHOM WE SHARE YOUR PERSONAL DATA

We do not sell or lease your data to third parties for marketing purposes. We share it only with trusted partners, without whom the execution of your order would be impossible:

• Courier companies and logistics providers – for the purpose of transporting and delivering the ordered confectionery and chocolate products.
• Payment service providers – for the secure processing of your online payments.
• Accounting firms and consultants – for the purpose of the financial and accounting reporting of our company.
• State authorities (National Revenue Agency, Ministry of Interior, etc.) – only when required by law to provide information within an official investigation.

5. DATA RETENTION PERIOD

We store your data only as long as necessary to achieve the purposes for which it was collected, or in accordance with the periods prescribed by law:

• Data contained in our accounting documents (invoices, reports, waybills) is stored for a period of 10 years in compliance with the requirements of the Accountancy Act and the Tax and Social Insurance Procedure Code.
• Data related to your user profile on the Website is stored until you decide to delete your profile or request its erasure.
• Data collected based on consent (e.g., for marketing) is kept until you withdraw your consent.

6. DATA SECURITY

AGEN LTD applies modern technical and organizational measures to protect your personal data against unauthorized access, accidental loss, alteration, or destruction. All data you exchange with the Website is protected via SSL/TLS encryption (HTTPS connection).

7. YOUR GDPR RIGHTS

As a user, you have the following rights regarding your personal data stored by us:

• Right of access: You have the right to request information on whether we process your personal data and to receive a copy of it.
• Right to rectification: You have the right to request the correction of inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten"): You have the right to request the deletion of your personal data, unless a legal requirement (e.g., accounting regulations) obliges us to retain it.
• Right to restriction of processing: You have the right to request a temporary suspension of the processing of your data under certain circumstances.
• Right to withdraw consent: You can withdraw your consent to receive marketing communications at any time (via the unsubscribe link at the bottom of each email).
• Right to lodge a complaint: If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the national supervisory authority:
  • Commission for Personal Data Protection (CPDP)
  • Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
  • Email: [email protected] | Website: www.cpdp.bg

8. POLICY UPDATES

We reserve the right to periodically update this Privacy Policy to reflect changes in our practices or changes in legislation. Any modifications will be published on this page, indicating the date of the last update.

Last updated: October 2, 2026