Last updated: 27 October 2026 · Поверителност на български

1. Who is responsible

Pendim SD, UIC 040582793, Bogomil 17 str., 4000 Plovdiv, Bulgaria, is responsible for your personal data in this shop. Write to us at info@pendim.com, call +359 888 819 528 or use the contact form.

We collect only what we need, we never sell your data, and we send no newsletters or advertising emails.

2. What we collect and why

• Orders: your name, delivery and billing address, email, phone, what you order and whether it is paid. We need them to make and deliver your order (the contract) and to keep the invoices the law requires.
• Your account, if you open one: your email, password (stored only in scrambled form), addresses, orders and wish list, so you can order again and see your orders.
• EU business buyers: your company's VAT number, which we check in the EU's VIES system to sell without VAT (a legal obligation).
• Messages: what you send through the contact form, "Ask for a price" or by email (name, email, phone if you give it, your message), to answer you.
• Returns: what you tell us about the return, to handle it.
• Technical data: the server that runs the shop records requests (IP address, browser, time) to keep it secure and working (our legitimate interest).

Card details go straight to Stripe, our payment provider: we never see or store them.

3. Who receives it

Only those who need it to do their part, and only what they need:

• Stripe (Stripe Payments Europe, Ireland) processes card payments.
• Interlogistica and Bulgarian Posts deliver your parcel and get your name, address and phone.
• Amazon Web Services (Luxembourg) hosts the shop on servers in Frankfurt, Germany.
• The service that sends the shop's emails (order confirmations, password resets) gets your email address and the message.
• Google receives your IP address only if you choose to show the map on the contact page.
• Authorities, when the law requires it (for example the tax authorities).

Our Facebook page is only linked: no Facebook code runs in the shop.

4. Outside the EU

We keep your data in the EU. Stripe and Google may also process it in the USA; they do so under the EU–US Data Privacy Framework or the EU's standard contractual clauses, which protect it to EU standards.

5. How long we keep it

• Orders and invoices: 10 years, as Bulgarian accounting law requires.
• Your account: until you delete it or ask us to.
• Messages and enquiries: 2 years.
• Server records: 30 days.

6. Your rights

You can ask us to show you the data we hold about you, correct it, delete it, limit how we use it or give it to you in a common format, and you can object to its use. Where you gave consent, you can withdraw it at any time. Write to us; we answer within one month.

If you think we handle your data wrongly, you can complain to the Bulgarian Commission for Personal Data Protection (www.cpdp.bg, 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia) or the data protection authority of your country.

7. Cookies

The shop sets only the cookies it needs to work and to take payments safely, so it does not ask for consent:

• OCSESSID keeps your cart and your login while you shop. It lasts 24 hours.
• currency remembers the currency. It lasts 30 days.
• __stripe_mid and __stripe_sid are set by Stripe, our payment provider, when the card form opens at checkout, to spot fraudulent payments: the first lasts 1 year, the second 30 minutes. For the same reason the card form also uses security cookies of Stripe and of its bot check, hCaptcha, on their own sites.

There are no statistics, advertising or tracking cookies. Google Maps sets its own cookies only if you choose to show the map on the contact page.

8. Security

The shop runs over an encrypted connection (HTTPS), passwords are stored only in scrambled form, and only the people at Pendim who handle orders can see your data.

9. Changes

We update this policy when the way we handle data changes. The date at the top shows when it last changed.