Privacy Policy
Last updated: 2026-02-14
GDPR & ISO 27001 Compliant
This privacy policy complies with Regulation (EU) 2016/679 (General Data Protection Regulation) and Bulgarian data protection law.
1. Data Controller
The data controller responsible for processing your personal data is:
LabForty Ltd. / Лаб40 ЕООД
EIK (Company ID): BG205622271
Managing Director: Christian Pangratz / Кристиян Панграц
Address: 131 Aleksandar Stamboliyski Blvd., Plovdiv 4000, Bulgaria
Data Protection Officer (DPO): [email protected]
Phone: +359 888 218 238
2. Data We Collect
We collect and process the following categories of personal data:
Identity Data
First name, last name, company name, and similar identifiers used for account creation and order processing.
Contact Data
Email address, phone number, billing address, and shipping address.
Transaction Data
Order history, payment references, and invoice records. We do not store credit card numbers — payment is handled by Revolut.
Technical Data
IP address, browser type and version, device type, operating system, and cookie identifiers.
Account Data
Login credentials, account preferences, language settings, and saved addresses.
Communication Data
Support ticket history, contact form messages, and newsletter subscription preferences.
3. How We Collect Data
We obtain your personal data through the following methods:
Direct Collection
Information you provide when creating an account, placing an order, filling out contact forms, or subscribing to our newsletter.
Automated Collection
Technical data collected automatically through cookies, server logs, and analytics tools when you browse our website.
Third-Party Sources
Payment confirmation data from Revolut and delivery status updates from our courier partners.
4. Purpose and Legal Basis for Processing
We process your personal data for the following purposes, each with a specific legal basis under Article 6 GDPR:
| Purpose | Data Used | Legal Basis (Art. 6 GDPR) |
|---|---|---|
| Order processing and fulfillment | Identity, Contact, Transaction | Contract (Art. 6(1)(b)) |
| Account management | Identity, Contact, Account | Contract (Art. 6(1)(b)) |
| Customer support | Identity, Contact, Communication | Legitimate Interest (Art. 6(1)(f)) |
| Marketing communications | Contact, Communication | Consent (Art. 6(1)(a)) |
| Website analytics and improvement | Technical | Legitimate Interest (Art. 6(1)(f)) |
| Legal and tax compliance | Identity, Transaction | Legal Obligation (Art. 6(1)(c)) |
| Fraud prevention and security | Technical, Transaction | Legitimate Interest (Art. 6(1)(f)) |
5. Data Sharing and Processors
We share your personal data only with trusted third-party processors who are contractually bound to protect your data under GDPR-compliant data processing agreements:
- •Payment Processing: Revolut Ltd. processes payment transactions securely. We never store your card details.
- •Shipping and Delivery: Speedy and Econt (Bulgaria), DPD and DHL (EU) receive your name and delivery address to fulfill orders.
- •Hosting Provider: Our web hosting provider stores and serves website data within the EEA.
- •Email Service: Transactional and marketing emails are sent through our email service provider.
- •Analytics: Google Analytics collects anonymized usage data to help us improve the website experience.
- •Legal Authorities: When required by law, court order, or to protect our legal rights.
We do not sell, rent, or trade your personal data to any third party for marketing purposes.
6. International Data Transfers
Your personal data is primarily processed and stored within the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure adequate protection through:
- •EU adequacy decisions recognizing the recipient country as providing adequate data protection.
- •Standard Contractual Clauses (SCCs) approved by the European Commission.
- •Additional technical and organizational safeguards where necessary.
7. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:
| Data Type | Retention Period | Legal Basis |
|---|---|---|
| Order and invoice data | 10 years | Bulgarian tax law (DOPK), EU VAT Directive |
| Account data | Until account deletion request | Contract performance |
| Marketing preferences | Until unsubscribe | Consent |
| Server logs | 90 days | Legitimate interest (security) |
| Cookie data | Per cookie policy (see Section 9) | Consent / Legitimate interest |
| Support tickets | 3 years | Legitimate interest (service quality) |
8. Your Rights Under the GDPR
Under the GDPR, you have the following rights regarding your personal data. To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
Right of Access (Art. 15)
Request a copy of the personal data we hold about you and information about how it is processed.
Right to Rectification (Art. 16)
Request correction of inaccurate or incomplete personal data we hold about you.
Right to Erasure (Art. 17)
Request deletion of your personal data when it is no longer necessary for the purpose it was collected.
Right to Restriction (Art. 18)
Request that we limit the processing of your personal data under certain circumstances.
Right to Data Portability (Art. 20)
Request your personal data in a structured, machine-readable format for transfer to another controller.
Right to Object (Art. 21)
Object to processing based on legitimate interests, including profiling and direct marketing.
Right to Withdraw Consent
Withdraw your consent at any time where processing is based on consent. This does not affect prior lawful processing.
Right to Lodge a Complaint
Lodge a complaint with your national data protection authority if you believe your rights have been violated.
9. Cookie Policy
We use cookies and similar technologies to provide essential functionality and improve your experience. Below is a detailed list of cookies used on our website:
Essential Cookies
These cookies are strictly necessary for the website to function and cannot be disabled.
| Cookie Name | Purpose | Duration |
|---|---|---|
| session_id | User authentication and session management | Session |
| cart_data | Stores shopping cart contents | 30 days |
| XSRF-TOKEN | Cross-site request forgery protection | Session |
| locale | Stores your language preference | 1 year |
Analytics Cookies
These cookies help us understand how visitors interact with our website. They are set only with your consent.
| Cookie Name | Purpose | Duration |
|---|---|---|
| _ga | Google Analytics - distinguishes unique visitors | 2 years |
| _gid | Google Analytics - identifies visitor session | 24 hours |
You can manage cookie preferences through your browser settings. Disabling essential cookies may affect website functionality. For analytics cookies, you can opt out via our cookie consent banner.
10. Newsletter and Marketing Communications
- •We only send marketing emails to users who have explicitly opted in via our newsletter subscription form.
- •Every marketing email contains a clear unsubscribe link that takes immediate effect.
- •You can update your marketing preferences at any time through your account settings or by contacting us.
- •We never sell, share, or rent your email address to third parties for their marketing purposes.
11. Children's Privacy
Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16.
If we become aware that we have collected personal data from a child under 16 without parental consent, we will take steps to delete that information promptly. Parents or guardians who believe their child has provided us with personal data should contact us at [email protected].
12. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:
- •SSL/TLS encryption for all data transmitted between your browser and our servers.
- •Encrypted storage for sensitive data at rest.
- •Role-based access controls limiting data access to authorized personnel only.
- •Regular security audits and vulnerability assessments.
- •PCI DSS compliance for payment processing through our payment partner Revolut.
13. Data Protection Authorities
You have the right to lodge a complaint with a supervisory authority. Depending on your location, the relevant authorities are:
Bulgarian DPA (CPDP)
Комисия за защита на личните данни (КЗЛД)
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Website: www.cpdp.bg
Email: [email protected]
Phone: +359 2 915 3518
14. Changes to This Privacy Policy
We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. When we make material changes:
- •We will notify you by email or through a prominent notice on our website at least 14 days before the changes take effect.
- •The "Last updated" date at the top of this policy will be revised.
- •Your continued use of our website after the effective date constitutes acceptance of the updated policy.
15. Contact Our Data Protection Officer
For any privacy-related questions, to exercise your GDPR rights, or to submit a data access request, please contact our Data Protection Officer:
+359 888 218 238 (Bulgaria)
LabForty Ltd., 131 Aleksandar Stamboliyski Blvd., Plovdiv 4000, Bulgaria
We aim to respond to all data protection inquiries within 30 calendar days.
16. Related Legal Pages
For more information about our policies, please also review:
Questions about this policy?
Contact Us