Privacy policy

Your data as a merchant

We store your company name, VAT number, contact person, email address, phone number and address. We need them to open the account, invoice you and reach you.

The legal basis is our contract with you. We keep the data while the account is open and for seven years after, because accounting law requires it.

Your end customer's data

When you place an order you send us the recipient's name, address and, if you provide it, email address and telephone number. We use it to pack and ship the parcel and for nothing else.

We pass it to the fulfilment centre and the carrier who deliver the parcel. They are in the EU.

We are a controller in our own right for this data, not your processor: we need the address for our own delivery obligation.

We keep it for two years after delivery, so that a complaint or a customs question can still be answered, and then delete it.

Sign-in and security

Passwords are stored as one-way hashes and can never be read back.

We log sign-ins and the browser used, so that we can tell you when someone signs in from somewhere new. Logs are kept for 90 days.

Who else sees the data

Our hosting provider, our fulfilment centre, the carrier, our email provider and our payment provider. All of them process on our instructions or as controllers in their own right for the delivery.

We do not sell personal data and we do not use it for advertising.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to our processing. Write to support@ecosupplements.eu.

If you think we handle your data wrongly you can complain to the Bulgarian Commission for Personal Data Protection.