Privacy Policy
The protection of your personal data is important to us. We continuously review all personal data processing activities to ensure full compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter “GDPR”), which is binding across all EU Member States, as well as the Bulgarian Personal Data Protection Act (“PDPA”), last amended October 2023, which implements the GDPR under Bulgarian national law.
1. Who processes your personal data?
Your personal data is processed as controller by PureSeq OOD, a company registered under Bulgarian law, operating the E-shop at pureseq.eu. You can contact us at any time by email:
2. For what purposes, on what legal basis, and for how long do we process your personal data?
We process personal data for the purposes listed below. The legal basis is determined by the nature of each purpose, which also determines the applicable retention period. Where retention periods are expressed in years, they begin on 1 January of the calendar year following the year in which processing commenced for that purpose.
PURPOSE
Order and purchase of Goods through the E-shop:
When you place an order, we process the personal data provided in your Order and during the contractual relationship in order to process your Order, arrange delivery of the Goods, handle any complaints, and perform all related activities.
LEGAL BASIS
Processing is necessary for the performance of the contract you have concluded with us. No consent is required.
RETENTION PERIOD
For the duration of the contract and 4 years after its termination, unless a longer limitation period applies.
Customer Account:
Ordering Goods through the E-shop requires creating a Customer Account. We process the data provided during Registration and subsequently recorded in the Customer Account (including order history) in order to execute current and future Orders.
Processing is necessary for the performance of pre-contractual and contractual relations. No consent is required.
For the duration of the Customer Account registration, or longer where required by applicable law.
Direct marketing:
Where you have previously purchased Goods from us, we may contact you with information about similar products from our catalogue.
Processing is based on our legitimate interest in promoting similar Goods to existing customers, who can reasonably expect to receive such communications. You may object to this processing at any time (see Section 4).
For the duration of the contractual relationship and 2 years after its termination.
Newsletter and promotional communications:
Where you are not yet a customer, or where we wish to inform you about promotions or products outside the scope of direct marketing, we may send you newsletters or promotional communications.
Processing requires your prior consent, which you may withdraw at any time (see Section 4).
For the duration of your consent, up to a maximum of 2 years from the date consent was granted, after which we may request renewed consent.
Suppliers and contractual partners:
Where you are our supplier or business partner, we process your personal data as necessary to communicate about and perform the contract concluded with you.
Processing is necessary for the performance of the concluded contract. No consent is required.
For the duration of the contract and 4 years after its termination, unless a longer limitation period applies.
Contact persons:
Where you are a contact person of one of our business partners (e.g. an employee or representative), we process your personal data as necessary to perform the contract in which you are listed as a contact.
Processing is based on the legitimate interest of both us and our business partner in ensuring proper contract performance.
For the duration of the contract and 4 years after its termination
Accounting:
As a registered business entity, we are required to maintain accounting records under applicable law, which may include certain personal data contained in invoices and other financial documents.
Processing is necessary to fulfil our legal obligations under applicable accounting legislation.
10 years from the preparation of the relevant accounting document.
Tax obligations:
We are subject to VAT and income tax obligations, which may require us to process personal data included in tax documents.
Processing is necessary to fulfil our legal obligations under applicable tax legislation.
In accordance with applicable tax regulations, generally 10 years from the preparation of the relevant tax document.
Legal claims:
We monitor compliance with applicable law and, where necessary, exercise or defend legal rights and claims.
Processing is based on our legitimate interest in protecting our legal rights and defending against claims by third parties.
For the period of existence and enforceability of the relevant rights or claims.
Essential cookies:
To ensure the functionality, security, and correct operation of our website, we use essential cookies that are strictly necessary for basic website functions.
Processing is based on our legitimate interest in ensuring the proper functioning of the E-shop. No consent is required for essential cookies.
Up to 7 days from your visit to the website, unless a shorter period is specified for an individual cookie, and subject to your browser settings.
Non-essential cookies:
We also use optional cookies (e.g. analytics and advertising cookies) that are not strictly necessary for website functionality but allow us to improve your experience and tailor content to your interests.
Processing requires your prior consent, which you provide via the cookie consent banner on your first visit. You may withdraw consent at any time.
For the duration of your consent, up to a maximum of 1 year from your website visit, unless otherwise specified for a particular cookie.
Social media:
We operate pages and accounts on social media platforms (including Instagram and others) through which we share information about our activities. We process personal data only for the purpose of managing these pages and obtaining anonymised statistical data made available by the platform operator.
Processing is based on our legitimate interest in promoting our activities. Statistical data is provided to us by platform operators in anonymised form only.
For the period of existence of the relevant social media page or account, up to a maximum of 5 years from the commencement of processing.
IT security:
To protect personal data and maintain information security, we may process certain data (including IP addresses) in connection with IT administration and the monitoring and resolution of security incidents.
Processing is based on our legitimate interest in protecting our information systems and the personal data they contain.
For the period necessary to address the relevant security incident, up to a maximum of 12 months.
GDPR compliance:
We process personal data as necessary to handle data subject requests, respond to security incidents, and fulfil our obligations as a data controller under the GDPR and applicable national law.
Processing is necessary to fulfil our legal obligations as a data controller.
5 years from the creation of the relevant record or output.
3. To whom do we disclose your personal data?
We protect your personal data and do not disclose or transfer it to third parties except to trusted service providers who process data on our behalf as data processors and are contractually bound to protect your data in accordance with our instructions. These include providers of cloud hosting, payment processing, shipping, accounting, and IT services.
Where we engage legal, audit, or other regulated professional services, such providers act as independent controllers and are subject to their own data protection obligations. Where required by law or by order of a public authority, personal data may also be provided to competent public authorities.
We do not sell your personal data to third parties.
4. What are your rights and how can you exercise them?
As a data subject under the GDPR, you have the following rights:
Here is the extracted text from the image:
Right of access
You may request confirmation of whether we process personal data about you and, if so, access to that data along with basic information about how it is being processed. The first provision of this information is free of charge. Repeated requests may be subject to an administrative fee of EUR 5.
Right to rectification
You may request that we correct any inaccurate personal data concerning you, or complete any incomplete personal data, without undue delay.
Right to erasure (“right to be forgotten”)
You may request immediate deletion of your personal data where:
• the data is no longer necessary for the purposes for which it was collected;
• you withdraw consent and there is no other legal basis for processing;
• you object to processing and there are no overriding legitimate grounds;
• the data has been unlawfully processed;
• erasure is required to comply with a legal obligation under EU or Bulgarian law.
We will assess each request and inform you if an exception applies (e.g. where data must be retained for legal claims).
Right to restriction of processing
You may request that we restrict processing of your data (i.e. store it but not otherwise use it) where:
• you contest the accuracy of the data;
• processing is unlawful and you prefer restriction over erasure;
• we no longer need the data but you require it for legal claims;
• you have objected to processing pending verification of our legitimate grounds.
Right to object
You may object at any time to processing based on our legitimate interests, including direct marketing. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
Right to data portability
Where processing is carried out by automated means on the basis of your consent or for the performance of a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller, where technically feasible.
Right to withdraw consent
Where processing is based on your consent, you may withdraw that consent at any time by contacting us at privacy@pureseq.eu. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Right to lodge a complaint
If you believe your rights under the GDPR have been violated, you may lodge a complaint with the Commission for Personal Data Protection (CPDP), Bulgaria’s national supervisory authority:
Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
• Website: www.cpdp.bg
• Email: kzld@cpdp.bg
You may also lodge a complaint with the data protection authority of your country of residence or place of work within the EU.
To exercise any of the above rights, contact us at: privacy@pureseq.eu
5. Is the provision of your personal data voluntary or mandatory?
Where we process personal data on the basis of your consent, provision is entirely voluntary. Declining to provide such data has no negative consequences for you.
Where processing is necessary for the performance of a contract or fulfilment of a legal obligation, failure to provide the required data may make it impossible for us to fulfil that contract or comply with the relevant obligation. In the case of essential cookies, not providing certain data may result in the website not functioning correctly. In other cases, failure to provide data does not adversely affect you but may limit our ability to fulfil our obligations or protect our legitimate interests.
Version: May 1, 2026 | PureSeq OOD | Governed by Bulgarian law and EU GDPR