Privacy Policy

Last updated: 14 July 2026

This Privacy Policy explains how GENTEK EOOD, operating the website balkantitles.com, collects, uses, stores and protects your personal data.

We process personal data in accordance with Regulation (EU) 2016/679, known as the General Data Protection Regulation (“GDPR”), the Bulgarian Personal Data Protection Act and other applicable legislation.

1. Data Controller

The controller responsible for processing your personal data is:

GENTEK EOOD
UIC: 175399870
VAT number: BG175399870

Registered office and management address:
35A Kazbek Street
Manastirski Livadi – West
Vitosha District
1618 Sofia
Bulgaria

Email: info@balkantitles.com
Website: https://balkantitles.com/

For questions concerning this Privacy Policy or the processing of your personal data, please contact us at info@balkantitles.com.

2. Personal Data We Collect

Depending on how you use the website and our services, we may collect the following categories of personal data:

2.1. Identification and contact information

This may include:

  • First and last name;

  • Billing and delivery address;

  • Email address;

  • Telephone number;

  • Country and postal code;

  • Company name, UIC and VAT number, where applicable.

2.2. Order and personalisation information

When you place an order, we may collect:

  • The products you purchase;

  • Information required to personalise a certificate or gift;

  • The name of the gift recipient;

  • A personal message, dedication or other text provided by you;

  • Selected delivery and gift-wrapping options;

  • Order history and correspondence relating to the order.

Please only provide personal data about another person when you have the right to do so and when that person could reasonably expect their information to be used for preparing and delivering the requested personalised product.

2.3. Payment information

Payments may be processed through banks, card payment providers, electronic payment platforms or other payment service providers.

We generally do not receive or store complete payment-card details. Such information is processed directly by the relevant payment service provider. We may receive limited transaction information, such as:

  • Payment status;

  • Transaction reference;

  • Payment method;

  • Amount paid;

  • Date and time of payment;

  • Limited payment identifiers.

2.4. Communications

When you contact us through the website, by email, telephone or another communication channel, we may collect:

  • Your contact details;

  • The content of your enquiry;

  • Order references;

  • Any documents or information you voluntarily provide;

  • Our correspondence with you.

2.5. Technical and usage information

When you visit the website, certain technical information may be collected automatically, including:

  • IP address;

  • Browser type and version;

  • Device type;

  • Operating system;

  • Language settings;

  • Pages visited;

  • Date, time and duration of visits;

  • Referring website;

  • Cookie identifiers;

  • Information about interactions with the website.

Some of this information may be collected through cookies and similar technologies. Further information is provided in our Cookie Policy and cookie consent settings.

3. How We Collect Personal Data

We may collect personal data:

  • Directly from you when you place an order;

  • When you complete a contact, checkout or registration form;

  • When you communicate with us;

  • When you subscribe to marketing communications;

  • Automatically through cookies and similar technologies;

  • From payment providers, banks, delivery companies and other service providers involved in fulfilling your order;

  • From publicly available sources where legally permitted.

4. Purposes and Legal Bases for Processing

We process personal data only when we have a valid legal basis.

4.1. Processing and fulfilling orders

We use your personal data to:

  • Accept and process orders;

  • Prepare personalised certificates and gifts;

  • Confirm orders and payments;

  • Deliver purchased products;

  • Provide order-related customer support;

  • Handle cancellations, returns, complaints and refunds.

The legal basis is the performance of a contract with you or taking steps at your request before entering into a contract.

4.2. Processing payments

We process transaction-related information to receive and verify payments, prevent payment fraud and handle refunds.

The legal basis is the performance of our contract with you and our legitimate interest in securing transactions and protecting the business against fraud.

4.3. Delivery of products

We may share the information required for delivery with postal operators, courier companies and fulfilment providers.

The legal basis is the performance of our contract with you.

4.4. Customer service and communications

We process your information to answer questions, provide information about products and services, resolve problems and communicate about existing or potential orders.

The legal basis may be:

  • Taking steps at your request before entering into a contract;

  • Performance of a contract;

  • Our legitimate interest in providing effective customer service;

  • Your consent, where required.

4.5. Accounting and legal obligations

We process and retain information contained in invoices, accounting documents and transaction records to comply with Bulgarian and European tax, accounting, consumer protection and other legal requirements.

The legal basis is compliance with a legal obligation.

4.6. Website security and fraud prevention

We may process technical, transaction and account information to:

  • Protect the website and its users;

  • Prevent fraud, abuse and unauthorised access;

  • Detect technical problems;

  • Maintain backups and security logs;

  • Establish, exercise or defend legal claims.

The legal basis is our legitimate interest in maintaining the security, integrity and proper operation of our website and services.

4.7. Website analytics and improvement

Where permitted by law, we may use analytics tools to understand how visitors use the website, improve its structure and content, measure performance and identify technical issues.

Where analytics technologies are not strictly necessary, they will be used on the basis of your consent.

4.8. Marketing communications

With your consent, we may send you information about products, special offers, promotions and news.

You can withdraw your consent at any time by:

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

4.9. Personalised advertising

Subject to your consent, advertising and social media technologies may be used to:

  • Measure the effectiveness of advertising;

  • Display relevant advertisements;

  • Create audiences based on website activity;

  • Limit how often advertisements are shown.

You can manage these technologies through the website’s cookie consent settings.

5. Cookies and Similar Technologies

The website may use cookies, pixels, local storage and similar technologies.

Cookies may be classified as:

  • Strictly necessary cookies, required for core functions such as the shopping cart, checkout, security and cookie preferences;

  • Functional cookies, used to remember settings and improve functionality;

  • Analytics cookies, used to measure website traffic and performance;

  • Advertising cookies, used to measure campaigns and deliver personalised advertising.

Strictly necessary cookies may be placed without consent where permitted by law. Non-essential cookies will only be activated after you provide consent through the cookie banner or consent management tool.

You may change or withdraw your consent at any time through the website’s cookie settings. You may also restrict cookies through your browser, although disabling certain cookies may affect the website’s functionality.

More detailed information should be provided in the website’s separate Cookie Policy.

6. Recipients of Personal Data

We may disclose personal data only where necessary and legally permitted.

Recipients may include:

  • Hosting and website maintenance providers;

  • E-commerce and content-management service providers;

  • Payment processors, banks and financial institutions;

  • Courier companies, postal operators and fulfilment providers;

  • Accounting, legal and professional advisers;

  • Email and communication service providers;

  • Analytics, security and fraud-prevention providers;

  • Advertising and social media platforms, where you have consented;

  • Public authorities, courts, regulators or law-enforcement bodies where required by law;

  • Business successors in connection with a lawful merger, acquisition, restructuring or transfer of business assets.

Service providers acting on our behalf may process personal data only according to our instructions, under appropriate contractual obligations and with suitable security measures.

We do not sell your personal data.

7. International Data Transfers

Some service providers may process personal data outside Bulgaria or outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, we take appropriate safeguards as required by the GDPR. These may include:

  • A decision of the European Commission recognising an adequate level of protection;

  • Standard Contractual Clauses approved by the European Commission;

  • Additional technical and organisational safeguards;

  • Another lawful transfer mechanism under the GDPR.

You may contact us for further information about the safeguards applicable to a particular transfer.

8. Retention of Personal Data

We retain personal data only for as long as necessary for the purposes for which it was collected and to comply with legal obligations.

Generally:

  • Order and contract information is retained for the duration of the contractual relationship and for the applicable limitation periods;

  • Invoices, accounting records and legally required transaction documents are retained for the periods required under Bulgarian tax and accounting legislation;

  • Customer-service correspondence is normally retained for up to three years after the enquiry is resolved, unless a longer period is necessary;

  • Information relating to disputes, complaints or legal claims may be retained until the relevant proceedings and limitation periods have expired;

  • Marketing information is retained until you withdraw your consent or object to the processing;

  • Cookie and analytics information is retained according to the duration stated in the Cookie Policy or cookie consent tool;

  • Security logs are retained for a limited period unless they are required to investigate an incident.

When personal data is no longer required, it will be deleted, anonymised or securely destroyed.

9. Is Providing Personal Data Mandatory?

Certain information is required to process an order, prepare a personalised product, issue an invoice, receive payment and arrange delivery.

Where information is marked as mandatory, failure to provide it may mean that we cannot accept or fulfil your order.

Providing data for marketing, analytics and personalised advertising is voluntary and is based on your consent where required.

10. Automated Decision-Making

We do not normally make decisions that produce legal or similarly significant effects concerning you solely through automated processing.

Payment processors, fraud-prevention providers or banks may use automated systems to assess transactions. Where applicable, their processing is governed by their own privacy notices.

11. Your Data Protection Rights

Subject to the requirements and limitations of applicable law, you have the following rights:

11.1. Right of access

You may request confirmation as to whether we process your personal data and obtain a copy of that data.

11.2. Right to rectification

You may request correction of inaccurate or incomplete personal data.

11.3. Right to erasure

You may request deletion of your personal data where there is no longer a lawful reason for us to retain it.

This right does not apply where processing is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

11.4. Right to restriction of processing

You may request that we temporarily restrict the use of your personal data in certain circumstances.

11.5. Right to data portability

Where processing is based on consent or a contract and is carried out by automated means, you may request your personal data in a structured, commonly used and machine-readable format.

11.6. Right to object

You may object to processing based on our legitimate interests. We will stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing is required for legal claims.

You have the right to object to direct marketing at any time.

11.7. Right to withdraw consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

11.8. Right to lodge a complaint

You have the right to lodge a complaint with the Bulgarian supervisory authority:

Commission for Personal Data Protection
2 Prof. Tsvetan Lazarov Boulevard
1592 Sofia
Bulgaria

You may also contact the competent supervisory authority in the EU or EEA country where you live, work or believe an infringement has occurred.

12. Exercising Your Rights

To exercise your rights, contact us at:

info@balkantitles.com

Please clearly describe your request. We may ask for additional information to verify your identity and ensure that personal data is not disclosed to an unauthorised person.

We normally respond within one month of receiving a valid request. This period may be extended by up to two additional months where permitted by the GDPR, taking into account the complexity and number of requests. We will inform you if an extension is necessary.

Requests are generally handled free of charge. However, where a request is manifestly unfounded or excessive, particularly because it is repetitive, we may charge a reasonable fee or refuse to act, as permitted by law.

13. Security of Personal Data

We apply appropriate technical and organisational measures designed to protect personal data against:

  • Unauthorised access;

  • Accidental or unlawful destruction;

  • Loss or alteration;

  • Unauthorised disclosure;

  • Misuse or unlawful processing.

These measures may include access controls, encryption, secure connections, backups, security monitoring, software updates and restrictions on access to personal data.

No online system can be guaranteed to be completely secure. You should also take appropriate precautions, such as protecting your account credentials and using secure devices and networks.

14. Children’s Privacy

Our website and services are not directed specifically at children.

Orders should be placed by persons who have the legal capacity to enter into a contract or by a parent or legal guardian. We do not knowingly collect personal data directly from children without an appropriate legal basis.

A purchaser may provide a child’s name for the personalisation of a gift or certificate. In such cases, the purchaser is responsible for ensuring that they are authorised to provide that information.

15. Third-Party Websites and Services

The website may contain links to third-party websites, payment services, social networks or other external platforms.

We are not responsible for the privacy practices, security or content of third-party services. We recommend reviewing their privacy policies before providing personal data.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our services, technologies, legal requirements or data-processing practices.

The current version will be published on this page with an updated revision date. Where changes are significant, we may provide an additional notice through the website or another appropriate communication channel.

17. Contact Us

For questions, requests or complaints concerning personal data, contact:

GENTEK EOOD
UIC: 175399870
VAT number: BG175399870

35A Kazbek Street
Manastirski Livadi – West
Vitosha District
1618 Sofia
Bulgaria

Email: info@balkantitles.com
Website: https://balkantitles.com/