Privacy policy
What personal data expo.rentals collects, on what grounds, how long we keep it, who receives it and what rights you have.
1. Who processes your data
The controller of personal data is SPUKI EOOD, company number 207218740, VAT number BG207218740, represented by Nikolay Bliznakov, with address and base in Sofia, 24 Dimitur Mollov str., Sofia.
Contact for data protection matters: email mail@expo.rentals, phone +359 87 996 1450, Mon–Fri 09:00–18:00, Sat until 13:00.
This policy describes what data we collect through expo.rentals, why we collect it, how long we keep it and what rights you have. It is written in the spirit of the General Data Protection Regulation.
2. What data we collect
- Contact details — name, email, phone. Needed so we can answer an enquiry and confirm an order.
- Delivery address — town, street address or courier office, name and phone of the person receiving the shipment. Needed to send out and collect rental items.
- Invoicing details — company name, company number, VAT number, registered address, authorised representative. For individuals — name and address.
- Order data — the products chosen, the rental dates, the delivery method, amounts, deposit, and the correspondence about the order.
- Print files — the files you upload or send for printing. They can contain personal data if you put it in the design, for example names and phone numbers on business cards.
- Technical data — IP address, device and browser type, pages visited, data from cookies.
We do not collect special categories of data and we do not ask for them. We do not store bank card data — payment is made against a proforma invoice.
3. The legal grounds we rely on
- Performance of a contract — to hand over a rented display, to print your material, to arrange delivery and return, and to handle the deposit.
- Legal obligation — accounting and tax reporting, issuing and keeping invoices.
- Legitimate interest — site security, fraud prevention, defending our rights in a dispute, internal statistics in aggregated form.
- Consent — for optional cookies and for marketing messages, if you signed up for them. You can withdraw consent at any time.
4. How long we keep the data
| Type of data | Retention period |
|---|---|
| Accounting and tax documents (invoices, proformas) | 10 years, as required by law |
| Data on a completed order and its correspondence | up to 5 years after the order is closed |
| Print files | up to 12 months after production, so you can reorder without uploading again |
| Enquiries that did not become orders | up to 12 months |
| Technical site logs | up to 12 months |
| Consent for marketing messages | until you withdraw it |
If you want your print files deleted earlier, write to us and we delete them, unless they form part of a document we are required to keep.
5. Who receives the data
We do not sell data and we do not pass it to third parties for advertising. We share it only with providers without whom the service cannot be delivered:
- Courier companies — Speedy and Econt. They receive a name, a phone number and the address for delivery or collection.
- Accounting service — receives the data contained in invoices and proformas.
- Hosting provider — stores the site, the database and the uploaded files.
- Payment provider — processes the payment by the chosen method.
- Public authorities — only where we have a legal obligation to provide information.
Each of these recipients processes the data only for the purpose it was given to them for.
6. Cookies
The site uses cookies that are necessary for it to work — language, cart contents, session and protection against abuse. These do not require consent.
Optional cookies for statistics and measurement are loaded only after consent. You can refuse or withdraw consent, and you can delete cookies from your browser settings. If you delete the necessary cookies, the cart and the language choice may be lost.
7. Transfers outside the European Union
We aim to work with providers inside the European Union. If a specific service requires a transfer of data outside the EU and the European Economic Area, it happens only on an appropriate basis — an adequacy decision or standard contractual clauses.
8. Automated decision-making
We do not carry out automated decision-making or profiling with legal effects for you. The calculator on the site computes a price from published rules, and that is not a decision about an individual person.
9. Your rights
- Access — to be told what data about you we process and to receive a copy of it.
- Rectification — to correct inaccurate or incomplete data, for example invoicing details.
- Erasure — to ask for deletion where there is no ground for us to keep the data.
- Restriction of processing — in the cases provided for by the regulation.
- Portability — to receive the data you gave us in a structured, machine-readable format.
- Objection — to processing based on legitimate interest.
- Withdrawal of consent — at any time, without affecting the lawfulness of processing before the withdrawal.
- Complaint — to the Bulgarian Commission for Personal Data Protection, and to the courts.
10. How to exercise your rights
Write to mail@expo.rentals describing your request. If we cannot identify you from the details in the request, we may ask for additional information so that we do not hand data to the wrong person.
We reply within the period set by the regulation. For simple enquiries we normally reply much sooner — within 2 working hours during business hours.
11. Security
Access to the data is limited to the people who fulfil the orders. Print files are kept in a separate storage location and used only for the order they belong to. When deletion is requested, they are also removed from backups at their next refresh.
12. Changes to this policy
This policy may be updated. The version published on the site at the time of your visit is the one that applies.
Note
This text is a sample. It was prepared as a working draft for the needs of the site and is subject to review and approval by a lawyer before the site goes into real operation.
