Skip to content
Fast delivery across Bulgaria via Econt
BG EN
Back to home

Privacy Policy & GDPR

Information concerning the processing of personal data in compliance with Regulation (EU) 2016/679 (GDPR).

1. Data Controller Information

The personal data controller responsible for processing your personal data on FyberShop is:

Controller / Platform: FyberShop (fybershop.store)

Data Protection Contact: support@fybershop.store

2. Categories of Personal Data We Process

We collect only the minimum personal data strictly necessary to fulfill your orders, provide customer service, and ensure platform security:

  • Customer Checkout Details: Full name, contact telephone number, and email address.
  • Shipping Destination: Selected city/settlement, Econt Express office or 24/7 locker code/name, or door street address with postal code.
  • User Account & Ratings Data: One-way password hashes (bcrypt/Argon2), saved shipping addresses, order history, and submitted product star ratings and reviews.
  • Technical & Security Logs: IP address, browser type and user-agent, session identifiers, and request timestamps for cybersecurity and abuse prevention.

3. Purposes and Legal Basis for Processing

Performance of Contract (Art. 6(1)(b) GDPR): To process your orders, calculate dynamic courier rates, generate Econt waybills, deliver shipments, and dispatch order confirmation emails.

Legal Obligations (Art. 6(1)(c) GDPR): To comply with statutory tax, invoicing, and accounting obligations under Bulgarian legislation and handle statutory 14-day withdrawal requests.

Legitimate Interests (Art. 6(1)(f) GDPR): To prevent fraud, secure our web application infrastructure, monitor system errors, and defend against potential legal claims.

Consent (Art. 6(1)(a) GDPR): For voluntary customer account registration and the voluntary submission and display of product reviews and star ratings.

4. Sharing Data with Third-Party Processors

To fulfill orders and communicate with you, we transfer specific personal data strictly to authorized sub-processors under binding data processing agreements:

„Еконт Експрес" ООД (Econt Express Ltd.)

Licensed postal operator in Bulgaria. Recipient name, contact phone number, delivery address (office/locker/street), and Cash on Delivery amount are transmitted strictly to calculate rates, create electronic waybills, and execute package delivery.

Email & Transactional Delivery (SMTP):

Customer email addresses are processed solely to send essential transactional messages (order confirmations, dispatch updates with tracking links, and account notices) via queued background workers.

We do not sell, rent, commercialize, or transfer your personal data to marketing third parties or entities outside the European Economic Area (EEA).

5. Data Retention and Security Measures

We retain personal data only for as long as required to fulfill the purposes for which it was gathered:

  • Order & accounting records: Retained for up to 5 to 10 years in compliance with Bulgarian tax and accountancy legislation.
  • Registered user accounts & ratings: Retained until account deletion or rating removal requested by the customer.
  • Technical & security logs: Retained for up to 90 days for cybersecurity and diagnostics.
  • Customer support inquiries: Retained for up to 1 year following the resolution of the ticket.
Security Standards:

All data transmission is encrypted using standard TLS/HTTPS (256-bit). User account passwords are protected using one-way cryptographic hashing (bcrypt/Argon2). Database operations utilize parameterized queries to safeguard against SQL injection, and asynchronous jobs run in isolated queue worker environments.

6. Your Rights Under the GDPR

As a data subject, you hold the following statutory rights under Regulation (EU) 2016/679:

Right of Access Request confirmation and a copy of your personal data processed by us.
Right to Rectification Request correction of inaccurate or incomplete personal details.
Right to Erasure Request erasure ("right to be forgotten") when statutory retention obligations no longer apply.
Right to Restrict & Object Restrict processing or object to processing based on legitimate interests.
Right to Data Portability Receive your provided data in a structured, machine-readable format.
Right to Withdraw Consent Withdraw consent for ratings, reviews, or optional profile data at any time.

To exercise any of these rights, contact our Data Protection team at support@fybershop.store.

You also have the right to lodge a complaint with the Commission for Personal Data Protection (КЗЛД) at cpdp.bg.

7. Cookies and Tracking

FyberShop uses only strictly necessary technical cookies to enable core website functionality: maintaining your shopping cart, user authentication session, and language preference. We do not use third-party tracking or behavioral advertising cookies.

8. Google Sign-In (OAuth) Data

FyberShop (fybershop.store) offers an optional "Continue with Google" sign-in. This section explains exactly what we receive from Google and how we use it.

  • Data we receive from Google: Your public Google profile name, your verified email address, and your Google profile picture (avatar).
  • Purpose of use: Solely to facilitate your registration, authentication (sign-in), and the management of your FyberShop account and orders. We do not request access to your Gmail, Google Drive, contacts, calendar, or any other Google service.
  • Data protection and sharing: Your Google user data is never sold, leased, or transferred to third parties for advertising purposes. It is used solely to identify you as a customer within FyberShop. FyberShop's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
  • Retention and deletion: We keep this data for as long as your account exists. To request deletion of your account and the Google-derived data, email support@fybershop.store from your account email address and we will process the request within 30 days (order and accounting records are retained only as required by law). You can also revoke FyberShop's access at any time at myaccount.google.com/permissions.
Questions regarding your personal data? Contact Store Owner