Privacy Policy
Version 1, effective from 25 September 2026
This policy explains which personal data we process when you shop at flantex.com, use a Flantex business portal, or receive a business message from us, why we do it, and what rights you have.
1. Controller
Flantex VCC, UIC 208985121
Registered office: 620 Arch. Bogdan Tomalevski St., bl. 620, entr. A, fl. 5, apt. 29, Mladost 4, 1715 Sofia
Correspondence address: 620 Arch. Bogdan Tomalevski St., bl. 620, entr. A, fl. 5, apt. 29, Mladost 4, 1715 Sofia
Email: nikolay@flantex.com, phone: +359 876122010
We have not appointed a data protection officer because we are not required to. For any data protection question, write to nikolay@flantex.com.
2. What we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Order fulfilment and delivery | name, delivery address, phone, email, ordered items with entered dimensions and parameters, order history | performance of a contract (GDPR Art. 6(1)(b)) | 3 years after delivery (the legal guarantee period plus one year for possible disputes) |
| Customer account | email, password (hashed), saved configurations | performance of a contract | until you delete the account |
| Sign-in with Google | name, email address and profile picture received from your Google account when you sign in with it | performance of a contract (your account) | until you delete the account |
| Complaints and withdrawals | complaint or withdrawal data, correspondence | legal obligation (complaints register) and performance of a contract | 3 years after the complaint or withdrawal is closed |
| Accounting and tax | data in payment and accounting documents | legal obligation (GDPR Art. 6(1)(c)) | as required by the Bulgarian Accountancy Act (up to 10 years) and VAT Act |
| Correspondence and support | email, name, message content | legitimate interest in answering enquiries (GDPR Art. 6(1)(f)) or performance of a contract | 2 years after the last message |
| Business portals | name, work email, login and activity data (orders, parameter changes) of business customers' staff | legitimate interest in serving the contract with your employer | while the account is active and 1 year after closure |
| Business outreach | name, job title, work email, company | legitimate interest in offering our products to companies that may need them | until you object, or 2 years without a reply |
| Site security | IP address, technical logs | legitimate interest in protecting the site from abuse | up to 90 days |
| Anti-bot check on the contact and complaint forms | IP address and browser signals, processed by Cloudflare Turnstile when you send one of the forms | legitimate interest in keeping the form free of automated abuse | not stored by us |
| Visitor statistics (only with your consent) | address and title of each page visited, without its query string and with order numbers removed, referring site, browser, operating system, device type, approximate location derived by Google from the IP address, time on the page, how far it was scrolled, and the actions counted as described in section 6, linked by the identifier in the Google Analytics cookies | your consent (GDPR Art. 6(1)(a)) | 14 months at Google, then deleted |
The data needed for an order is required to conclude the contract. Without it we cannot fulfil the order.
We do not take decisions based solely on automated processing that produce legal effects for you.
3. Business outreach
We send unsolicited business messages only to company work addresses, never to consumers' personal addresses. We collect contact details from publicly available company sources (websites, professional profiles) and from a business contact data provider (Apollo).
You can object to such messages at any time, using the opt-out link in every message or by writing to nikolay@flantex.com. After an objection we stop using your data for this purpose.
We do not send a newsletter and do not use Shop customers' data for advertising.
4. Who receives data
- DHL: courier delivery (name, address, phone).
- Stripe: card payment processing. Stripe processes payment data as an independent controller; we never receive or store your card details.
- Cloudflare: the anti-bot check on the contact and complaint forms (IP address and browser data). It runs only when you send one of them.
- Google: when you sign in with Google, we receive your name, email address and picture from your Google account. Your Google account itself is covered by Google's privacy policy.
- Google (Google Analytics): visitor statistics, only if you allow them. Google Ireland Limited processes them on our behalf, with every advertising use switched off.
- Hosting provider (Hetzner, servers in the EU): storage of site and portal data.
- Amazon Web Services (SES): sending order emails.
- Google Workspace: business email.
- Apollo: sending business messages to companies.
- Accountant: bookkeeping.
- Public authorities: where the law requires it.
Providers that process data on our behalf are bound by a data processing agreement.
5. Transfers outside the EU
Some providers (Google, Amazon Web Services, Stripe, Cloudflare, Apollo) are US-based or may access data from the US. Transfers rely on a European Commission adequacy decision or on standard contractual clauses approved by the Commission. You can request a copy of the relevant safeguards at nikolay@flantex.com.
6. Cookies and browser storage
The site stores on your device what it needs to work and to provide the service you requested and, only with your consent, the visitor statistics cookies:
| Name | Kind | Purpose | Duration |
|---|---|---|---|
flantex.session_token | cookie | keeping you logged in | 30 days |
flantex_configuration_owner | cookie | linking the parts you configure to your browser, so that only you can add them to your cart | 1 year |
flantex.cart | local storage | keeping your cart | until you empty the cart or clear the site's data |
sveltekit:scroll, sveltekit:snapshot | session storage | returning you to the same place on a page when you go back | until you close the tab |
flantex_lang | cookie | remembering your language | 1 year |
flantex.state | cookie | protecting sign-in with Google against forgery | 5 minutes |
flantex_consent_v3 | cookie | remembering whether you allowed visitor statistics | 6 months |
__stripe_mid, __stripe_sid | cookies set by Stripe on the payment page | preventing card fraud | 1 year, 30 minutes |
_ga, _ga_* | cookies set by Google Analytics, only if you allow statistics | telling your visits apart from other visitors' in the statistics | 6 months |
On the payment page, Stripe's payment form also sets cookies on Stripe's own domains to prevent fraud. Stripe describes them in its own privacy and cookie policies. On the contact and complaint pages, the anti-bot check runs in a frame from Cloudflare, which may keep its own data there. In our check it stored nothing.
Apart from the Google Analytics cookies, this storage is necessary for the site to work, so it needs no consent. We use no advertising cookies or tracking pixels.
Visitor statistics. Only if you allow them, in the banner or with the form at the end of this page, the site counts visits with Google Analytics. Your browser then loads Google's script, which sets the two _ga cookies above and sends Google the address and title of each page you open, without its query string and with order numbers removed, the site you came from without the page on it, the time spent on the page and how far it was scrolled. It also counts six actions: creating an account (by email or with Google), adding a product to the cart (with its product code and material), opening the checkout, paying for an order (with the product codes, materials and quantities ordered), sending the contact form and filing a complaint. These counts carry no amounts, order numbers, names or email addresses. From each request Google derives the browser, operating system, device type and approximate location from the IP address. Google states that Google Analytics does not store IP addresses. Google signals and ad personalisation are switched off, so the statistics are not used for advertising and are not linked to your Google account. Google keeps them for 14 months, then deletes them, and may process them in the US (section 5). You can withdraw your consent at any time with the same form or the Cookie settings link at the bottom of every page. The site then switches Google's script off on the page at once, so nothing more is counted, and deletes its cookies. Your choice is kept for 6 months, then we ask again.
You can delete or block cookies and site data in your browser settings; logging in and the cart will then not work.
7. Your rights
You have the right to:
- access your data and get a copy;
- have inaccurate data corrected;
- have data erased ("right to be forgotten") where we have no ground to keep it;
- restrict processing;
- receive the data you gave us in a machine-readable format and transfer it (portability);
- object to processing based on legitimate interest, and object to processing for direct marketing at any time, without giving a reason;
- withdraw consent where processing is based on consent.
Write to nikolay@flantex.com. We reply without undue delay and within one month at the latest. Exercising your rights is free.
8. Complaints
If you believe we are infringing your rights, you can complain to the Bulgarian Commission for Personal Data Protection:
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, kzld@cpdp.bg, www.cpdp.bg.
You may also complain to the supervisory authority in your EU country of residence.
9. Security
We use encrypted connections (HTTPS), password hashing, restricted access to data and regular backups. If a personal data breach creates a risk for you, we will notify the Commission within 72 hours and, where required, you.
10. Changes
When we change this policy, we publish the new version on the site with its effective date. We notify registered users of significant changes by email.
Cookies and statistics
No choice saved. Statistics stay off until you allow them.