PRIVACY POLICY AND PERSONAL DATA PROTECTION

of S & K Company Ltd.

Last updated: August 2026

1. General Provisions

This Privacy Policy governs the manner in which S & K Company Ltd. collects, processes, stores, uses, and protects the personal data of its customers, suppliers, business partners, and visitors to all websites, online stores, and electronic services operated by the Company.

This Policy has been prepared in accordance with:

Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR);
the Bulgarian Personal Data Protection Act;
the Bulgarian Consumer Protection Act;
the Bulgarian Electronic Commerce Act;
the Bulgarian Accountancy Act;
and all applicable European Union and Bulgarian legislation.

By accessing or using any website operated by S & K Company Ltd., you acknowledge that you have read and accepted the terms of this Privacy Policy.

2. Data Controller

The Data Controller responsible for the processing of personal data is:

S & K Company Ltd.

UIC (Company Registration Number): 205858656

Registered office and business address:

26 Pop Gruyo Street

Floor 1, Office 2

1517 Sofia

Bulgaria

Website:

www.syc-company.eu

E-mail:

marketing@syc-company.eu

The Data Controller determines the purposes and means of processing personal data and is responsible for ensuring that such processing is lawful and compliant with applicable legislation.

3. Scope of this Privacy Policy

This Privacy Policy applies to all websites, online stores, and electronic services owned or operated by S & K Company Ltd.

4. Principles of Personal Data Processing

When processing personal data, the Company complies with the following principles:

lawfulness;
fairness;
transparency;
purpose limitation;
data minimization;
accuracy;
storage limitation;
integrity;
confidentiality;
accountability.

Personal data is processed only to the extent necessary for the performance of legal obligations, contractual relationships, or the provision of requested services.

5. Categories of Personal Data Processed

Depending on the services used, the following categories of personal data may be processed.

Identification Data

first name;
last name;
company name;
Company Registration Number (UIC);
VAT number;
contact person.

Contact Information

postal address;
telephone number;
mobile phone number;
e-mail address.

Order Information

purchased products;
order history;
invoices;
payment method;
delivery method;
warranty and complaint information.

Technical Information

IP address;
browser type;
operating system;
device type;
country;
preferred language;
date and time of access;
referral source.

Cookie Data

session identifiers;
preferred language;
shopping cart contents;
account preferences;
analytical information.

6. Purposes of Processing

Personal data is processed for the following purposes:

customer registration;
order processing;
delivery of products;
issuing invoices and accounting documents;
warranty service;
handling complaints and claims;
customer support;
technical support;
sending order-related notifications;
sending newsletters where consent has been provided;
statistical analysis;
improving the quality of services;
preventing fraud and abuse;
protecting the Company's legitimate interests;
complying with legal obligations.

7. Legal Basis for Processing

Personal data is processed only where at least one of the following legal grounds applies:

performance of a contract;
taking steps prior to entering into a contract;
compliance with a legal obligation;
protection of vital interests;
performance of a task carried out in the public interest;
legitimate interests pursued by the Company;
freely given consent.

Where processing is based on consent, such consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

8. Retention of Personal Data

S & K Company Ltd. retains personal data only for as long as necessary to fulfill the purposes for which it was collected or for the period required by applicable law.

Retention periods vary depending on the type of data and the legal basis for processing.

In particular:

customer account data – until the account is deleted or until the applicable legal retention period expires;
accounting records and invoices – 10 years in accordance with the Bulgarian Accountancy Act;
warranty and complaint documentation – until the procedure is completed and for the legally required retention period;
e-mail correspondence – until the relevant inquiry has been resolved or for as long as necessary;
data processed based on consent (e.g. newsletters) – until consent is withdrawn;
technical logs and security-related data – for the period necessary to ensure information security and prevent abuse.

After the applicable retention period expires, personal data will be securely deleted or anonymized where permitted by law.

9. Recipients of Personal Data

Personal data may be disclosed only where necessary for the performance of a contract, compliance with a legal obligation, or the protection of the Company's legitimate interests.

Depending on the specific service, personal data may be shared with:

courier and delivery companies;
payment service providers and banks;
accounting and auditing firms;
hosting and IT service providers;
e-commerce software providers;
public authorities where required by law;
legal advisors where necessary to protect the Company's legitimate interests.

All processors act under contractual obligations and are required to maintain an appropriate level of data protection.

10. International Transfers of Personal Data

In certain cases, personal data may be processed outside the European Economic Area by service providers.

Where such transfers occur, S & K Company Ltd. ensures that appropriate safeguards are in place, including:

adequacy decisions adopted by the European Commission;
Standard Contractual Clauses (SCCs);
other transfer mechanisms provided for under Regulation (EU) 2016/679.