Privacy policy

1. Data controller

The trader is not required to appoint a data protection officer. All enquiries are handled by the contact stated above.

• Trade mark: TITAN LABS
• Contact for personal data matters: support@titanlabs.bg · 0888 089 099 · 0895 749 130

2. What data we process

We do not deliberately collect special categories of data. If you state health information in a note to an order or in a message, it is processed only in order to handle your specific enquiry.

• Order data: name, email, phone, delivery address or selected courier office, the content and value of the order, notes to the order.
• Invoice data, when requested: company name, company number, VAT number, responsible person, address.
• Customer account data: email, name, encrypted (hashed) password and, when signing in with Google, the account identifier and email from Google.
• Newsletter subscription data: email address.
• Customer review data: name, rating, text and, optionally, a photo.
• Correspondence: messages sent through the contact form or by email.
• Technical data: IP address, browser and device type, date and time of the request, technical security logs, and data from cookies where consent is given.
• Data on the origin of the order, where consent for analytics cookies is given: the advertising tag in the address you arrived by, or the site that referred you. It is kept with the order so that we know which advert works.

3. Purposes and legal bases

• Fulfilling an order, delivery, service and returns - the processing is necessary for the performance of a contract (Article 6(1)(b) GDPR).
• Issuing and keeping invoices and accounting documents - compliance with a legal obligation (Article 6(1)(c) GDPR).
• Customer account - performance of a contract and your consent at registration.
• Newsletter and marketing messages - your consent (Article 6(1)(a) GDPR), which can be withdrawn at any time.
• Anonymous visit statistics without cookies (Google Analytics in a storage-free mode) - legitimate interest (Article 6(1)(f) GDPR).
• Analytics and marketing cookies (Google Analytics, Meta Pixel) - your consent, given through the cookie banner.
• Session recording on the site (Microsoft Clarity) - your consent, given through a separate dialog, which can be withdrawn at any time.
• Publishing reviews - your consent and the legitimate interest in reliable product information.
• Site security, prevention of abuse and defence of legal claims - legitimate interest (Article 6(1)(f) GDPR).

4. Who we share data with

Data is shared only with parties involved in fulfilling the order or in maintaining the shop, and only to the extent necessary. All processors act under a contract and on our instructions.

• euShipments.com - warehouse processing and preparation of the parcels.
• Спиди АД - delivery of the parcels and collection of the amount due on cash on delivery.
• Hostinger - hosting of the site, the database and the email service.
• Payment service provider - for card payments, when that option is active.
• Google - when signing in with a Google account, and Google Analytics where consent for analytics cookies is given.
• Meta Platforms - where consent for marketing cookies is given.
• Microsoft - where consent for session recording on the site (Microsoft Clarity) is given.
• Accounting services, and state authorities where the law requires it.

5. Transfers outside the European Union

As a rule the data is processed within the European Union. Where a provider processes data outside the EU, this takes place on the basis of an adequacy decision of the European Commission or of standard contractual clauses together with additional technical measures.

6. Retention periods

• Accounting documents, including invoices - 10 years, under the Bulgarian Accountancy Act.
• Order data without an invoice - 5 years from fulfilment, in view of the limitation periods for possible claims.
• Customer account - until you delete it or after 3 years of inactivity.
• Newsletter consent and the related data - until the consent is withdrawn.
• Reviews - while they are published or until a deletion request.
• Technical logs - up to 12 months.

7. Your rights

Rights are exercised by a request to support@titanlabs.bg. We reply within one month, which may be extended by a further two months for complex requests, of which you will be informed.

Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, Bulgaria, phone +359 2 915 3518, kzld@cpdp.bg, cpdp.bg

• Access to the data processed about you and a copy of it.
• Rectification of inaccurate or incomplete data.
• Erasure (the “right to be forgotten”), where there is no legal ground for further storage.
• Restriction of processing.
• Portability of the data you have provided, in a machine-readable format.
• Objection to processing based on legitimate interest, and to direct marketing at any time.
• Withdrawal of consent at any time, without affecting the lawfulness of the processing up to that moment.
• A complaint to the supervisory authority.

8. Automated decision-making

We do not carry out automated decision-making or profiling that produces legal effects for you or significantly affects you.

9. Security

The connection to the site is encrypted (HTTPS). Passwords are stored in hashed form only. Access to the administration panel is restricted, protected by individual accounts and by protection against repeated login attempts.

10. Children

The shop is not intended for persons under 16 and we do not knowingly collect their data. Food supplements are not recommended for children without medical advice.

11. Changes to this policy

When this policy changes we publish the current version on this page with a new update date. For material changes we will notify you in an appropriate way.