Product
FeaturesEverything your store can do Design & ThemesReady themes for every niche Integrations & PaymentsCouriers, banks and accounting Move your storeSwitch platforms without losing data
Solutions
For BusinessFor growing and larger stores ClientsStores already running on Plumtex PartnershipWork with us as a partner
Pricing
Resources
Help centerStep-by-step guides FAQQuick answers to common questions ContactWrite or call us Suggest a featureTell us what to build next
Start free
EN / BG

Privacy policy

Last updated:

This policy explains how Plumtex International Ltd. collects and uses personal data when you visit plumtex.com, register an account or use the Plumtex platform. It follows the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Bulgarian Personal Data Protection Act.

1. Controller

Plumtex International Ltd., UIC 208804756, 5A Vili Kazasyan Str., Triaditsa district, 1407 Sofia, Bulgaria, email: [email protected]. You can write to this address with any question about your personal data. The company is not required to appoint a data protection officer (Art. 37 GDPR) and has not appointed one.

2. What data we process

  • Account and billing data: name, email, phone, address, company name, company number, VAT number and the responsible person.
  • Service and payment data: ordered plans and domains, invoices and payment history. Card details are entered at the payment service provider and never reach us.
  • Messages: what you send us through the contact form or by email.
  • Technical data: IP address, browser, device, pages visited and time of access, kept in server logs for security and maintenance.
  • Cookies: only those needed for the site to work, described in the cookie policy.

We receive the data from you. The status of online payments (successful or not, without card details) comes from the payment service provider.

3. Purposes and legal bases

  • Entering into and performing the contract: creating your account, providing the platform, hosting and domain, support and service notices (Art. 6(1)(b) GDPR).
  • Legal obligations: issuing and keeping invoices and accounting documents, answering requests from public authorities (Art. 6(1)(c)).
  • Legitimate interest: platform security, preventing abuse, defending legal claims and improving the service (Art. 6(1)(f)).
  • Consent: marketing messages and newsletters when you subscribed; you can withdraw consent at any time with the unsubscribe link in every email or by writing to us (Art. 6(1)(a)).

Account and billing data are needed to conclude and perform the contract and to issue invoices; without them we cannot provide the service. Providing any other data is voluntary. We do not take decisions based solely on automated processing, including profiling, that have legal effects for you.

4. Data of the stores' buyers

When a store built with Plumtex collects data from its buyers (orders, delivery addresses, accounts), the store owner is the controller of that data. Plumtex is a processor under Article 28 GDPR: it stores and processes the data only to run the store and on the owner's instructions. For questions about that data, contact the store; if you contact us, we will pass your request on to the store owner.

5. Recipients

We share data only as far as needed with:

  • providers of hosting, security and content delivery (including Cloudflare);
  • payment service providers and banks when you pay online;
  • domain registries and registrars when you order a domain (the registry rules require the holder's details);
  • email delivery providers;
  • accountants and legal advisers bound by confidentiality;
  • public authorities where the law requires it.

Fonts and the other resources of the site are served from our own server, with no requests to Google Fonts or other outside services.

6. Transfers outside the EU

Some providers (such as Cloudflare) may process data in the United States. Such transfers rely on the European Commission's adequacy decision on the EU–US Data Privacy Framework or on standard contractual clauses approved by the Commission. You can ask for a copy of the safeguards at the email above.

7. How long we keep data

  • Account and service data — while you have an account and up to 5 years after it is closed, to defend possible claims.
  • Invoices and accounting documents — 10 years, as the Bulgarian Accountancy Act requires.
  • Contact form messages — up to 2 years.
  • Server logs — up to 6 months, unless needed to investigate an incident.

8. Your rights

You have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, to object to processing based on legitimate interest and to withdraw consent. To use these rights, write to [email protected]. We answer within one month, which may be extended by two further months for complex or numerous requests, in which case we tell you. Using your rights is free of charge.

You can complain to the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg, [email protected].

9. Security

We use an encrypted connection (HTTPS), restricted staff access, two-factor authentication and regular updates to protect data from unauthorised access, loss or change.

10. Children

The services are meant for adults who can enter into contracts. We do not knowingly collect data from children.

11. Changes

We may update this policy. The date of the last change is shown at the top of the page, and registered customers are told about material changes by email.