Privacy Policy

The controller of your personal data is: - MMC KLIMATIZATSIYA OOD - UIC 205247914 / VAT no. BG205247914 - Registered seat: Gabrovo, ul. "Zelena livada" 16 - Gabrovo office: Gabrovo Center, ul. "Orlovska" 33, 5300 Gabrovo, Bulgaria - Troyan office: ul. "Vasil Levski" 147, Troyan - Email: office@mmc-klima.com - Phone: 0898 730 858 · 0896 447 252

For any question about how we process your personal data, or to exercise your rights, contact us at the details above.

We collect only the data necessary for a specific, clearly defined purpose:

Identification and contact data: - First name and last name - Email address - Phone number - Delivery address (street, number, floor, postal code, city)

Order-related data: - The products and services you ordered - Order value and currency - Chosen fulfilment method (office pickup, delivery, delivery with installation) - Notes you provide with the order - Order number and date

Communication data: - Content of emails you send us - Notes from phone conversations with our team - Enquiries, quotes and service requests

Technical data: - IP address and device / browser information - Essential cookies needed for the site to work - Anonymous usage analytics (only with your consent)

We do not process "special categories" of personal data within the meaning of Art. 9 GDPR (health, political views, religious beliefs, etc.).

We process your personal data only when we have a specific purpose and a valid legal basis under Article 6 GDPR:

• Order fulfilment and delivery — basis: performance of a contract (Art. 6(1)(b));
• Invoicing and accounting records — basis: legal obligation (Art. 6(1)(c)) — Bulgarian Accountancy Act, VAT Act;
• Warranty and service work — basis: performance of a contract;
• Communication and customer support — basis: legitimate interest in responding to your enquiries (Art. 6(1)(f));
• Marketing messages (promotions, offers) — basis: explicit consent (Art. 6(1)(a)), which you can withdraw at any time;
• Site security and fraud prevention — basis: legitimate interest;
• Defence against disputes and legal claims — basis: legitimate interest.

We do not sell or rent your personal data. We share it only with trusted partners needed to deliver the service, under a data processing agreement:

• Courier company — name, phone and delivery address, only when you choose home delivery;
• Bank (UBB AD) — only the order number, shown as the reference on your bank transfer;
• Accounting service — invoice data, to the extent required by law;
• Hosting and cloud providers (e.g. Vercel, Upstash) — process the data only on our behalf for technical reasons;
• Google Maps — only when you open an embedded map; see Google's privacy policy;
• Government authorities — only on explicit legal request or court order.

We keep your personal data only for as long as necessary, and no longer:

• Order and invoice data — 10 years (Bulgarian Accountancy Act);
• Warranty service data — for the warranty term plus 3 years;
• Communication (emails, tickets) — 2 years after the last activity;
• Marketing data — until you withdraw consent or 3 years without activity;
• Technical logs and cookies — up to 12 months;
• Inactive customer data — deleted after 5 years without an order.

After these periods expire, the data is securely deleted or anonymised.

As a data subject you have the following rights, which you can exercise at any time, free of charge and without giving a reason:

• Right of access (Art. 15) — to receive a copy of the personal data we process about you;
• Right to rectification (Art. 16) — to have inaccurate data corrected;
• Right to erasure ("right to be forgotten", Art. 17) — to have your data deleted, except where we are legally required to keep it;
• Right to restriction (Art. 18) — to limit processing for a specified period;
• Right to data portability (Art. 20) — to receive your data in a machine-readable format and transfer it to another controller;
• Right to object (Art. 21) — to processing based on "legitimate interest" or for direct marketing;
• Right to withdraw consent — at any time, without affecting the lawfulness of past processing;
• Right to lodge a complaint with a supervisory authority — see section 12.

To exercise any of these rights, send a written request to office@mmc-klima.com. We respond within 30 days.

We use several types of cookies:

• Essential cookies (always active) — needed for the site to work (cart, language preference, your session). Without these the site cannot function;
• Analytics cookies (optional) — help us understand how the site is used, in aggregated and anonymous form. Activated only with your consent through the cookie banner;
• Third-party cookies — loaded only when you actively use the relevant feature (e.g. when you open a map of our offices — Google Maps cookies).

You can manage cookies through your browser settings. Note that disabling essential cookies may break the site's functionality.

We apply appropriate technical and organisational measures to protect your personal data:

• Encrypted connection (HTTPS / TLS) for all traffic to the site;
• Encryption of sensitive data at rest;
• Access control — data is visible only to staff with a specific need to know;
• Regular infrastructure updates and vulnerability checks;
• Data processing agreements with every external provider.

In the event of a security incident that may result in a high risk to you, we will notify you within 72 hours, in line with Art. 33 and Art. 34 GDPR.

Our services are intended for individuals aged 18 and over. We do not knowingly process personal data of children under 16. If you discover that we have received such data without parental consent, please contact us at office@mmc-klima.com and we will delete it immediately.

We store your data within the European Union. When we use service providers outside the EU/EEA (for example for hosting or analytics), we ensure an adequate level of protection through:

• Standard Contractual Clauses approved by the European Commission;
• Data protection certifications (e.g. the EU-U.S. Data Privacy Framework, where applicable);
• Additional technical measures such as pseudonymisation and encryption.

We may update this Privacy Policy to reflect changes in legislation, our services, or how we process data. The current version is always available on this page. For material changes, we will notify you by email (where we have contact details) or with a clear notice on the site.

For any questions, requests or complaints about how we process your personal data:

• Email: office@mmc-klima.com
• Phone: 0898 730 858
• Address: Gabrovo Center, ul. "Orlovska" 33, 5300 Gabrovo, Bulgaria

You also have the right to lodge a complaint with the supervisory authority in Bulgaria: - Commission for Personal Data Protection (CPDP) - Address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria - Phone: +359 2 915 3518 - Email: kzld@cpdp.bg - Website: www.cpdp.bg