Privacy Policy

Last updated: 14.10.2026. This English version is a translation for your convenience; the Bulgarian text is the binding one.

This policy explains what personal data the online shop of the Association "Volkswagen Fan Club of Bulgaria" at fanshop.vwclub.bg collects, why it collects it, who it passes it to, how long it keeps it and what rights you have. It applies only to the shop's website. The Club's main website, vwclub.bg, is separate and this policy does not apply to it.

We process your personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, the "Regulation") and the Bulgarian Personal Data Protection Act. We do not sell your personal data or give it to others for their advertising purposes.

1. Who processes your data

The controller of your personal data is the Association "Volkswagen Fan Club of Bulgaria":

• Registered office and address: 113A Tsarigradsko Shose Blvd., Lito Balkan building, floor 3, room 7, 1784 Sofia, Bulgaria
• UIC (EIK): 175251409
• Phone: +359 877 67 67 78
• E-mail: fanshop@vwclub.bg

We refer to it as the "Club" or "we". For any questions about your personal data and to exercise your rights, write to fanshop@vwclub.bg.

2. What data we collect and why

We collect only the data needed for each purpose. For each purpose we also give the legal basis under Art. 6(1) of the Regulation: a contract with you (point (b)), a legal obligation (point (c)) or a legitimate interest (point (f)).

2.1. Orders

When you place an order, you fill in:

• first and last name;
• company name (optional);
• country (Bulgaria);
• phone, so the courier can contact you;
• e-mail address, so we can send you the order confirmation and the invoice, and for bank transfer payments the transfer details;
• delivery point: a courier office, an Econt parcel locker (Econtomat) or your address.

The order also records the products ordered, the prices, the delivery and payment methods, the order date and number, and our correspondence with you about it.

We use this data to accept the order, send you confirmation, prepare and send the parcel, track the payment and contact you if there is a question about the order.

Legal basis: conclusion and performance of the purchase contract (point (b)).

2.2. Delivery

To calculate the delivery price and create the parcel, the shop sends the courier you chose your name, phone, e-mail address and delivery address or office. For cash on delivery, the courier also receives the amount to collect from you.

Legal basis: performance of the contract (point (b)).

2.3. Payment

We do not accept card payments and do not receive any bank card data.

• With cash on delivery you pay the courier when you receive the parcel, and the courier transfers the amount to the Club.
• With bank transfer we receive through the bank the details contained in the transfer: the payer's name, account number (IBAN), the amount and the payment reference (the order number). We use them to match the payment to the order.

If we need to refund you, for example when you withdraw from the contract, for bank transfer payments we refund to the account the transfer came from. For cash on delivery we transfer the money to a bank account you give us, or if you do not want a bank transfer, we send it by postal money order through a courier. For a bank transfer we need the account number and the account holder's name. For a postal money order, the courier receives your name and phone, the address or office to send it to, and the amount.

Legal basis: performance of the contract (point (b)) and our legal obligations to refund amounts paid (point (c)).

2.4. Invoices and accounting

The invoice contains your name or your company's name, the delivery address or the address you send us for the invoice, the purchase details and the other details required by law. If you ask for an invoice in a company's name, we also use the company details you send us by e-mail (UIC, VAT number, address). We send you the invoice at the e-mail address you gave in the order. Invoices and payment documents become part of the Club's accounting records.

Legal basis: legal obligations under the Accountancy Act and tax laws (point (c)).

2.5. Withdrawal, returns and complaints

If you withdraw from the contract, return goods or make a complaint, we use the order details and the details you give us (for example a description of the problem and a bank account for the refund) to deal with your request and meet our obligations. If you withdraw online, we also record the name, order number and e-mail address you entered, and the date and time of the withdrawal. The conditions are described in the Terms and conditions.

Legal basis: performance of the contract and our legal obligations to consumers (points (b) and (c)).

2.6. Shop account

You can shop without an account. If you create an account (on the "My account" page or by ticking the box at checkout), we keep your e-mail address, username, name, saved addresses and order history. You set your own password through a link we send you by e-mail. The password is stored in encrypted form that cannot be read, so we do not know it.

In your account you can see your orders and saved addresses.

Legal basis: performance of the contract for the account you requested (point (b)).

2.7. Enquiries

When you write to us or call us, we receive the details you give us: usually your name, e-mail address or phone and the content of your question. We use them to reply to you.

Legal basis: if the question is about an order, performance of the contract, and if it is about a future purchase, steps you asked for before entering into a contract (point (b)). In all other cases the basis is our legitimate interest in replying to people who contact us (point (f)).

2.8. Technical data

When you visit the website, the hosting company's server automatically records technical data for every request to it:

• the IP address;
• the date and time;
• the page or file opened;
• the amount of data transferred and whether the request succeeded;
• the type and version of the browser and operating system;
• the address of the page you came from.

These records are used for the security and proper running of the website and for detecting errors and misuse. We do not link them with other data to find out who you are, unless this is needed to investigate a specific case of misuse.

For each order, the shop system automatically records the IP address and browser type it was placed from. This helps detect fraudulent orders.

Legal basis: our legitimate interest in protecting the shop from misuse and keeping it running properly (point (f)).

2.9. Protection in a dispute

If a dispute arises over an order, we use the necessary data to protect our rights.

Legal basis: our legitimate interest in protecting our rights (point (f)).

2.10. Automated decisions

We do not make decisions based solely on automated processing of your data, and we do not carry out profiling.

3. Do you have to give us your data?

You are not obliged to give us personal data. However, without a name, phone, e-mail address and delivery point we cannot accept and fulfil the order. An account is optional.

4. Who receives your data

We pass data only to those who need it for the relevant purpose, and only as much as they need:

• The couriers Econt Express OOD or Speedy AD, depending on which you chose: the delivery details from section 2.2, and for refunds by postal money order also the transfer details from section 2.3. They process them as independent controllers, and for cash on delivery they transfer the amount collected to the Club. You can find more about how they process data on their websites econt.com and speedy.bg.
• The hosting company IT Factory EOOD (TheHost.bg), whose servers run the shop's website and database. It processes the data on our behalf.
• The Club's bank, First Investment Bank AD: for bank transfer payments and refunds by bank transfer.
• The people who keep the Club's accounts: the details in invoices and payment documents.
• E-mail providers, through which we send and receive e-mails, including order confirmation e-mails.
• Public authorities, such as the National Revenue Agency, the Consumer Protection Commission, the courts and the prosecutor's office, when the law requires it or in a dispute.

For external services your browser connects to directly, see section 8.

5. Transfers of data outside the European Economic Area

Our main providers (the hosting company, e-mail providers, couriers and bank) are in Bulgaria. If any of our providers processes data outside the European Economic Area (EEA: the EU countries, Iceland, Liechtenstein and Norway), this is done only with the safeguards the Regulation requires, such as a European Commission adequacy decision or standard contractual clauses.

6. How long we keep data

• Order data, including delivery details, IP address and browser type: 5 years from the end of the year in which the order was placed. This is the general limitation period for contract claims. If there is a dispute, we keep it until the dispute is finally resolved.
• Invoices and other accounting documents, including payment details: 10 years from 1 January of the year following the one they relate to (Art. 12 of the Accountancy Act), and where tax laws require a longer period, until it expires.
• Account: until you ask us to close it. Data on orders placed through the account is kept after that for the periods above.
• Enquiries: as long as needed to reply to you and close the matter. If the enquiry relates to an order, we keep it together with the order data.
• Server technical logs: for the period set by the hosting company, unless they are needed to investigate a specific case of misuse.
• Cookies and local storage: as described in section 7.

When these periods expire, we delete the data or anonymise it so that it can no longer be linked to you.

7. Cookies and similar technologies

Cookies are small text files that the website stores in your browser. The website also uses your browser's local storage, which works in a similar way.

The shop uses only cookies and local storage that are needed for it to work or to remember the display you prefer. It does not use external services for visitor statistics, advertising or social media, and it does not send newsletters.

7.1. Basket and order cookies

They remember what you put in your basket and the details you entered until you complete your order. Shopping does not work without them. They are kept for up to 2 days, or up to 7 days if you are logged in to your account.

7.2. Account login cookies

They are set when you log in to your account or create one (the shop then logs you in automatically). They remember that you are logged in, so you don't have to enter your password on every page. They are usually deleted when you close your browser. If you ticked "Remember me" when logging in, or have just created your account, they are kept for up to 14 days. In both cases they are deleted when you log out. The website also sets a temporary cookie that checks whether your browser accepts cookies.

7.3. Website protection cookie

The hosting company sets a cookie that tells real visitors apart from malicious automated programs and protects the website from attacks.

7.4. Remembering the light or dark display

The website stores in your browser's local storage whether you prefer a light or dark display, until you clear your browser data. This information stays on your device and is not sent to us.

7.5. How to manage cookies

You can view, delete or block cookies and local storage in your browser's settings. If you block all cookies for this website, the basket and checkout will not work.

8. External services your browser connects to

Only when you open the map of courier offices at checkout are the map images loaded directly from the servers of the OpenStreetMap Foundation. Your browser then sends OpenStreetMap your IP address, browser details and which website you are viewing. OpenStreetMap can also see which part of the map you are viewing. The Foundation is in the United Kingdom, for which the European Commission has adopted an adequacy decision. It processes this data under its own rules. See the OpenStreetMap Foundation's privacy policy.

Legal basis: our legitimate interest in showing you on a map the courier offices you asked to see (point (f)).

9. Your rights

Regarding your personal data, you have the right to:

• access: find out whether we process data about you, what it is, what we use it for, who we pass it to, where we got it from and how long we will keep it, and get a copy of it;
• rectification: ask us to correct inaccurate data or complete incomplete data;
• erasure: ask us to delete your data when it is no longer needed, when you have objected with good reason, or when it is processed unlawfully. We cannot delete data the law requires us to keep, such as invoices;
• restriction: ask us to stop processing temporarily, for example while we check whether the data is accurate;
• portability: receive the data you gave us for orders and your account in a machine-readable format, or have us send it to another controller where technically possible;
• objection: object to processing based on our legitimate interest, for example of technical data (section 2.8). We then stop, unless we have compelling legal grounds or need the data to defend ourselves in a dispute;
• complaint to the Commission for Personal Data Protection (section 11).

10. How to exercise your rights

Write to us at fanshop@vwclub.bg or by post to the address in section 1. Say what you want and, if the request relates to an order, give its number. To make sure the data goes to the right person, we may ask you to confirm your identity, for example by writing to us from the e-mail address you ordered with.

We reply within one month of receiving the request. If the request is complex or there are many requests, this period may be extended by two further months, and we will tell you so within the first month.

Exercising your rights is free of charge. Only for clearly unfounded or excessive requests, especially repeated ones, may we charge a reasonable fee or refuse.

If you have an account, you can see your orders and saved addresses yourself under "My account".

11. Right to complain

If you believe we are infringing your rights, you can complain to the Commission for Personal Data Protection (CPDP):

• Address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia
• E-mail: kzld@cpdp.bg
• Website: www.cpdp.bg

Under the Personal Data Protection Act, a complaint must be made within six months of learning of the infringement, and no later than two years after it took place. If you live or work in another European Union country, you can also turn to the data protection authority there.

You can also seek protection in court, including compensation for damage.

We would be glad if you wrote to us first, so we can try to resolve the matter together.

12. Security

We protect your data with appropriate technical and organisational measures against unauthorised access, loss, alteration or disclosure. Only the people who handle orders, delivery and accounting have access to order data, and only as far as they need it. Account passwords are stored only in encrypted form.

We will never ask you for your password. Do not send us by e-mail any data that is not needed for the order, such as bank card details.

If, despite these measures, a personal data breach occurs, we will notify the CPDP within 72 hours where the law requires it. If the breach poses a high risk to you, we will also notify you without undue delay.

13. Changes to this policy

We may change this policy when the shop, the services we use or the laws change. The current version is always on this page, and the date of the last update is given at the top. If we decide to use your data for a new purpose, we will tell you in advance.

If you have questions, write to us at fanshop@vwclub.bg.