Privacy policy

Last updated: 18 July 2026

Data controller

OfficeLabs Co is the controller of personal data within the meaning of the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

This policy describes what personal data we collect, why, and how we protect it when you use our website or place an order with us.

What data we collect

Data you provide when placing an order

  • Full name, email address, phone number
  • Delivery address (city, street, postcode)
  • Company details when you request an invoice (company name, UIC, VAT number, company representative)
  • Chosen courier, delivery method and payment method

Technical data collected automatically

  • IP address and approximate location (country, city)
  • Browser type and version
  • The page you came from
  • Preferred browser language
  • Time zone

Marketing data (UTM)

When you visit from an advertising link, we store UTM parameters solely to analyse the effectiveness of our marketing channels.

Cart data

The contents of your cart are stored locally in your browser and are not sent to our servers until you complete an order.

How we use the data

Fulfilling orders

Personal data from an order is used exclusively to process and deliver the order, to issue an invoice on request, and to communicate about the status of the delivery.

Email notifications

We send an order confirmation by email immediately after you place an order. We do not send marketing emails without your explicit consent.

Improving the service

Technical data (IP, browser, UTM) is used anonymously to analyse traffic, improve the website and prevent abuse.

Legal obligations

We keep order data (including invoices) for 5 years, as required by the Corporate Income Tax Act and the VAT Act.

Legal basis (GDPR)

We process your personal data on the following legal bases:

  • Performance of a contract — Art. 6(1)(b) GDPR — data necessary to process and deliver your order.
  • Legal obligation — Art. 6(1)(c) GDPR — data necessary for accounting and tax reporting.
  • Legitimate interest — Art. 6(1)(f) GDPR — technical data for security and abuse prevention; UTM data to assess marketing effectiveness.

Sharing with third parties

We do not sell or rent out your personal data. Data may only be shared with:

Courier companies

We pass your full name, address and phone number to the chosen courier solely to carry out the delivery.

Public authorities

We may disclose data to competent authorities where we are required to do so by law (e.g. the National Revenue Agency, courts, prosecutors).

All our providers are bound by contractual data protection obligations and have adopted the European Commission's standard contractual clauses or provide an adequate level of protection.

Cookies

The site uses a minimal number of cookies that are necessary for it to work. We do not use tracking or advertising cookies.

Local storage

The shopping cart is stored in the localStorage of your browser under the key officelabsco-cart. This data is not sent to our servers and is deleted when you clear your browser data.

You can disable or delete cookies in your browser settings. Note that disabling them may affect the functionality of the site.

Your rights

As a data subject under the GDPR you have the following rights:

  • Right of access (Art. 15) — to receive information about what data we process about you.
  • Right to rectification (Art. 16) — to ask us to correct inaccurate data.
  • Right to erasure (Art. 17) — to ask us to delete your data, unless we are legally required to keep it.
  • Right to restriction (Art. 18) — to ask us to restrict processing in certain circumstances.
  • Right to data portability (Art. 20) — to receive your data in a structured, machine-readable format.
  • Right to object (Art. 21) — to object to processing based on legitimate interest.
  • Right to complain — to the Bulgarian Commission for Personal Data Protection (CPDP), cpdp.bg, if you believe your rights have been violated.

To exercise your rights, email info@officelabsco.com. We will reply within 30 days.

Data retention

  • Order data — kept for 5 years, as required by the Corporate Income Tax Act and the VAT Act.
  • Technical data (IP, browser, UTM) — kept together with the order for the same period.
  • Unfinished orders — not stored on the server; they remain only in the localStorage of your browser.

Once these periods expire, the data is deleted or anonymised securely.

Security

We apply technical and organisational measures to protect your data:

  • All traffic is encrypted with TLS/HTTPS;
  • Passwords and tokens are stored as cryptographic hashes (SHA-256);
  • Access to the admin panel is protected with a password;
  • The database is accessible only over an encrypted connection with an authentication token;
  • We do not accept card payments on the website. Payment is made by bank transfer against a proforma invoice, and the customer's bank details are processed only to issue the invoice.

If a security breach is detected, we will notify the affected persons and the CPDP within the statutory deadlines.

Changes to this policy

We may update this policy from time to time to reflect changes in legislation or in our business. For significant changes we will publish a notice on the site. We recommend that you check the policy regularly.

The date of the last update is shown at the top of the page.

Contact us

For questions, requests or complaints related to your personal data: