Last updated: September 29, 2026
This policy describes how we handle personal data of users who visit and make purchases on marketplace.trilium-bg.com (the “Site”), in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Bulgarian implementing law.
1. Data controller
The data controller is Trilium EOOD, a company incorporated under Bulgarian law (EIK/UIC 131461587, VAT BG131461587), registered office at Alabin Str. 31, floor 1, apt. 1, 1000 Sofia, Bulgaria, represented by Fabio Felice Cudia. For any request relating to the processing of personal data, write to info@trilium-bg.com or call +359 899 665 200.
2. Data we collect
When you browse and shop on the Site, we may collect:
- identification and contact details provided at registration, purchase or contact (name, email address, shipping and billing address, phone number);
- order data (products purchased, amounts, date and payment method — card details are processed directly by our payment provider and are not stored on our servers);
- browsing and technical data collected automatically (IP address, browser type, pages visited, cookies and similar identifiers — see our Cookie Policy);
- any messages sent through contact forms, customer support, or product reviews.
3. Purposes and legal basis
- Order management and fulfilment (concluding and performing the sales contract, shipping, after-sales support, returns and withdrawal) — legal basis: performance of a contract (Art. 6(1)(b) GDPR);
- Accounting, tax and legal compliance — legal basis: legal obligation (Art. 6(1)(c) GDPR);
- Customer account management — legal basis: performance of a contract;
- Marketing communications (newsletter, offers) — legal basis: consent (Art. 6(1)(a) GDPR), revocable at any time;
- Statistical analysis and Site improvement — legal basis: consent (non-essential cookies) or legitimate interest for aggregate measurements strictly necessary for Site security;
- Fraud and abuse prevention — legal basis: legitimate interest of the controller, including verifying suspicious order or return patterns as described in our Refund and Returns Policy.
4. Sharing and transfer of data to third parties
Personal data may be shared, strictly as necessary for the purposes above, with: hosting and Site maintenance providers; our payment service providers (including, where you choose Pay by Bank, Salt Edge, a PSD2-authorised payment initiation service provider that redirects you to your own bank — we never receive your banking credentials); our logistics and delivery partners, responsible for fulfilling and shipping physical orders; accounting and legal advisors; public authorities, where required by law. Where products are shipped from warehouses located outside the European Economic Area, only the data strictly necessary for delivery (recipient name and address) may be transferred to third countries for order fulfilment purposes; we apply the safeguards required under Chapter V GDPR (including the European Commission’s standard contractual clauses, where applicable) for such transfers. We do not sell or share personal data with third parties for their own marketing purposes.
5. Data retention
Order data is kept for the period required by applicable tax and accounting law (generally 10 years). Customer account data is kept until the account is deleted at the user’s request. Data processed on the basis of consent (e.g. newsletter) is kept until consent is withdrawn.
6. Your rights
Under Articles 15-22 GDPR, you have the right to: access your personal data; rectify inaccurate or incomplete data; request erasure (“right to be forgotten”) in the cases provided by law; restrict processing; receive your data in a structured, machine-readable format (portability); object to processing based on legitimate interest or for direct marketing; withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Requests can be sent to info@trilium-bg.com. You also have the right to lodge a complaint with the competent supervisory authority (in Bulgaria, the Commission for Personal Data Protection — www.cpdp.bg; or the supervisory authority of your habitual place of residence).
7. Cookies
The Site uses essential cookies and, subject to consent, analytics and third-party cookies. For details on the types, purposes and management of cookies, see our Cookie Policy.
8. Changes to this policy
We may update this policy to reflect regulatory or organisational changes. The date of the last update is shown at the top of this page. We encourage you to review it periodically.