Privacy Policy

1. Personal Data Controller

Duel EOOD, UIC 103715306, VAT BG103715306, registered office: 2 Tsanko Dyustabanov Str., 9000 Varna, Bulgaria.

Contact email: office@duelbg.com

2. What personal data we collect

• On registration and order: first name, last name, phone, email, shipping address, billing address.
• If ordering as a company: additionally — name, UIC, VAT ID, accountable person.
• On payment: bank card data is not stored by us — it is processed by myPOS.
• On site visits: IP address, browser and device info, behavior on the site (via PostHog).

3. Purposes of processing

• Order fulfillment and delivery.
• Invoicing and accounting under the Accounting Act.
• Customer communication on order status, complaints, inquiries.
• Service improvement through anonymized data analysis.
• Marketing only with explicit consent (newsletter and promotions).

4. Legal basis

• Contract performance (Art. 6(1)(b) GDPR) — for orders.
• Legal obligation (Art. 6(1)(c) GDPR) — invoicing, tax reports.
• Legitimate interest (Art. 6(1)(f) GDPR) — security, anti-fraud.
• Consent (Art. 6(1)(a) GDPR) — marketing communications.

5. Retention period

• Order and invoice data — 10 years (Art. 12 of the Accounting Act).
• Site registration — while the account is active or until deletion request.
• Marketing consent — until consent is withdrawn.
• Security logs — 12 months.

6. Who we share data with

• Econt Express — for delivery to address or office.
• myPOS — for card payment processing.
• Aurora ERP (Sis Technology) — for order processing.
• We do not sell or provide data to third parties for marketing purposes.

7. Your GDPR rights

• Right of access to your data.
• Right to rectification of inaccurate data.
• Right to erasure (right to be forgotten).
• Right to restrict processing.
• Right to data portability.
• Right to object to processing.
• Right to lodge a complaint with the Commission for Personal Data Protection (CPDP).

8. Contact for GDPR matters

To exercise your rights, contact us at: office@duelbg.com