Privacy Policy

This is an English translation for your convenience. The Bulgarian version of this policy is binding.

This policy explains what personal data the online bookshop The Book collects, why, how long we keep it, who we share it with and what your rights are. We process data under the General Data Protection Regulation (Regulation (EU) 2016/679, „GDPR“) and the Bulgarian Personal Data Protection Act.

1. Data controller

„Дъ Бук“ ЕООД (The Book EOOD), company ID 208855448, registered office: р-н Красно село, бул. „Цар Борис III“, 73, ет. 4, ап. 5, 1612 София, България.
For any question about personal data: contact@dbfgg.com, phone +359 877 770 628.

2. What we process and why

Order and delivery — name, phone, email, delivery address or office, the order's contents and the chosen payment method. We cannot fulfil the order without them (contract — Art. 6(1)(b) GDPR).
Card payments — card details are entered only on the secure page of BORICA AD and never reach us. We receive only the outcome of the payment: whether it was approved, the approval code, the transaction number and a masked card number (for example 4341 XXXX XXXX 0044). We keep them to prove the payment, to refund to the same card and to answer a payment dispute (contract, legal obligation and legitimate interest — Art. 6(1)(b), (c) and (f)).
Accounting and tax — the sale and refund documents and the data in them (legal obligation — Art. 6(1)(c); Bulgarian Accountancy Act, VAT Act, Ordinance N-18).
Account — name, email, phone, password (kept only encrypted), order history and loyalty points (contract).
Returns and complaints — the request's data, the photos you send and the bank account (IBAN) to which we refund cash-on-delivery or bank-transfer payments (contract and legal obligation).
Consent to the general terms — the date, time and version of the terms you accepted with your order. The bank that processes card payments requires us to keep them (legitimate interest and legal obligation).
Enquiries — what you send us through the contact form, the chat or by email (legitimate interest in replying; for questions about an order — contract).
Marketing messages — only with your explicit consent, which you can withdraw at any time (consent — Art. 6(1)(a)).
Cookies and analytics — the essential cookies keep your cart and your login. Analytics and marketing cookies (for example Google Analytics, Google Tag Manager, Meta Pixel) load only with your consent — see the Cookie Policy.

3. Who we share data with

The courier delivering the order (for example Speedy AD) — name, phone, address and the cash-on-delivery amount.
BORICA AD and UniCredit Bulbank AD — for card payments, to process the payment and refunds to the card.
Our accountant — the sale and refund documents.
The hosting and email providers the site runs on — only as processors acting on our instructions.
Public authorities — for example the National Revenue Agency, when the law requires it.

We do not sell personal data or share it with third parties for their marketing. If you consent to analytics or marketing cookies, some data may be transferred to Google or Meta, including to the USA, under the EU–US Data Privacy Framework.

4. How long we keep data

Order and return data — 5 years after the end of the year of the order, for possible claims.
Accounting and tax documents — 10 years, under the Accountancy Act.
Card payment records and the consent to the terms — at least 13 months from the payment, as the bank requires.
Your account — until you close it.
Consent to marketing messages — until you withdraw it.

5. Your rights

Access to your data and a copy of it.
Rectification of inaccurate data.
Erasure („the right to be forgotten“) — except data we must keep by law.
Restriction of processing.
Portability — receiving your data in a machine-readable format.
Objection to processing based on legitimate interest.
Withdrawal of consent at any time — without affecting the lawfulness of processing before it.

Write to us at contact@dbfgg.com — we reply within one month. If you have an account, you can also download your data yourself.

6. Complaints to the supervisory authority

If you believe your rights have been infringed, you can complain to the Commission for Personal Data Protection — 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, cpdp.bg.

7. Security

The site uses an encrypted connection (HTTPS). Only the staff who fulfil orders have access to the data. Passwords are stored only encrypted. We never receive or store card numbers or CVV/CVC codes. We make no decisions about you based solely on automated processing, including profiling.

8. Changes to this policy

We may change this policy. The new version is published on this page with the date of the change.

Last updated: 25.09.2026