Last updated: 18 August 2026
This Privacy Policy explains how Phytocode EOOD collects, uses, stores and shares personal data when you visit phytocode.es, create an account, place an order, contact us, subscribe to our newsletter or otherwise use our services.
1. Data controller
Phytocode EOOD (Фитокод ЕООД), a single-member limited liability company registered in Bulgaria, is the controller of your personal data.
- Company registration number (EIK): 201055368
- VAT number: BG201055368
- Registered office: 154 Vasil Aprilov St., Plovdiv 4003, Bulgaria
- Managing Director: Plamen Vasilev
- Email: sales1@phytocode.eu
- Telephone: +359 888 206 291
2. Personal data we collect
Depending on how you use the website, we may collect the following categories of personal data:
- Website and device data: IP address, browser and device information, pages and products viewed, referring source, cart activity and information stored through essential cookies.
- Order and account data: name, billing and delivery address, email address, telephone number, account credentials, order contents, order history, payment status and related customer-service correspondence.
- Payment data: information necessary to initiate and confirm a card payment through DSK Bank. The payment provider processes payment information under its own security and privacy requirements.
- Delivery data: name, telephone number, email address, delivery address, selected Speedy office or delivery option, and shipment information required to fulfil and track an order.
- Contact data: first name, last name, email address, telephone number and the contents of messages submitted through our contact form or sent directly to us.
- Newsletter data: email address, subscription status, consent record and information relating to promotional codes issued through the newsletter service.
- Reviews and comments: the information you choose to publish, together with technical data used for moderation and fraud or spam prevention.
3. Why we process personal data
We process personal data only where we have a lawful basis. The principal purposes and legal bases are:
- Performance of a contract: to process orders, take payment, arrange delivery, manage accounts, provide customer service and handle returns or complaints.
- Legal obligations: to comply with tax, accounting, consumer-protection, product-safety and other applicable legal requirements.
- Legitimate interests: to secure and operate the website, prevent fraud and misuse, maintain business records, improve customer service and protect our legal rights, provided those interests are not overridden by your rights.
- Consent: to send newsletter and promotional communications, and to use any optional cookies or similar technologies that require consent. You may withdraw consent at any time without affecting processing carried out before withdrawal.
4. Who receives personal data
Access is limited to authorised personnel and service providers that need the information for the purposes described above. We may share relevant data with:
- website hosting, maintenance, security and IT service providers;
- DSK Bank and other parties involved in card-payment processing;
- Speedy and other delivery or fulfilment providers used for your order;
- professional advisers, accountants, auditors and insurers where necessary;
- public authorities, courts or regulators where disclosure is required by law.
Service providers are permitted to use personal data only for the relevant service and in accordance with applicable data-protection requirements.
5. International data transfers
Where a service provider processes personal data outside the European Economic Area, we use a legally recognised transfer mechanism and appropriate safeguards where required. You may contact us for further information about safeguards applicable to a particular transfer.
6. How long we retain data
We retain personal data only for as long as necessary for the relevant purpose and for any period required by tax, accounting, consumer-protection or other applicable law. Order and transaction records are retained for the legally required record-keeping period. Account data is retained while the account remains active and for a reasonable period afterwards where required for legal or security purposes. Contact enquiries are retained for as long as necessary to answer and document the request. Newsletter data is retained until you unsubscribe or withdraw consent, subject to a limited suppression record used to respect your choice.
7. Cookies and similar technologies
The website uses essential WordPress and WooCommerce cookies and similar technologies to operate the shopping cart, checkout, account login, security, session continuity and order attribution. These technologies are necessary for the requested service.
If optional analytics, advertising or personalisation technologies are introduced, they will be activated only in accordance with applicable consent requirements, and this policy and the website’s cookie information will be updated. You can also control cookies through your browser settings, although blocking essential cookies may prevent parts of the shop from working correctly.
8. Security
We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or disclosure. No online system is completely secure, and you are responsible for keeping your account password confidential.
9. Your rights
Subject to the conditions in applicable law, you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing, data portability, or object to processing based on legitimate interests. You may withdraw consent at any time and may object at any time to direct marketing.
To exercise a right, contact sales1@phytocode.eu. We may request information necessary to verify your identity.
10. Complaints
You may lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) or with the competent supervisory authority in your country of residence. Information about the CPDP is available at cpdp.bg.
11. Children
The online shop is not intended to collect personal data directly from children. If you believe that a child has provided personal data without appropriate authorisation, please contact us.
12. Changes to this policy
We may update this Privacy Policy to reflect changes in our services, technology or legal obligations. The updated version will be posted on this page with a revised date.
13. Contact
Questions about this Privacy Policy or our use of personal data may be sent to sales1@phytocode.eu or Phytocode EOOD, 154 Vasil Aprilov St., Plovdiv 4003, Bulgaria.