ROMA 71 EOOD
Privacy notice
Last updated 22 September 2026
Who is responsible
ROMA 71 EOOD, UIC 207494660, registered at Kv. Manastirski Livadi, Bul. Balgariya, 1000 Sofiya, Bulgaria, is the controller for the personal data described in this notice. This notice is given under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679.
- Controller
- ROMA 71 EOOD
- Address
- Kv. Manastirski Livadi, Bul. Balgariya, 1000 Sofiya, Bulgaria
- [email protected]
- Telephone
- +359 87 7137153
Send any question about this notice, and any request about your own data, to the email address above.
What this website itself does
Almost nothing. These pages are static files. There is no account system, no contact form, no newsletter, no analytics, no advertising or measurement script, no social media button, no embedded map or video, and no third-party font or script of any kind. The typeface is served from the same address as the page you are reading.
The hosting provider that delivers the files may keep short technical logs, typically the IP address, the time of the request, the page requested, the browser identifier and any error, in order to serve the site and protect it from abuse. Those logs are the provider's standard operation of the server, not a profile of you.
What we receive from you
The company only holds what you choose to send when you get in touch. Typically that is your name, your email address or telephone number, the company you represent if you represent one, and whatever you write about the space, the products, the quantities and the timing.
All of it comes from you directly. No personal data about you is bought, scraped or obtained from third-party sources.
Purposes and lawful bases
Each activity below has its own purpose and its own lawful basis.
- Replying to your enquiry and taking the steps you ask for before a possible contract. Lawful basis: Article 6(1)(b) GDPR. Where no contract is in prospect, the company's legitimate interest in answering business correspondence, Article 6(1)(f).
- Running an ongoing business relationship and keeping the correspondence that belongs to it. Lawful basis: Article 6(1)(b) where a contract exists, otherwise the legitimate interest in managing customer and supplier relationships, Article 6(1)(f).
- Accounting and tax records, where an order or an invoice follows. Lawful basis: Article 6(1)(c), compliance with the obligations that Bulgarian accounting and tax legislation places on the company.
- Delivering and securing this website, including the hosting provider's technical logs. Lawful basis: the legitimate interest in operating a working and protected website, Article 6(1)(f).
- Establishing, exercising or defending legal claims if that ever becomes necessary. Lawful basis: Article 6(1)(f).
No processing on this website relies on consent, because nothing here asks for it. No special categories of data under Article 9 are sought, and none should be sent in an enquiry.
Who else sees the data
- The email provider. The company's address is a Google mail address, so messages you send to it are received and stored on Google's service.
- The hosting provider that serves these pages, in respect of the technical logs described above.
- Accountants and professional advisers, where an order, an invoice or a legal question makes that necessary.
- Public authorities, only where the company is required by law to provide the data.
Personal data is never sold, rented, or used for advertising, profiling or automated scoring of any kind.
Transfers outside the EEA
Because the company's mailbox is a Google service, an email you send may be stored on or processed through servers outside the European Economic Area, including in the United States. Google states that it relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework and on the standard contractual clauses approved by the Commission for transfers that fall outside it.
If you would rather your message did not pass through that provider, telephone the company instead on +359 87 7137153.
How long data is kept
Personal data is kept only while there is a reason to keep it. The criteria are:
- An enquiry that does not lead to a relationship is kept while it is being dealt with and for a short settling period afterwards, then deleted.
- Correspondence belonging to an active business relationship is kept for the length of that relationship, and afterwards for as long as a claim arising from it could still be brought or defended.
- Accounting and tax documents are kept for the periods that Bulgarian accounting and tax legislation requires, which are longer than the periods above and which the company cannot shorten on request.
- The hosting provider's technical logs are kept for the short retention period that the provider applies to its server logs.
Your rights
Under the GDPR you have the right to:
- be told what personal data about you is held, and get a copy of it, Article 15;
- have inaccurate data corrected and incomplete data completed, Article 16;
- have data erased where one of the grounds in Article 17 applies;
- have processing restricted in the cases listed in Article 18;
- receive the data you provided in a structured, commonly used, machine-readable form and have it sent to another controller, Article 20;
- object at any time to processing based on legitimate interests, on grounds relating to your particular situation, Article 21;
- withdraw consent at any time where processing is based on consent, which does not affect processing carried out before the withdrawal, Article 7(3). No processing described here currently relies on consent;
- lodge a complaint with a data protection supervisory authority, Article 77.
Complaining to the supervisory authority
The supervisory authority for ROMA 71 EOOD is the Commission for Personal Data Protection (opens in a new tab) of the Republic of Bulgaria, at 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, email [email protected]. You may also complain to the supervisory authority of the country where you live or work, or where you believe the problem occurred.
How to exercise them
Write to [email protected] and say which right you are exercising. There is no form and no charge.
You will receive an answer within one month of the request. If a request is complex, or several requests arrive together, that period can be extended by up to two further months, and you will be told within the first month if that happens. Where there is genuine doubt about who is making the request, the company may ask for enough information to confirm your identity before acting on it.
Do you have to provide data
No. Providing your contact details is neither a statutory nor a contractual requirement. The only consequence of not providing them is the obvious one: an enquiry with no way to reply to it cannot be answered.
Automated decisions
There is no automated decision-making and no profiling within the meaning of Article 22 of the GDPR. Enquiries are read and answered by people.
Changes to this notice
This notice is updated when the website, the company's processing or the legal requirements change. The date of the current version appears at the top of this page. Material changes affecting an active business relationship are notified directly.