Created for those who are looking for the best olive oil at this time on Earth! ☎ +359 88 226 8693

Privacy Policy

Effective from 01.10.2026.

Who processes your data

ExtraVirgin.BG Ltd. (Екстравърджин.БГ ООД), Company No. 205980667, 10 Milin Kamak St., 1421 Sofia, Bulgaria, is the controller. Questions and requests: noindiano@extravirgin.bg, phone +359 88 226 8693.

What data, why, and on what legal basis

  • Orders: name, email, phone, delivery address, ordered products, payment method and invoice details if you ask for an invoice — to perform the contract (Art. 6(1)(b) GDPR) and to issue accounting documents (legal obligation, Art. 6(1)(c)).
  • Requests for products not yet available: email, phone and quantity — to tell you when the product arrives (your request, Art. 6(1)(b)).
  • Withdrawals and complaints: the data you send us — to handle them (legal obligation, Art. 6(1)(c)).
  • Correspondence: emails and calls — to answer you (legitimate interest, Art. 6(1)(f)).
  • Technical data: IP address and browser data in server logs — for security and abuse prevention (legitimate interest, Art. 6(1)(f)).
  • Statistics and advertising: only if you click "Accept all" in the cookie banner (consent, Art. 6(1)(a)) — see "Cookies" below.

We do not collect card data: card payments are handled entirely by PayPal. We make no automated decisions or profiling with legal effects for you.

Cookies

  • Necessary (always): session for cart and checkout (connect.sid, 7 days), protection against forged requests, and remembering your cookie choice (ev_consent, 6 months).
  • Statistics — Google Analytics 4 (consent only): which pages and products are viewed, without knowing who you are (_ga, up to 2 years), and where you came from — an ad, a search engine or social media — so we know which channels bring orders (ev_src, 30 days).
  • Advertising — Google Ads and Meta (Facebook/Instagram) Pixel (consent only): measuring which ads lead to purchases and showing our ads to site visitors (_gcl_au, _fbp — up to 90 days). On purchase, Google Ads receives your email and phone in hashed (irreversibly encoded) form to attribute the purchase.
  • Maps: the Google map on the Contacts page loads if you accepted all cookies or open it yourself; the Speedy office map loads when you choose office delivery. Google and Speedy then receive your IP address.

You can change or withdraw your consent at any time via "Cookie settings" at the bottom of every page.

Who receives the data

  • Speedy (Bulgaria) and Direx (abroad) — for delivery
  • PayPal (Europe) S.à r.l. et Cie, S.C.A. — when you pay with PayPal, as an independent controller
  • SuperHosting.BG EOOD — hosting and email, servers in Bulgaria
  • Google Ireland Ltd. (Analytics, Ads, Tag Manager, Maps) and Meta Platforms Ireland Ltd. — only with consent; they may transfer data to the USA under the EU–US Data Privacy Framework
  • our accountant and public authorities where the law requires it

We do not sell personal data.

How long we keep data

  • Accounting documents (invoices, orders) — 10 years, as required by the Bulgarian Accountancy Act
  • Other order data — 5 years (the general limitation period)
  • Requests for unavailable products — up to 6 months after the product arrives
  • Server logs — up to 30 days
  • Cookies — as listed above

Your rights

You have the right of access, rectification, erasure, restriction, portability, objection and to withdraw consent, without affecting processing already carried out. Write to noindiano@extravirgin.bg — we reply within one month. You may also lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, cpdp.bg, or with the authority in your own country.