Last updated: 19 October 2026

This privacy policy explains how Eco Supplements EOOD handles personal data in connection with our wholesale website b2b.ecosupplements.eu (“Eco Supplements Wholesale”). We sell only to businesses, so the personal data we handle is mainly that of the people who work for or represent our business customers and prospective customers, for example the owner, buyer or contact person of a shop, gym or studio.

1. Who is responsible for your data

The controller of your personal data is:

Eco Supplements EOOD
Antim I Street No. 14, fl. 2
1303 Sofia, Bulgaria
Company number (EIK): 207958071
VAT number: BG207958071
Email: support@ecosupplements.eu

We are not required to appoint a data protection officer and have not done so. For any question about this policy or your data, please write to support@ecosupplements.eu.

2. What data we collect

  • Contact and account data: your name, role or job title, business email address, mobile phone number and the company you represent.
  • Company data: company name, address and VAT number, and for customers outside the EU the details needed for export and customs. If you trade as a sole trader, this is also personal data about you.
  • Order data: products ordered, billing and delivery addresses, delivery contact details, order history, invoices and credit notes, quote requests, and files you upload to your account (for example bulk-order lists).
  • Payment data: payment method and payment status, and for bank transfers the payer name and account details shown on the payment. Card details are entered on Mollie’s systems; we never see or store full card numbers.
  • Communication data: emails and messages you send us, including through the contact button on your orders, and our replies.
  • Prospect data: if we contact your business before you have registered with us, the business contact details we have collected (see section 4).
  • Technical data: IP address, browser and device information, login times and the server logs created when you use the website.
  • Email data: whether our emails were delivered and opened, and which links in them were clicked.

Some information is required to open an account and place orders, such as your name, contact details, the company address and, for EU customers, a valid VAT number. Without it we cannot set up the account, deliver the order or issue a correct invoice.

3. Why we use your data and on what legal basis

Purpose Legal basis under the GDPR
Creating and managing your wholesale account, including logging in with a one-time code sent to your phone by SMS. Our legitimate interest in managing the business relationship with your company (Art. 6(1)(f)). If you are a sole trader, performance of our contract with you (Art. 6(1)(b)).
Processing, packing, shipping and delivering orders, handling quote requests, returns and complaints.
Checking that EU customers have a valid VAT number, applying the correct VAT treatment, and issuing invoices and credit notes. Compliance with our legal obligations under EU and Bulgarian VAT and accounting law (Art. 6(1)(c)).
Taking payments and preventing payment fraud. Our legitimate interest in being paid for orders (Art. 6(1)(f)) or performance of a contract with you as a sole trader (Art. 6(1)(b)), and legal obligations under payment and anti-money-laundering rules (Art. 6(1)(c)).
Answering questions and support requests. Our legitimate interest in providing customer service (Art. 6(1)(f)).
Sending existing customers emails about our products, prices, offers and changes to our terms. Our legitimate interest in direct marketing to our business customers (Art. 6(1)(f)). You can opt out at any time.
Contacting businesses that may be interested in our wholesale offer (business outreach, see section 4). Our legitimate interest in direct marketing to businesses (Art. 6(1)(f)). You can object at any time.
Keeping the website secure, preventing misuse and fixing technical problems. Our legitimate interest in running a secure, working website (Art. 6(1)(f)).
Keeping accounting records and responding to tax audits and other legal requirements. Compliance with our legal obligations (Art. 6(1)(c)).
Establishing, exercising or defending legal claims. Our legitimate interest in protecting our legal rights (Art. 6(1)(f)).

Where we rely on legitimate interests, we have weighed them against your interests and rights. You can ask us for more information about this assessment, and you have the right to object (see section 9).

4. Where we get your data, including business outreach

Most of the data we hold comes directly from you when you register, place an order or contact us. When you enter a VAT number, our website checks it against the European Commission’s VIES system, which confirms whether the number is valid.

We also contact businesses that have not registered with us yet, such as gyms, fitness studios and yoga and pilates studios, to introduce our wholesale offer. For this we collect business contact details (company name, business address, business email address and phone number, and where available the name and role of a contact person) from publicly available sources, such as the business’s own website, public business directories and online map listings. We use this data only to contact the business about our wholesale offer.

Every outreach email states who we are and how to stop further contact. If you tell us you do not want to hear from us, we stop immediately and keep only your email address on a suppression list, so that we do not contact you again by mistake. If you do not become a customer, we delete prospect data no later than 2 years after our last contact.

5. Who we share your data with

We do not sell personal data. We share it only with the following recipients, and only as far as needed for the purposes described above.

Recipient Purpose
Kinsta Website hosting
Twilio Sending one-time login codes by SMS
Mollie (Netherlands) Payment processing, including card payments and SEPA bank transfers
Brevo (France) Sending emails to customers and business outreach emails
Zoho Our business email system
BaseLinker (Poland) Order management software that passes orders to our warehouses
Mail Step a. s. (Mailstep), Czech Republic Warehousing and order fulfilment in the Czech Republic
[POLISH WAREHOUSE COMPANY NAME], Poland Warehousing and order fulfilment in Poland
Parcel carriers, such as Packeta, GLS, InPost and PPL Delivering your orders. Carriers receive the delivery name, address, phone number and email address.
Our external accounting firm in Bulgaria Bookkeeping, tax returns and statutory reporting
Tax and customs authorities, courts and legal advisers Where required by law, for customs clearance of shipments outside the EU, or to establish or defend legal claims

Our service providers process personal data on our behalf, under data processing agreements and only on our instructions. Payment providers, carriers and public authorities may also use the data as independent controllers for their own legal obligations, for example Mollie’s anti-money-laundering checks, under their own privacy policies.

6. Transfers outside the EU/EEA

Some of our providers, such as Twilio and Kinsta, are companies based in the United States, and some providers may access data from outside the European Economic Area (EEA) for support or maintenance. In those cases we rely on an adequacy decision of the European Commission, including the EU–US Data Privacy Framework where the provider is certified under it, or on the European Commission’s Standard Contractual Clauses, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

If your company is located outside the EU, we must send your order and delivery details to carriers and customs authorities in the destination country in order to deliver your order. This transfer is necessary to perform the order (Art. 49(1)(b) and (c) GDPR).

7. How long we keep your data

  • Invoices, credit notes and other accounting records: for the periods required by the Bulgarian Accountancy Act and tax legislation, generally 10 years from 1 January of the year after the year they relate to, and longer where a tax audit or limitation period requires it.
  • Order records and order-related correspondence: up to 5 years after the order, to handle complaints and possible legal claims, unless they also form part of the accounting records above.
  • Wholesale accounts: as long as the account is active. We delete or anonymise accounts with no login and no order for 3 years, except data we must keep under the points above. You can ask us to close your account at any time.
  • Support emails not related to an order: up to 2 years after the matter is closed.
  • Prospect data from business outreach: up to 2 years after our last contact. If you object, we keep only your email address on our suppression list for as long as needed to respect your objection.
  • Server logs and security records: for a short period set by our hosting provider, unless we need them longer to investigate a specific security incident.

8. Cookies

We use only cookies that are strictly necessary for the website to work, for example to keep you logged in, remember the contents of your cart and your language, and protect the website against misuse. These cookies do not require your consent. We do not use analytics, advertising or social media tracking cookies on this website.

When you pay, you may be taken to Mollie’s payment pages, which use their own cookies under Mollie’s privacy policy. If we ever add cookies that are not strictly necessary, we will ask for your consent first and update this policy.

9. Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you and receive a copy of it.
  • Rectification of data that is inaccurate or incomplete.
  • Erasure of your data, unless we must keep it, for example for accounting or tax reasons.
  • Restriction of processing, for example while we check a complaint about the accuracy of your data.
  • Data portability: to receive data you gave us in a structured, machine-readable format, or have it sent to another company.
  • Object to processing based on our legitimate interests. If you object to direct marketing, including business outreach, we will always stop.

Every marketing email includes an unsubscribe link. To exercise any of your other rights, email support@ecosupplements.eu. Exercising your rights is free of charge. We reply within one month and may ask you to confirm your identity first.

You also have the right to lodge a complaint with a data protection authority, in particular in the EU country where you live or work or where an alleged infringement took place. Our lead supervisory authority is:

Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd.
1592 Sofia, Bulgaria
Email: kzld@cpdp.bg
Website: www.cpdp.bg

We would appreciate the chance to deal with your concern first, so please contact us before going to the authority.

10. Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. When you enter a VAT number at checkout, our website automatically checks it against VIES. If the number cannot be validated, the order cannot be placed. Please contact us if you believe this is a mistake.

11. Security

The website uses encrypted connections (HTTPS), and accounts use one-time login codes instead of passwords. Access to customer data is limited to the staff and service providers who need it to do their work, and our providers are bound by confidentiality and data processing agreements.

12. Changes to this policy

We update this policy when our processing of personal data changes. The date at the top of this page shows when it was last updated. If we make important changes, we will inform registered customers by email.