Privacy Policy

1. Who We Are

zorliva.eu ("we", "us", "our") operates the website zorliva.eu and sells dietary supplements, including Power Edge, to customers in Bulgaria and across the European Union. Our registered business address is in Sofia, Bulgaria. For data protection enquiries, contact: [email protected] or by telephone +359 87 364 5291.

We are subject to the General Data Protection Regulation (EU) 2016/679 (GDPR) as directly applicable in Bulgaria, and to the Personal Data Protection Act (PDPA) of Bulgaria (Закон за защита на личните данни).

The Bulgarian supervisory authority for data protection is the Commission for Personal Data Protection (CPDP – Комисия за защита на личните данни), website: www.cpdp.bg.

2. What Personal Data We Collect

When you interact with our website or place an order, we may collect the following categories of data:

Identity data: First name, last name
Contact data: Phone number, email address (if provided)
Delivery data: Postal address, city, postcode within Bulgaria
Transaction data: Products ordered, package selected, payment method chosen
Technical data: IP address, browser type, device type, cookies, pages visited
Communication data: Messages submitted via our contact form

We do not collect sensitive data (health data, financial account details). We do not store payment card numbers — card payments are processed by PCI-compliant third-party processors.

3. How We Use Your Data

We process your personal data for the following purposes and on the following legal bases:

Order fulfilment (Contract): To process, confirm, and deliver your order via Speedy or Econt.
Customer service (Contract / Legitimate Interest): To respond to enquiries and manage returns within our 30-day guarantee policy.
Legal compliance (Legal Obligation): To comply with Bulgarian tax law, consumer protection regulations, and GDPR requirements.
Website analytics (Legitimate Interest): To understand how visitors use our site and improve user experience using anonymised data.
Direct marketing (Consent): Only if you explicitly opt in. You may withdraw consent at any time by contacting [email protected].

4. Data Sharing and Third Parties

We share personal data only where necessary and with appropriate safeguards:

Courier services: Speedy AD and Econt Express OOD — delivery name and address only
Payment processors: Stripe, PayPal — as per their own privacy policies; we do not store card data
IT infrastructure: Hosting providers operating within the EEA under GDPR-compliant data processing agreements
Analytics: Anonymised/pseudonymised data only; no sale of personal data to third parties

We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.

5. Data Retention

We retain personal data only for as long as necessary:

Order and transaction records: 5 years (Bulgarian tax/accounting requirements)
Customer service communications: 2 years from resolution
Website analytics data: 13 months in anonymised form
Marketing consent records: Until withdrawal of consent + 1 year

After the applicable retention period, data is securely deleted or anonymised.

6. Your Rights Under GDPR

As a data subject in Bulgaria/the EU, you have the following rights:

Right of access: Request a copy of the personal data we hold about you
Right to rectification: Correct inaccurate or incomplete data
Right to erasure ("right to be forgotten"): Request deletion where there is no legal basis to retain the data
Right to restriction: Request limited processing while a dispute is resolved
Right to data portability: Receive your data in a structured, machine-readable format
Right to object: Object to processing based on legitimate interest or direct marketing
Right to withdraw consent: Withdraw any previously given consent at any time

To exercise any right, contact [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the CPDP at www.cpdp.bg.

7. Cookies

We use cookies to improve your experience on our website. For full details of the cookies we use and how to manage them, please see our Cookie Policy.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include SSL/TLS encryption, access controls, and regular security assessments. However, no internet transmission is entirely secure; if you believe your data has been compromised, please contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The date of the most recent version is shown at the top of this page. We recommend checking this page periodically. Continued use of our website after any change constitutes acceptance of the updated policy.