This Privacy Policy explains what personal data Fitco Group Ltd collects when you visit fitcogroup.eu, place an order or contact us, why we use it and what rights you have. It also explains the cookies we use.
Last updated: 22 October 2026
1. Who we are
The controller of your personal data is Fitco Group Ltd (Фитко Груп ООД, trading as FITCO), a company registered in Bulgaria, UIC / VAT number BG205733670, registered office 28Zh Dr. Lyuben Popov Str., Varna 9000, Bulgaria.
For any question about your data or to exercise your rights, write to office@fitcogroup.eu or call +359 887 766 046.
2. What data we collect and why
Orders
When you buy from our online shop we collect your name, company name and VAT number (if you give them), billing and delivery address, email address, phone number, the products you order with your chosen options (for example frame colour, RAL code and upholstery), and payment status. We use this data to process and deliver your order, produce made-to-order equipment, issue invoices, handle returns and warranty claims, and send you emails about your order.
Legal basis: performance of a contract with you (Art. 6(1)(b) GDPR) and our legal obligations under Bulgarian tax and accounting law (Art. 6(1)(c) GDPR).
Payments
Card payments are processed by our payment service provider myPOS on its own secure payment page. We do not see or store your full card details – we only receive confirmation that the payment was made. For bank transfers we receive the payer’s name and account details from our bank, as shown on the transfer.
Quote requests and enquiries
When you use a “Request a quote” form, the contact form or email us, we collect your name, email address and, if you give them, your phone number, company, country, the product and options you are interested in and your message. We use this data to answer you and to prepare an offer.
Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering business enquiries (Art. 6(1)(f) GDPR).
Website operation and security
When you visit the website, our hosting provider’s servers automatically record technical data such as your IP address, browser type, the pages requested and the time of the request. This is needed to deliver the website, keep it secure and prevent abuse (for example spam through our forms).
Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
Optional cookies
Statistics and marketing cookies are only used if you agree to them in our cookie banner (Art. 6(1)(a) GDPR). You can withdraw your consent at any time – see section 7.
We do not sell your personal data, and we do not use it for automated decision-making or profiling that has legal or similarly significant effects on you.
3. Who we share your data with
We only share your data when it is needed for the purposes above:
- Hosting and email: SuperHosting.BG (Bulgaria) hosts our website and our email.
- Payments: myPOS (card payments) and our bank (bank transfers).
- Delivery: the transport and courier companies that deliver your order receive your name, delivery address and phone number.
- Production: for made-to-order equipment, the manufacturer receives the order details and options needed to produce it – not your payment details.
- Accounting: our accountant receives invoices and payment records.
- Authorities: tax and other public authorities, when the law requires it.
These recipients are located in the European Union or the European Economic Area. If a transfer outside the EEA ever becomes necessary (for example for a delivery to the UAE or Saudi Arabia), we will only share the data needed for that purpose and use the safeguards required by the GDPR.
4. How long we keep your data
- Orders, invoices and payment records: for as long as Bulgarian accounting and tax law requires (currently up to 10 years).
- Warranty information: until the warranty period of the product has ended.
- Quote requests and enquiries that do not lead to an order: up to 2 years after our last contact.
- Server logs: for a short period set by our hosting provider, normally not longer than a few months.
- Cookies: as listed in section 6.
5. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy of it;
- have inaccurate data corrected;
- have your data erased, where we no longer have a legal reason to keep it;
- restrict the processing of your data;
- receive your data in a structured, machine-readable format (data portability);
- object to processing based on our legitimate interest;
- withdraw your consent at any time, without affecting processing that took place before.
To exercise these rights, email office@fitcogroup.eu. We will reply within one month. We may ask you to confirm your identity first.
You also have the right to lodge a complaint with the Bulgarian supervisory authority, the Commission for Personal Data Protection (2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg), or with the data protection authority of the EU country where you live or work.
6. Cookies
Cookies are small text files stored in your browser. We use some cookies that are necessary for the shop to work, and optional cookies only if you agree to them.
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* | Necessary | Remember the contents of your basket and your checkout session. | Session / up to 2 days |
| fitco_consent | Necessary | Remembers your cookie choices. | 6 months |
| wordpress_*, wordpress_logged_in_* | Necessary | Keep you signed in if you log in to an account. | Session / up to 14 days |
| sbjs_* | Statistics (optional) | Record how you arrived at our website (for example search, social media or a direct visit) so we can see which channels bring orders. Set by WooCommerce only if you accept statistics cookies. | Session / up to 6 months |
We do not currently use analytics or advertising tools such as Google Analytics or social media pixels. If we add them in the future, they will only run after you accept the relevant category in the cookie banner, and we will update this table.
Links to our Facebook, Instagram and LinkedIn pages are ordinary links – these networks do not set cookies on our website, but their own privacy policies apply once you visit them.
7. Changing your cookie choices
You can change or withdraw your consent at any time in the cookie settings. You can also delete cookies in your browser settings.
8. Changes to this policy
We may update this Privacy Policy when our services or the law change. The current version is always published on this page with the date of the last update.