Privacy notice

Who processes your data

The data controller is Lider ofis ML EOOD (Лидер офис МЛ ЕООД), EIK 204578516, registered at s. Markovo, mestnost Bedrozov bunar No 42, obl. Plovdiv, Bulgaria (с. Марково, местност Бедрозов бунар № 42, обл. Пловдив). You can reach us at info@buy-a-vend.com or +359 897 943 424.

What data we collect

Through the enquiry form we collect only what we need in order to reply with a quote:

• the contact person's name;
• the company name;
• phone and email;
• VAT number, if you choose to give it;
• your message, if you write one;
• the machine and the questionnaire answers you selected before sending the enquiry.

On sending, the spam protection also processes technical data - your IP address and signals from your browser. These serve only to tell a person from an automated bot and are not stored with your enquiry.

On what legal basis

Each activity rests on its own legal basis:

• The enquiry and the quote. We process the data in order to take steps at your request before entering into a contract - Article 6(1)(b) GDPR. The checkbox on the form confirms you have read this document; it is not the legal basis, and withdrawing it does not stop a quote already under way.
• Protection from spam and abuse. Our legitimate interest in the form remaining usable - Article 6(1)(f).
• Accounting and tax, if a contract is concluded - a legal obligation under Article 6(1)(c).

What we use it for

Only to contact you, prepare a quote and, if it comes to that, prepare a contract. We do not sell it and do not pass it to third parties for marketing. We do not send a newsletter unless you explicitly ask for one.

Checks before a quote

The machine is delivered against an invoice, so before we quote we check the company in public sources - the commercial register, the register of public liabilities and similar. For a company these are not personal data. Where the counterparty is a sole trader or a self-employed person, the same check concerns a natural person. Here too the source is a public register, not a purchased database.

The decision whether to quote is taken by a person, not automatically. We do not carry out automated decision-making within the meaning of Article 22 GDPR and we do not profile.

Who we give it to

Enquiries are handled personally by the manager. Beyond him, the data reaches only providers who process it on our instructions and have no right to use it for their own purposes:

• hosting and database provider - stores the enquiry;
• Resend - sends the notification to us and the confirmation to you;
• Cloudflare - the “are you human” check on the form;
• Plausible Analytics - anonymous visit statistics, without cookies and without identifying visitors.

Google stands apart: it supplies the map on the “Who we are” page. It acts not on our instructions but as an independent controller - once you load the map, Google receives your IP address and browser data and processes them on its own terms. That is precisely why the map does not load by itself: a button stands in its place, and nothing goes to Google until you press it. If you do not press it, nothing happens between you and Google, and the address and opening hours are written out without the map.

Transfer outside the European Union

Plausible is a European company and the data is processed in the European Union. Resend and Cloudflare are US-based, so a transfer outside the EU is possible with them. The same applies to Google if you choose to load the map. Such transfers rest on the standard contractual clauses adopted by the European Commission or on another recognised protection mechanism.

How long we keep it

Enquiries that do not lead to a contract are kept for up to 12 months. If a contract is concluded, retention follows the periods required by accounting and tax legislation.

Cookies

We do not use tracking cookies and do not build a profile of your behaviour. The site therefore has no consent banner. The detail is in the cookie notice.

Your rights

• access to the data we hold about you;
• rectification of inaccurate data;
• erasure;
• restriction of processing;
• portability;
• objection to processing based on legitimate interest;
• withdrawal of consent where we process on that basis.

Write to info@buy-a-vend.com and we will answer within one month. You also have the right to lodge a complaint with a supervisory authority. Ours, as a Bulgarian company, is the Commission for Personal Data Protection - Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd, cpdp.bg.

You do not have to go there. Article 77 GDPR gives you the right to complain instead to the supervisory authority of the country where you habitually live, where you work, or where the alleged infringement took place. Every EU and EEA country has one, and you may choose whichever of those applies to you.