Privacy Policy

Last updated: April 2026

1. Data Controller

EZAX Ltd. ("EZAX", "we", "us", "our") is the data controller responsible for your personal data. We operate the EZAX Premium Chairs ordering platform at orders.ezax.eu and the EZAX mobile application.

Registered Address: 30 Todorin Vrah Street, Sofia, Bulgaria
VAT ID: BG202657726
Email: sales@ezax.bg
Phone: +359 884 626 186

2. Information We Collect

2.1 Information You Provide

• Account Data: Name, email address, phone number, password (encrypted)
• Business Data: Company name, VAT identification number, business type
• Order Data: Delivery address, billing address, order items, quantities, notes
• Payment Data: Payment method selection (we do not store credit card numbers)

2.2 Information Collected Automatically

• Usage Data: Pages viewed, products browsed, features used
• Device Data: Browser type, operating system, screen resolution
• Local Storage: Login session, shopping cart contents, user preferences

2.3 Information We Do NOT Collect

• We do not use third-party tracking or analytics cookies
• We do not collect location data
• We do not use advertising identifiers
• We do not sell or share data with third parties for marketing

3. Legal Basis for Processing (GDPR Art. 6)

We process your personal data based on:

• Contract Performance (Art. 6(1)(b)): Processing necessary to fulfill your orders, manage your account, and provide our services
• Legitimate Interest (Art. 6(1)(f)): Customer support, fraud prevention, improving our services
• Consent (Art. 6(1)(a)): Marketing communications (only with your explicit opt-in)
• Legal Obligation (Art. 6(1)(c)): Tax records, VAT compliance, regulatory requirements

4. How We Use Your Information

• Process and fulfill your orders
• Send order confirmations, shipping updates, and invoices via email
• Manage your account and preferences
• Verify business accounts through EU VIES VAT validation
• Provide customer support
• Generate order documentation (PDF invoices and proforma invoices)
• Comply with legal and tax obligations

5. Data Sharing & Third Parties

We do not sell, rent, or trade your personal data. We may share data only with:

• Email Service Providers: To send order confirmations (via our SMTP server)
• EU VIES Service: To verify VAT numbers for business accounts (European Commission service)
• Law Enforcement: Only when required by law or court order

6. International Data Transfers

Your data is stored on servers located in the European Union. We do not transfer personal data outside the EU/EEA. If transfers become necessary, we will ensure appropriate safeguards under GDPR Chapter V (e.g., Standard Contractual Clauses).

7. Data Retention

• Account Data: Retained while your account is active, deleted within 30 days of account deletion request
• Order Data: Retained for 7 years as required by Bulgarian tax law
• Shopping Cart: Stored locally on your device, cleared when you clear browser data

8. Your Rights Under GDPR

Under the General Data Protection Regulation (EU 2016/679), you have the right to:

• Access (Art. 15): Request a copy of your personal data
• Rectification (Art. 16): Correct inaccurate or incomplete data
• Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
• Restriction (Art. 18): Restrict processing of your data
• Data Portability (Art. 20): Receive your data in a structured, machine-readable format
• Object (Art. 21): Object to processing based on legitimate interests
• Withdraw Consent (Art. 7(3)): Withdraw consent at any time without affecting prior processing

To exercise any of these rights, contact us at sales@ezax.bg. We will respond within 30 days.

9. Data Security

• All data transmitted via HTTPS/TLS encryption
• Passwords stored using bcrypt one-way hashing
• Database access restricted to authorized personnel
• Regular server security updates and backups
• No plaintext storage of sensitive credentials

10. Cookies & Local Storage

Our app uses browser local storage (not cookies) to store:

• Authentication tokens (login session)
• Shopping cart contents
• User preferences (language, user type)

We do not use third-party cookies, tracking pixels, or analytics tools. No consent banner is required as we only use technically necessary storage.

11. Children's Privacy

Our service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us for immediate deletion.

12. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act:

• Right to know what personal data is collected and how it is used
• Right to delete personal data
• Right to opt-out of the sale of personal data (we do not sell data)
• Right to non-discrimination for exercising privacy rights

13. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via email or prominent notice in our app. The "Last updated" date at the top reflects the most recent revision.

14. Supervisory Authority

If you are unsatisfied with our handling of your data, you have the right to lodge a complaint with your local data protection authority. For Bulgaria:

Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
www.cpdp.bg

15. Contact Us

EZAX Ltd.
30 Todorin Vrah Street
Sofia, Bulgaria
Email: sales@ezax.bg
Phone: +359 884 626 186
Web: ezax.eu