Privacy Policy

The data controller under the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) is GIGACHARGER BUSINESS EOOD — a single-member limited liability company entered in the Commercial Register kept by the Bulgarian Registry Agency.

This policy covers the website gigacharger.net (including the online shop), the station-request and contact forms, and the correspondence we exchange with you about those services. The company is not required to appoint a data protection officer. Please send any question about this policy to sales@gigacharger.net.

We collect only what a specific purpose requires. How much depends on how you use the site:

We do not collect or ask for special categories of data (health, ethnicity, political opinions, biometrics). Please do not include such data in the free-text fields.

Fields marked as required are the minimum we need to process your request or order. Everything else is optional and leaving it blank never results in a refusal of service.

We process personal data only where Article 6 GDPR gives us a lawful basis:

Once these periods expire the data is deleted or irreversibly anonymised. Where several periods apply to the same data, the longest one governs.

We never sell or rent personal data. We share it only with providers who help us deliver the service, act on our documented instructions as processors and are bound by confidentiality:

We may also disclose data to competent public authorities (courts, prosecution, tax administration, the Consumer Protection Commission, the Data Protection Commission) where the law requires it.

We aim to keep processing within the European Economic Area. Some of our providers (Supabase, Vercel, Google, Meta, Stripe) belong to groups with US entities, and access from there is possible.

Where that happens, the transfer is protected by the European Commission's Standard Contractual Clauses under Art. 46(2) GDPR and/or by the EU–US Data Privacy Framework, together with additional technical measures such as encryption in transit and at rest. We can tell you which mechanism applies to a given provider on request.

The site uses strictly necessary cookies, which cannot be switched off, and optional analytics and marketing cookies that we load only after your explicit consent given through the banner on your first visit.

You can change or withdraw that choice at any time via the “Cookie preferences” button in the footer of every page. The full list of cookies, their providers, purpose and lifetime is set out in the Cookie Policy.

As a data subject you have the following rights under the GDPR:

• Right of access (Art. 15) — to confirmation of whether we process your data and a copy of it.
• Right to rectification (Art. 16) — to have inaccurate data corrected and incomplete data completed.
• Right to erasure / “to be forgotten” (Art. 17) — where the data is no longer needed, you withdraw consent, or processing is unlawful.
• Right to restriction of processing (Art. 18) — for example while we verify the accuracy of the data.
• Right to data portability (Art. 20) — to receive the data you provided in a structured, machine-readable format.
• Right to object (Art. 21) — to processing based on legitimate interest, and at any time to direct marketing.
• Right to withdraw consent (Art. 7(3)) — at any time, without affecting the lawfulness of processing before the withdrawal.
• Right not to be subject to a decision based solely on automated processing (Art. 22).
• Right to lodge a complaint with a supervisory authority (Art. 77).

To exercise a right, write to sales@gigacharger.net or to 16 Tsarkovna Nezavisimost St, 7000 Ruse, Bulgaria. We reply free of charge within one month of receiving the request; for complex or numerous requests that period may be extended by two further months, and we will tell you if it is. We may ask for extra information to verify your identity — solely so that we never hand your data to someone else.

If you believe your rights have been infringed you may complain to the Commission for Personal Data Protection — 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, Bulgaria, tel. +359 2 915 3518, kzld@cpdp.bg, www.cpdp.bg, and you may also seek redress before the courts.

We do not take decisions producing legal or similarly significant effects on you by automated means alone. Station requests and orders are always reviewed by a member of staff.

Automated checks run for security only — reCAPTCHA assesses whether a form is submitted by a human, and Stripe scores the fraud risk of a payment. If such a check blocks your request, contact us and we will process it manually.

We apply technical and organisational measures proportionate to the risk: an encrypted connection (HTTPS/TLS) across the whole site, encrypted storage in the database, role-based admin access with individual accounts, separated development and production environments, regular backups and data minimisation.

We never enter, process or store bank card details — all payment information is entered in a secure form hosted by Stripe, a PCI DSS certified provider.

In the event of a security breach likely to result in a high risk to your rights, we will notify you without undue delay and inform the Commission for Personal Data Protection within 72 hours, as required by Articles 33 and 34 GDPR.

GigaCharger's services and online shop are intended for people aged 18 and over. We do not knowingly collect children's data. If we learn that we have received such data without the consent of the holder of parental responsibility, we delete it immediately.

We may update this policy when our services, providers or the law change. The current version is always available at this address, and the date of the last revision is shown at the top of the page.

For material changes we will post a prominent notice on the site, and where processing relies on consent we will ask for your consent again. Related documents: General Terms and Conditions and Cookie Policy.