Data protection

Privacy Policy

How GigaCharger collects, uses and protects your personal data — in plain language.

Last updated: 22 July 2026

1.Who processes your data

The data controller under the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) is GigaCharger.

Company details	Value
Name	GigaCharger
Phone	+359 877 442 442
E-mail	sales@gigacharger.net
Website	gigacharger.net

This policy covers the website gigacharger.net (including the online shop), the station-request and contact forms, and the correspondence we exchange with you about those services. The company is not required to appoint a data protection officer. Please send any question about this policy to sales@gigacharger.net.

2.What personal data we collect

We collect only what a specific purpose requires. How much depends on how you use the site:

Source	Data
Charging-station request (the “Request a station” form)	name, e-mail, phone, preferred contact channel, site address and the geographic coordinates of the point you pick on the map, property type and ownership, your role in relation to the property, desired power and mounting, chosen pricing plan, free-text requirements and, at your discretion, a photo of the installation spot.
Order in the online shop	name, e-mail, phone, delivery address or the Econt office/parcel machine you select, order contents and value, the Stripe payment reference, the waybill number and shipment status.
Contact by e-mail or phone	whatever you choose to include in your message, plus the history of that correspondence.
Automatically, when you visit	IP address, browser and device type, language, pages viewed and referring source, cookie identifiers. Some of this is collected only with your consent — see the Cookie Policy.

We do not collect or ask for special categories of data (health, ethnicity, political opinions, biometrics). Please do not include such data in the free-text fields.

Fields marked as required are the minimum we need to process your request or order. Everything else is optional and leaving it blank never results in a refusal of service.

3.Purposes, legal bases and retention periods

We process personal data only where Article 6 GDPR gives us a lawful basis:

Purpose	Legal basis	Retention
Reviewing a charging-station request, site survey, quotation and scheduling the installation	Steps taken at your request prior to entering into a contract — Art. 6(1)(b)	12 months from the last contact if no contract follows
Concluding and performing a plan, installation and maintenance agreement	Performance of a contract — Art. 6(1)(b)	The term of the agreement plus 5 years after it ends (general limitation period)
Accepting, processing, charging for and delivering a shop order	Performance of a contract — Art. 6(1)(b)	5 years from completion of the order
Issuing and keeping accounting and tax records	Legal obligation — Art. 6(1)(c) (Bulgarian Accountancy Act, VAT Act, Tax Procedure Code)	10 years, under Art. 12 of the Accountancy Act
Handling claims, returns and withdrawals	Legal obligation — Art. 6(1)(c) (Consumer Protection Act)	3 years after the case is closed
Answering an enquiry by e-mail, phone or the contact form	Legitimate interest — Art. 6(1)(f) (communicating with prospective and existing customers)	12 months from the last message
Preventing spam, abuse and fraud (reCAPTCHA, Stripe risk checks, server logs)	Legitimate interest — Art. 6(1)(f) (security of the service)	up to 12 months
Measuring traffic and advertising performance	Consent — Art. 6(1)(a)	Until consent is withdrawn or the relevant cookie expires
Establishing, exercising or defending legal claims	Legitimate interest — Art. 6(1)(f)	Until the dispute is finally resolved and limitation periods expire

Once these periods expire the data is deleted or irreversibly anonymised. Where several periods apply to the same data, the longest one governs.

4.Who we share data with

We never sell or rent personal data. We share it only with providers who help us deliver the service, act on our documented instructions as processors and are bound by confidentiality:

Recipient	Why	What data
Econt Express OOD, company no. 117047646, Ruse, Bulgaria	Delivering orders, issuing waybills and tracking shipments	Name, phone, e-mail, delivery address or office, parcel weight and description
Stripe Payments Europe, Ltd. (Ireland)	Card payment processing and fraud prevention	Name, e-mail, amount, card details (entered directly with Stripe — they never reach our servers)
Supabase, Inc.	Database and secure file storage for orders, requests and uploaded photos	All data you enter in forms and orders
Vercel, Inc.	Website hosting and content delivery network	Technical logs, IP address, request data
Google Ireland Limited	Maps and address picking (Google Maps), bot protection for forms (reCAPTCHA) and — only with consent — Google Analytics	IP address, cookie identifiers, interaction with the map and forms
Meta Platforms Ireland Limited	Advertising measurement through Meta Pixel and the Conversions API — only where marketing consent has been given	Cookie identifiers, IP address and, on an order, irreversibly hashed e-mail and phone
E-mail (SMTP) provider	Sending order and request confirmations	Name, e-mail and the content of the message
Accountants, banks, installation partners	Bookkeeping, settlement of payments and carrying out the on-site installation	Invoicing data and the data needed for the installation

We may also disclose data to competent public authorities (courts, prosecution, tax administration, the Consumer Protection Commission, the Data Protection Commission) where the law requires it.

5.Transfers outside the EU and the EEA

We aim to keep processing within the European Economic Area. Some of our providers (Supabase, Vercel, Google, Meta, Stripe) belong to groups with US entities, and access from there is possible.

Where that happens, the transfer is protected by the European Commission's Standard Contractual Clauses under Art. 46(2) GDPR and/or by the EU–US Data Privacy Framework, together with additional technical measures such as encryption in transit and at rest. We can tell you which mechanism applies to a given provider on request.

6.Cookies and tracking technologies

The site uses strictly necessary cookies, which cannot be switched off, and optional analytics and marketing cookies that we load only after your explicit consent given through the banner on your first visit.

You can change or withdraw that choice at any time via the “Cookie preferences” button in the footer of every page. The full list of cookies, their providers, purpose and lifetime is set out in the Cookie Policy.

7.Your rights

As a data subject you have the following rights under the GDPR:

Right of access (Art. 15) — to confirmation of whether we process your data and a copy of it.
Right to rectification (Art. 16) — to have inaccurate data corrected and incomplete data completed.
Right to erasure / “to be forgotten” (Art. 17) — where the data is no longer needed, you withdraw consent, or processing is unlawful.
Right to restriction of processing (Art. 18) — for example while we verify the accuracy of the data.
Right to data portability (Art. 20) — to receive the data you provided in a structured, machine-readable format.
Right to object (Art. 21) — to processing based on legitimate interest, and at any time to direct marketing.
Right to withdraw consent (Art. 7(3)) — at any time, without affecting the lawfulness of processing before the withdrawal.
Right not to be subject to a decision based solely on automated processing (Art. 22).
Right to lodge a complaint with a supervisory authority (Art. 77).

To exercise a right, write to sales@gigacharger.net or to 16 Tsarkovna Nezavisimost St, 7000 Ruse, Bulgaria. We reply free of charge within one month of receiving the request; for complex or numerous requests that period may be extended by two further months, and we will tell you if it is. We may ask for extra information to verify your identity — solely so that we never hand your data to someone else.

If you believe your rights have been infringed you may complain to the Commission for Personal Data Protection — 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, Bulgaria, tel. +359 2 915 3518, kzld@cpdp.bg, www.cpdp.bg, and you may also seek redress before the courts.

8.Automated decisions and profiling

We do not take decisions producing legal or similarly significant effects on you by automated means alone. Station requests and orders are always reviewed by a member of staff.

Automated checks run for security only — reCAPTCHA assesses whether a form is submitted by a human, and Stripe scores the fraud risk of a payment. If such a check blocks your request, contact us and we will process it manually.

9.Data security

We apply technical and organisational measures proportionate to the risk: an encrypted connection (HTTPS/TLS) across the whole site, encrypted storage in the database, role-based admin access with individual accounts, separated development and production environments, regular backups and data minimisation.

We never enter, process or store bank card details — all payment information is entered in a secure form hosted by Stripe, a PCI DSS certified provider.

In the event of a security breach likely to result in a high risk to your rights, we will notify you without undue delay and inform the Commission for Personal Data Protection within 72 hours, as required by Articles 33 and 34 GDPR.

10.Children's data

GigaCharger's services and online shop are intended for people aged 18 and over. We do not knowingly collect children's data. If we learn that we have received such data without the consent of the holder of parental responsibility, we delete it immediately.

11.Changes to this policy

We may update this policy when our services, providers or the law change. The current version is always available at this address, and the date of the last revision is shown at the top of the page.

For material changes we will post a prominent notice on the site, and where processing relies on consent we will ask for your consent again. Related documents: General Terms and Conditions and Cookie Policy.