Privacy Policy
This Privacy Policy explains how Capilux Medical collects, uses, stores, shares and protects personal data when you visit our website, create an account, place an order, request information or otherwise interact with us.
Data Controller
ul. “Lachezar Stanchev” 5
Tower A, Floor 61
1756 Sofia, Bulgaria
1. About This Privacy Policy
Capilux Medical respects your privacy and is committed to protecting personal data in accordance with applicable data protection law, including Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), where applicable.
This Policy applies to customers, prospective customers, website visitors, account holders, business contacts and other persons who interact with Capilux Medical through our website or commercial services.
2. Personal Data We May Collect
Depending on how you interact with us, we may collect the following categories of personal data:
- Name and surname
- Company name and business contact details
- Billing and shipping address
- Email address
- Telephone number
- VAT number, company registration number and invoicing information
- Order history and transaction details
- Products viewed, purchased or requested
- Account information and login details
- Customer service and support communications
- Return, refund, complaint and warranty information
- IP address and technical device information
- Browser type, operating system and website interaction data
- Cookie identifiers and similar online identifiers
- Marketing preferences and consent records
3. Information You Provide to Us
We collect information that you voluntarily provide when you create an account, place an order, submit a quotation request, contact customer support, subscribe to communications, complete forms or otherwise communicate with us.
4. Information Collected Automatically
When you visit our website, certain technical information may be collected automatically through server logs, cookies and similar technologies.
This may include your IP address, device type, browser information, approximate location derived from IP data, referral source, pages visited and website interaction information.
5. How We Use Personal Data
We may process personal data for purposes including:
- Processing and fulfilling orders
- Managing customer accounts
- Issuing invoices and maintaining accounting records
- Processing payments and preventing payment fraud
- Arranging shipping, customs and delivery services
- Handling returns, refunds, warranties and complaints
- Responding to customer enquiries
- Providing quotations and commercial information
- Operating, protecting and improving our website
- Preventing fraud, abuse and security incidents
- Complying with legal, tax and regulatory obligations
- Sending marketing communications where legally permitted
- Measuring website performance where permitted by applicable cookie rules
6. Legal Bases for Processing
We only process personal data where we have a lawful basis to do so. Depending on the purpose, this may include:
- Performance of a contract: where processing is necessary to process an order, arrange delivery, manage an account or provide a requested service.
- Legal obligation: where processing is required for tax, accounting, regulatory, fraud-prevention or other legal requirements.
- Legitimate interests: where necessary for reasonable business purposes such as website security, fraud prevention, customer service or improving our operations, provided your rights and freedoms do not override those interests.
- Consent: where applicable, including certain marketing, analytics or advertising activities.
7. Payment Information
Online payments may be processed by authorised third-party payment service providers.
Payment providers may receive information necessary to authorise, authenticate and process a transaction, such as billing information, transaction amount and payment-related identifiers.
Capilux Medical does not intend to store full payment card numbers or card security codes directly on its own systems where payment processing is handled by a payment service provider.
The identity and privacy information of the payment provider will be updated when the applicable online payment service has been activated.
8. Orders and E-Commerce Data
When you place an order, we process the information necessary to create, confirm, fulfil and record the transaction.
This may include your contact information, delivery address, billing information, purchased products, transaction status and related correspondence.
10. WooCommerce and Website Infrastructure
Our website may use WordPress, WooCommerce and related technologies to operate the online store, manage customer accounts, process orders and provide website functionality.
These technologies may process technical, account and order information necessary to provide the relevant functionality.
12. Marketing Communications
Where permitted by law, we may use contact information to send information about products, offers or services.
Where consent is required, marketing communications will only be sent after the required consent has been obtained.
You may unsubscribe from marketing communications at any time using the unsubscribe mechanism provided or by contacting us.
13. Data Retention
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to satisfy applicable legal, accounting, tax, contractual and regulatory requirements.
Retention periods may vary depending on the category of information and the applicable legal obligation.
When personal data is no longer required, it will be deleted, anonymised or otherwise securely disposed of where appropriate.
14. International Data Transfers
Some service providers may process information in countries outside the European Economic Area.
Where personal data is transferred internationally, Capilux Medical will take appropriate measures required by applicable data protection law, such as relying on an adequacy decision, appropriate contractual safeguards or another lawful transfer mechanism where required.
15. Data Security
We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.
However, no internet transmission or electronic storage system can be guaranteed to be completely secure.
16. Account Security
Customers are responsible for maintaining the confidentiality of their account credentials and for notifying Capilux Medical if they reasonably suspect unauthorised access to their account.
17. Your Data Protection Rights
Subject to the conditions and limitations provided by applicable law, you may have the right to:
- Request access to your personal data
- Request correction of inaccurate or incomplete data
- Request erasure of personal data in applicable circumstances
- Request restriction of processing
- Object to certain processing
- Receive certain personal data in a portable format
- Withdraw consent where processing is based on consent
- Object to direct marketing at any time
- Lodge a complaint with a competent supervisory authority
18. Exercising Your Rights
To exercise a data protection right, contact us at info@capiluxmedical.com.
We may request information reasonably necessary to verify your identity before responding to a request.
19. Automated Decision-Making
Capilux Medical does not currently intend to make decisions producing legal or similarly significant effects on customers solely through automated processing.
Payment or fraud-prevention providers may use automated risk assessment tools as part of their services. Where applicable, further information may be provided by the relevant service provider.
20. Children’s Privacy
Our online store is intended for customers capable of entering into legally binding purchase transactions and is not directed specifically at children.
We do not knowingly seek to collect personal data from children for marketing purposes.
21. Links to Third-Party Websites
Our website may contain links to third-party websites or services. Capilux Medical is not responsible for the privacy practices of external websites. Users should review the privacy information provided by those third parties.
22. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our operations, technologies, service providers or legal requirements.
The latest version will be published on this page together with the applicable update date.
23. Privacy Contact
24. Supervisory Authority
Individuals may have the right to lodge a complaint with the competent data protection supervisory authority.
In Bulgaria, the national supervisory authority is the Commission for Personal Data Protection (CPDP).
Questions about your personal data?
Contact our team for privacy enquiries or requests relating to your data.