Privacy policy
Version:
This notice covers the portal's processing of personal data, including individual professional contacts and enquiries submitted to administrators.
1. Controller
For its own processing, the controller is СОЦИАЛНО ПРЕДПРИЯТИЕ БАРТ ЕООД, company number 203706824, 3 Tsar Asen Street, floor 1, apartment 1, Triaditsa, Sofia 1000, Bulgaria. Contact info@maxobazar.com, +359 898 454 540, or Contact administrators → Personal data. Independent sellers and service providers may act as separate controllers for their transactions and services.
2. Data categories
Sign-in provides an identifier, email and name. Personal features may process favourites, preferences, listings, messages and technical request data. Business profiles may include professional contacts, authority information and evidence documents you submit. Requests to providers contain the contact and fulfilment information you enter. Administrator enquiries contain name, email, subject, message, listing URL, category, dates and case developments. Do not submit personal identification numbers, bank passwords, health information or unnecessary documents.
3. Purposes and legal bases
Requested accounts, publications and services rely on contract or steps requested before a contract under GDPR Article 6(1)(b). Handling notices, data rights and applicable legal duties relies on Article 6(1)(c). Maintenance, security, abuse prevention and legal claims may rely on legitimate interests under Article 6(1)(f), subject to necessity and balancing against individual rights. Ordinary enquiries are handled for the requested communication and the legitimate interest in responding. Where consent is required under Article 6(1)(a), it must be separate, specific, freely given and withdrawable. Contacting us does not subscribe you to marketing.
4. Data from other sources
Profiles may contain names, professional contacts, business addresses, images or information supplied by applicants, official registers, business websites and other public publications. Public availability is not unrestricted permission to reuse personal data. Each category requires a suitable legal basis, necessity, accuracy checks and balancing of rights, with particular care for private listings. Information under GDPR Article 14 must be provided within the applicable period unless a legal exception is established. This page alone does not replace required individual notification. You may request the particular source, correction, restriction, erasure or object through the contact form.
5. Public and private information
Published profiles and listings are publicly accessible and may be indexed by search engines. Not every profile has been claimed or confirmed by its owner. Administrator enquiries, internal notes and private authority evidence are not published in the catalogue. A contact reference and private key reveal only that case's status and reply to the sender; protect both.
6. Recipients
Authorised administrators and necessary technical providers may access data: ChatGPT Sites/OpenAI and Cloudflare for hosting, databases, files, security and authentication. Information needed for a request you direct to a business is shared with that business. Authorities may receive data when legally justified. Loading a Google map sends technical connection data to Google; external websites apply their own policies. Remote image servers may receive an IP address and request details when serving their images.
7. Transfers outside the EEA
International providers may process data outside the European Economic Area. Such transfers must use an applicable adequacy decision or appropriate Chapter V GDPR safeguards, such as standard contractual clauses where appropriate. Contact the controller for the actual recipients, processing locations and applicable safeguards. Publication of this policy does not itself establish the necessary contractual safeguards.
8. Retention
Administrator enquiries and replies are retained for up to twelve months after the latest case activity, with necessary restricted retention where a legal dispute or statutory duty applies. Abuse prevention uses a daily HMAC identifier derived from an IP address, without storing the raw IP in the contact module; rate records older than 24 hours are removed at the next processing operation. Accounts and listings are retained while actively used or while necessary and lawfully justified as catalogue information. On closure, data without another applicable basis is erased or restricted. Transaction, accounting and legal claim data follow applicable statutory periods. Infrastructure logs follow the providers' applicable contractual and legal periods. Browser storage is described in the Cookies policy.
9. Your rights
Subject to GDPR conditions, you have rights of access and a copy, rectification, erasure, restriction, portability and objection to legitimate-interest processing. You may object to direct marketing at any time. Consent may be withdrawn without affecting earlier lawful processing. We respond without undue delay, normally within one month. A lawful extension of up to two further months is explained within the first month. If identity is uncertain, only necessary verification information is requested. No account or marketing consent is needed to exercise rights.
10. Complaints and security
You may complain to the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592, Bulgaria, kzld@cpdp.bg, https://cpdp.bg/, or another competent authority or court. Access controls and communication protections are used, without a promise of absolute security. Contact administrators if you suspect misuse. The contact form does not make solely automated decisions with legal or similarly significant effects; anti-spam controls do not replace human review.
11. Required fields and updates
Name, email, subject and description are needed for ordinary enquiries. The special anonymous notice category does not require identifying fields. Correction, removal and infringement notices need the exact content URL. Missing information may prevent a useful response but does not amount to consent for another purpose. The policy carries a version date and material changes are appropriately notified.