Privacy Policy and Personal Data Protection

Scope – Enquiries, quotations and related communication.
Last updated – Date of publication.

Who is responsible for processing your data

The data controller for the activities described herein is “DRAGANOVI S-IE” General Partnership, UIC 020595769, with registered address at 1A Georgi Dimitrov Street, 4148 Krislovo village, Maritsa Municipality, Plovdiv Region, Bulgaria.

For questions regarding personal data and the exercise of your rights, you can contact us at sddraganovi@abv.bg or at the postal address indicated above.

What this policy covers

This policy explains how we process personal data when you contact us regarding tractors, agricultural implements, spare parts or servicing, and when we prepare or follow up on a quotation requested by you.

This includes communication through draganovi.bg, email, telephone, and our Facebook page “СД Драганови С-ие” and Messenger.

The policy also covers the internal organisation of enquiries and quotations by machinery model and service stage. For other activities and for website cookies, we provide additional information depending on the specific processing activity.

What data we collect

We process the information you provide, including your name, telephone number, email address, company name and professional role, the content of your enquiry, the machinery you are interested in, details required for the quotation, and subsequent communications.

You are not required to provide your national identification number (EGN), a copy of your identity card or sensitive personal data in order to receive general product information.

When you contact us through Facebook or Messenger, we may receive your profile name, the user identifier associated with the relevant page, conversation and message identifiers, interaction timestamps, and service-related labels.

We use your telephone number or actual email address where these have been provided or are available for the specific interaction. A technical address ending in @facebook.com is not treated as your actual correspondence email address.

The data primarily comes from you and from your interactions with our Facebook page. Your professional contact details may also be provided by the organisation you represent. In such cases, we provide the applicable information at the first contact and, in any event, within the time limits set out in Article 14 of the GDPR.

Whether providing the data is necessary

Providing personal data for an enquiry is not a general legal obligation. We need sufficient information about the subject of your enquiry and a way to respond to you. Without this information, we may be unable to prepare or send the requested quotation.

We do not require consent to unrelated marketing activities as a condition for responding to your enquiry.

Purposes and services used

Why we use your data and the legal basis for processing

When you are an individual and a prospective party to a contract, processing your data to respond to your enquiry and prepare a quotation is necessary in order to take steps at your request prior to entering into a contract – Article 6(1)(b) of the GDPR.

When you represent a company, we use your professional contact details to communicate with you on the basis of our legitimate interest in handling the company's enquiry.

On the same basis, we organise correspondence, follow up on quotations, prevent duplicate records, and protect our systems and legal rights – Article 6(1)(f) of the GDPR. We assess the necessity of such processing and its impact on your rights. You may object to this processing on grounds relating to your particular situation.

Where a contract has been concluded, we process the necessary data for its performance. Where applicable law requires documentation or data retention, we process the data to comply with the relevant legal obligation – Article 6(1)(c) of the GDPR.

Responding to a requested enquiry does not mean that you are subscribed to receive future marketing communications. If we offer a separate subscription, we will specify its purposes and the applicable legal basis. Where consent is required, it will be separate, voluntary and easy to withdraw.

How we organise quotations

When the integrated system is used, information from Messenger is transferred through Make to a restricted internal register in Google Sheets.

We record the necessary contact details or conversation identifiers, machinery model, quotation stage and date of the relevant action. The purpose is to enable our employees to follow up on customer service and avoid duplicate work.

By default, we do not need to copy the entire conversation.

The model label helps organise communication and does not, by itself, prove a purchase or establish that the enquiry originated from a particular advertisement.

In the process described herein, we do not make decisions producing legal effects or similarly significant effects concerning you based solely on automated processing. Quotations are assessed and actions are taken by an employee.

Who may have access to your data

Access is granted to employees who need the information to handle your enquiry, as well as to providers of the communication, integration and cloud services we use.

For the process described herein, these include:

Meta – for Facebook and Messenger;
Make – for the integration service;
Google – for the selected spreadsheet and storage services.

Where necessary and subject to an applicable legal basis, data may also be disclosed to professional advisers and competent authorities.

Where a service provider processes personal data on our behalf, the relationship is governed by the requirements of Article 28 of the GDPR.

Meta Platforms Ireland Limited also processes data for its own purposes in accordance with Meta's privacy policy. This policy does not replace Meta's own platform privacy information.

Transfers outside the European Economic Area

Cloud services may involve the storage of or access to personal data from countries outside the European Economic Area (EEA).

Any such transfer is carried out only where an applicable mechanism under Chapter V of the GDPR is in place, such as an adequacy decision or Standard Contractual Clauses together with the necessary supplementary measures.

You may request information about the safeguards applicable to a particular service and how to obtain a copy of them by contacting us using the details provided above.

Data retention and your rights

How long we retain your data

Data relating to completed enquiries and quotations that have not resulted in a contract is retained for up to 12 months following the last substantive communication, after which it is deleted or irreversibly anonymised.

New genuine communication relating to the enquiry may require the retention period to be updated. An automatic technical action does not, by itself, extend the retention period.

In the event of a transaction, warranty service, legal obligation or dispute, we retain only the data necessary for the relevant purpose, for the applicable statutory retention period or until the claim has been finally resolved.

We do not apply one general retention period to all documents.

For requests concerning data protection rights, we retain the evidence necessary to document how the request was handled, for the period required to protect against potential legal claims.

Technical logs are retained only for as long as necessary for security and troubleshooting purposes, in accordance with the settings of the relevant service.

Deleted data may temporarily remain in secure backup copies until their scheduled rotation. Such data is not used for ongoing customer service. If data is restored from a backup, the deletion already performed is applied again.

What rights do you have

Subject to the conditions set out in the GDPR, you have the right to request access to and a copy of your personal data, rectification, erasure, restriction of processing and data portability, where applicable.

You have the right to object to processing based on legitimate interests on grounds relating to your particular situation.

Where personal data is processed for direct marketing purposes, you have the right to object at any time, and processing for that purpose will cease.

Where processing is based on consent, you may withdraw your consent at any time. This does not affect the lawfulness of processing carried out before the withdrawal.

The right to erasure is not absolute. For example, certain data may need to be retained to comply with a legal obligation or to establish, exercise or defend legal claims.

How to exercise your rights

You can contact us at sddraganovi@abv.bg, by post at our registered address, or through Messenger on our Facebook page “СД Драганови С-ие”.

Please specify the action you are requesting and provide sufficient information to enable us to identify the relevant correspondence.

If we have reasonable doubts about your identity, we may request only the additional verification necessary to confirm it.

We respond without undue delay and, in any event, within one month of receiving your request.

Where necessary, due to the complexity or number of requests, this period may be extended by up to a further two months. We will inform you of any extension and the reasons for it within the initial one-month period.

Requests are generally handled free of charge. Statutory exceptions apply only under the conditions set out in the GDPR.

You may lodge a complaint with the Commission for Personal Data Protection (CPDP) – 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592, Bulgaria, https://cpdp.bg/, or with another competent supervisory authority.

Security and changes to this policy

We implement organisational and technical measures appropriate to the risks, including restricted employee access, account protection and controls over data sharing.

We update this information whenever our data processing activities change. Where a significant new purpose of processing is introduced, we provide the required information before that processing begins.