Privacy Policy

This Privacy Policy applies to all visitors of the website www.my-sap.com and customers of the Services provided by SAPA GERMANY LTD in the sense of the General Terms of Use of our Website and the General Terms and Conditions of Purchase.

I. Controller of your personal data

(1) The controller of your personal data is SAPA GERMANY LTD, Company № 207962002, with registered office and management address: Bulgaria, Sofia city, p.c. 1715, Mladost district, MLADOST 4, bl. 465, entry 4, fl. 1, apt. 71, represented by the manager Aylin Durmush (referred to for short as "the Controller", "We", "Us").

(2) For questions related to the protection of your personal data, you can contact us at the following e - mail address info@my-sap.com .

II. Basic principles for personal data protection

We are committed to processing your personal data in compliance with all legal requirements under Regulation (EU) 2016/679 (abbreviated as "GDPR") and the Bulgarian Personal Data Protection Act. The main principles we follow are related to your personal data being:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);

(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes (‘purpose limitation’);

(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);

(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (‘storage limitation’);

(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

III. Your personal data and purposes – General terms

(1) The processing of your personal data begins only after the successful completion of an order by you under the terms and conditions specified in our General Terms and Conditions of Purchase.

(2) You enter your personal data yourself in the online form provided by us, therefore you guarantee that they are current and accurate at that time. In case of inaccuracy of the personal data entered by you and there is a need to update the data, you guarantee that you will inform us in order to carry out a correction on our part.

(3) Personal data and purposes of processing:

3.1. When visiting the website www.my-sap.com we collect data about your device (computer, phone, tablet, etc.), including your IP address, the browser you use and your language settings, in which case this data is anonymous and does not allow you to be identified.

The legality of the processing is based on Article 6, par. 1, (f) of the GDPR as it is necessary for the purposes of the legitimate interests of the Controller. We believe that we have an interest in analyzing the usability of our Website and the level of user satisfaction, as we understand that the processing of this data is also beneficial to you, since the aim is to improve the user experience and provide a service with a higher quality.

3.2. Upon successful completion of an order for a Service/s provided by us as a "Guest", we collect your following general personal data:

- Physical identity: e - mail address

The legality of the processing is based on Art. 6, par. 1, (b) of the GDPR , as the information is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to the conclusion of a contract. The above-mentioned personal data are also processed on the basis of Art. 6, Par. 1, (f) of the GDPR , due to the existence of a legitimate interest of the Controller to determine a longer term for data storage, for the purpose of protection in the event of a judicial or extrajudicial claim.

3.3. When registering a user profile on our Website, we collect the following general personal data about you:

- Physical identity /required to fill in/: Two names and e - mail address

- Contact data /optional/: contact phone number and correspondence address (when requesting an invoice)

The legality of the processing is based on Art. 6, Par. 1, (b) of the GDPR , as the information is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to the conclusion of a contract. The above-mentioned personal data are also processed on the basis of Art. 6, Par. 1, (f) of the GDPR , due to the existence of a legitimate interest of the Controller to determine a longer period of data storage, for the purpose of protection in the event of a judicial or extrajudicial claim.

3.3. Attaching an image/photo to a user profile

As a registered user you can choose and attach an image/photo for your profile at your own request. In the event that you choose to use your own photo, we will process your biometric personal data that falls under the category of sensitive personal data under the GDPR .

We process this data on the basis of Art. 6, Par. 1, (a) of the GDPR – explicit consent, which we consider that you have given by informing yourself in advance of this Policy and attaching, at your own discretion, your image to your profile on our Website . You can withdraw your consent at any time by deleting the attached photo. From this point on, we will stop processing your personal data.

3.4. With your explicit consent , we process your e - mail address for the purposes of preparing and sending marketing messages, such as brochures, surveys, giving individual discounts and information about campaigns conducted by us, etc. We will also process any other information voluntarily provided by you on this occasion.

With this Policy, we would like to inform you that you can withdraw the given consent at any time and we will stop processing the above personal data for the stated purposes and sending marketing messages by sending us your explicit refusal in writing to the following e - mail address : info@my-sap.com

(4) Your data is not subject to transfers to countries outside the European Union (EU) and the European Economic Area (EEA). In exceptional cases, solely for the purposes described above, we may transfer your personal data to a third party located outside the EU or EEA, but in all cases the transfer of your personal data will be carried out in accordance with the requirements of Chapter V of GDPR .

(5) The Controller does not use automated individual decision-making, including profiling, when processing your personal data.

IV. Usage of the "Cookies"

We use "cookies" to collect specific information from all users, including visitors to our Website. More information about them can be found in our Cookie Policy, available on the Home Page of www.my-sap.com .

V . Recipients of your personal data

providers of IT services, hosting services for implementation and maintenance of the Services provided by us;
service providers for the purposes of measuring and tracking user behavior on the sites, sending email messages, sharing content by users, etc. These companies may be or are (non-exhaustively):

- Google (with Google Analytics, Google Tag Manager, AdManager, AdX, AdSense, AdWords, Google Plus): https://privacy.google.com

- Facebook (with Facebook Tracking Pixel, Facebook Tools – Plug-in "like" button, Sign in with Facebook profile, etc.) : https://www.facebook.com/privacy/

- LinkedIn: https://www.linkedin.com/legal/privacy-policy

- Twitter widgets: https://twitter.com/en/privacy

- Viber: https://www.viber.com/terms/viber-privacy-policy/

- Telegram: https://telegram.org/privacy/eu

- Whats app: https://www.whatsapp.com/legal/privacy-policy

companies providing postal services and deliveries (couriers) for the purposes of communication between you and the Controller;
archive management providers;
all appropriate state and investigative bodies having the right of access to the relevant information processed by the Controller;
subcontractors of the Controller who are processors of personal data, according to a contract concluded with the Controller and according to the instructions of the Controller, using only processors of personal data who provide sufficient guarantees for the implementation of appropriate technical and organizational measures for compliance with the GDPR ;
external consultants and auditors, disclosing only the amount of personal data that is necessary to assist and provide services, according to a contract concluded with the Controller;
recipients of your personal data may also be third parties in the event that the Controller has an obligation to disclose or share them, in order to comply with a legal obligation, in order to protect rights, property or safety or in connection with contractual and legitimate interests.

In case you want additional information about whether your personal data has been provided to specific recipients of personal data, you can send us a written inquiry to the following e - mail address: info@my-sap.com .

VI . Storage periods

(1) General provisions:

1.1. The Controller processes your personal data for the terms established by the legislation in force in the country and by the regulatory supervisory authorities. After the expiration of the legally/regulatory terms, the Controller will delete your personal data.

1.2. Personal data for which there is no express legal/supervisory storage obligation will be deleted after the purposes for which it was collected and processed have been achieved.

1.3. If the storage of your data is necessary for a pending proceeding to which the Controller is a party, your data will be kept until the conclusion of this proceeding, as well as until the expiration of the relevant limitation periods for legal proceedings provided for in the legislation of the Republic of Bulgaria.

1.4. The Controller processes your personal data in accordance with the above-mentioned purposes, grounds and terms, collecting them in a minimum volume and for clearly defined storage purposes and terms. A limited number of entities have access to the information in order to ensure the security of your personal data.

(2) Time Limits

2.1. For the purposes of the execution of the contract concluded between you and SAPA GERMANY LTD, your personal data is processed for the period of validity of the same. However, the Controller sets a longer storage period - 5 (five) years, which starts to run after the termination of the contract, in order to pursue legitimate goals for the purpose of protection when presenting a judicial or extrajudicial claim. The determination of the duration of the specified storage period is subject to the general rules of the statute of limitations according to the Bulgarian legislation.

2.2. For tax and accounting purposes, We will store your personal data for the prescribed period according to the applicable legislation.

2.3. For the purposes of sending marketing messages, brochures, surveys, giving individual discounts and information about campaigns conducted by us, We will store your personal data for as long as your express consent lasts.

2. 4. For the purposes of using cookies, the data is stored for the period of validity for which the respective cookie is saved. You can control and/or delete cookies at any time through the settings of your browser.

VII . Your rights as a data subject:

(1) You have the right to:

Right to access to your personal data;
Right to rectification if your personal data is inaccurate;
Right to erasure (‘right to be forgotten’) if the period determined by law or the Controller has expired in relation to the same;
Right to data portability (between individual Controllers);
Right to object of processing of your personal data (the Controller will stop processing the data only when he is convinced that his interest does not prevail in the specific situation)
Restriction of the processing of your personal data, provided that the accuracy of the data is disputed by you and the processing is unlawful, but you refuse to delete it and the Controller no longer needs the data, but you require it for the establishment, exercise or defense of legal claims , or you have filed an objection against their processing according to Article 21 of the GDPR ;
You have the right not to be subject to a decision based solely on automated processing, including profiling, which gives rise to legal consequences for the data subject or similarly significantly affects the data subject;
Right to legal or administrative protection through the Bulgarian Commission for the Protection of Personal Data, with address: Sofia 1592, "Prof. Tsvetan Lazarov" № 2 and e - mail address kzld@cpdp.bg in case your rights have been violated.

(2) You can exercise the above rights by sending us a written application using a template or in free text by e - mail info@my-sap.com You can find the application form ..

(3) In exercising your rights as a data subject, we do not require the payment of fees. However, we would like to inform you that in accordance with the law, we may in certain cases require the collection of such if your requests are clearly unfounded and/or excessive, in particular due to their repetition, or refuse to take action on your request.

(4) In the event that you choose to send a response to your application to a correspondence address and/or office of a shipping company/postal courier, you are responsible for paying all shipping costs.

(5) We would like to inform you that we will make reasonable efforts to comply with your request within 30 days of receiving it. If necessary, this term can be extended by another two months, depending on the complexity and number of requests.

(6) In certain cases, we may ask you for specific information that will enable us to verify your identity and to respect your right to access the information (or any of your other rights). This is an appropriate additional security measure to ensure that your personal information is not disclosed to persons who do not have the right to receive it.

VIII . Information for non-EU citizens

(1) The described legal regulation is based on Regulation (EU) 2016/679, which applies only to citizens of member states of the European Union and European economic citizenship.

(2) However, the provision of our Services is not limited to users who are EU citizens. We would like to hereby inform you, in case you are a citizen of a non-EU country, that we will comply with this Privacy Policy and apply the same technical and organizational security measures to your personal data.

(3) Please note that some foreign jurisdictions require the express acceptance of this Privacy Policy in connection with the protection of your personal data. By familiarizing yourself with and marking the " checkbox " space when making a purchase of Service/s on our Website, you declare that you have given your consent to the application of this Policy in relation to you as an individual.

(4) For more information about the protection of your personal data and the applicable law for your country, you can contact us at the following e - mail address info@my-sap.com

SAPA GERMANY LTD, in its capacity as the Controller of personal data, reserves the right to change this Privacy Policy at any time. Changes will be communicated by placing a notice on this website.

This Privacy Policy enters into force from 16.01.2025

Last update: 2025

APPLICATION FOR EXERCISE OF RIGHTS AS A DATA SUBJECT UNDER REGULATION (EU) 2016/679

From ................................................ ................................................ ...................................

(first and last name)

contact phone number ............................................, e- email ……………….

*Data for data subject representative:

................................................ ................................................ ........................................

(first and last name)

Power of Attorney ................................................... ................................................ ...................

contact phone number ............................................, e- email ……………….

On the basis of Art. 12-Art. 22 of Regulation (EU) 2016/679, I declare my desire to exercise my rights regarding the protection of my personal data, processed by SAPA GERMANY LTD, Company No 207962002.

I wish to exercise the following rights:

☐ Access request

☐ Rectification request

☐ Request for erasure (right to be forgotten)

☐ Request for restriction of processing

☐ Objection to processing

☐ Request for information about recipients of personal data in cases of correction or deletion of personal data or ☐ restriction of processing

☐ Request to exercise the right to portability of personal data

☐ Request not to be subject to a decision based solely on automated processing involving profiling □

Please describe in relation to which of your personal data you wish to exercise the right(s) noted above:

……………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………..

How do you would like to receive our response?

☐ I want to receive the requested personal data at an email address ...................................

☐ I want to receive the requested personal data at the address for correspondence: .........................................................................................................................................

by shipping company/postal courier ...................................................................................

□ In another way ................................................................................................................

Date: ……………… ………………………………

/name, surname, signature/

Privacy Policy

Cookie Policy

Website terms

Purchase Terms

Privacy Policy