1. Who we are
PROMACH LTD (ПРОМАХ ЕООД) (“PROMACH”, “we”), UIC 208556296, Str. Kolednitsa 2, et. 1, 7002 Ruse, Bulgaria, is the controller of the personal data processed through promachwood.com. For any question about personal data, write to [email protected].
2. Scope
This policy applies to personal data we process when you visit the website, send a request through one of our forms, or contact us by e-mail, telephone or WhatsApp. The website presents woodworking machinery to companies and professionals. It is not an online shop: machinery is sold only on the basis of an individual quotation and a written contract. The personal data concerned is usually that of contact persons acting for a company.
3. What data we process and why
Most people who contact us act on behalf of a company. For them, the legal basis is our legitimate interest in communicating with the companies that are our customers, prospective customers and suppliers (Art. 6(1)(f) GDPR). Where you deal with us on your own behalf, for example as a sole trader, we rely instead on the contract or on steps taken at your request before a contract (Art. 6(1)(b) GDPR).
3.1 Requests for quotation (Contact form). Company, name, e-mail, telephone (optional), the PROMACH office you address (Bulgaria or Romania), preferred language, message and, where applicable, the machine and its code. We use them to answer you, prepare a quotation and discuss the requirement.
3.2 Technical support requests (Service form). Company, name, contact details, country, language, machine details and location, description of the issue and any files you upload. We use them to assess the request and organise support.
3.3 Offers to sell a used machine (Sell your machine form). Company or owner, name, contact details, machine details, location, condition, photographs and documents. We use them to evaluate the machine and discuss a possible purchase.
3.4 Direct correspondence. Data contained in e-mails, calls and WhatsApp messages, used to answer and to follow up on business matters.
3.5 Contracts and invoicing. Company data, contact persons and billing data, used to perform the contract with the company and to meet our legal obligations, including accounting and tax obligations (Art. 6(1)(c) GDPR).
3.6 Website operation and security. IP address and technical data recorded by our hosting and database providers when you load pages or send a form. Legal basis: our legitimate interest in operating and securing the website (Art. 6(1)(f) GDPR).
3.7 Usage statistics. PROMACH's own statistics, without Google Analytics or advertising tools, and only if you switch on “Usage statistics” in Cookie Settings. For each page you view, we record in our database (Supabase, Frankfurt): the page, the language, the machine category or machine code viewed, clicks on “Request a quote”, the device type (mobile, tablet or desktop) and a random session identifier. The identifier is kept in your browser only until you close the tab; the records already sent stay in our database for 24 months and are then deleted automatically. The records do not contain your name or e-mail and we do not build visitor profiles. We use them to understand which pages and machines are of interest. Legal basis: your consent (Art. 6(1)(a) GDPR). If you switch the statistics off in Cookie Settings, no further records are made.
Fields marked with * are needed to answer your request. Without them we cannot process it.
4. Marketing
Sending a request does not subscribe you to marketing messages. If we ever ask for your consent to marketing, we will do so separately, and you can withdraw it at any time.
5. Who receives the data
Service providers acting on our behalf, under data processing agreements: Supabase (database and file storage for website content and form requests; servers in Frankfurt, Germany); Resend (delivery of the e-mail notifications generated by the forms); Cloudflare (website hosting and delivery); our e-mail provider, for messages sent to our addresses.
Where needed to perform a delivery or service that has been agreed: technical specialists, service partners and transport companies. Our accountants, for invoicing. Public authorities, where the law requires it. We do not sell personal data.
6. Transfers outside the European Economic Area
Our database is located in the European Union (Frankfurt, Germany). Some service providers may process data outside the European Economic Area, including in the United States: Resend, for e-mail delivery, under the European Commission's standard contractual clauses included in its data processing agreement; Cloudflare, which hosts the website and delivers it through servers in many countries; Google, for YouTube videos you choose to load; and Meta, for messages you send us on WhatsApp. Cloudflare, Google and Meta are certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision.
7. How long we keep the data
Requests and correspondence that do not lead to a contract: 3 years from the last contact, then deleted automatically. Data related to a contract, a delivery or support: for the duration of the contract and afterwards for as long as Bulgarian accounting and tax law requires, or as long as needed to establish, exercise or defend legal claims. Usage statistics: 24 months, then deleted automatically. Technical logs: for the period set by our hosting and database providers for security purposes. Your cookie choice: in your browser, until you change or delete it.
8. Your rights
You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, to object to processing based on legitimate interest, and to withdraw your consent at any time where processing is based on consent. Write to [email protected]; we answer within one month. You also have the right to lodge a complaint with the Commission for Personal Data Protection (Bulgaria) or with the supervisory authority in the country where you live or work.
9. Security
We use technical and organisational measures appropriate to the data we process, including encrypted connections, access limited to authorised persons and separate administrator accounts.
10. Cookies
Information about cookies and similar technologies is in the Cookie Policy. You can change your choice at any time through Cookie Settings, in the website footer.
11. Changes
We may update this policy. The current version and the date of the last update are shown at the top of the page.