Last updated: November 5, 2026
1. General Information
This Privacy Policy explains how SMART ENGINE INVEST LTD. collects, uses, stores, and protects the personal data of visitors and customers of the online store https://dipetane-bg.com.
We respect your right to privacy and are committed to processing your personal data lawfully, fairly, and transparently, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR), the Bulgarian Personal Data Protection Act, and other applicable legislation.
This Privacy Policy applies when you browse our website, submit inquiries, register a customer account, place orders, make payments, arrange deliveries, return products, or exercise your consumer rights.
2. Data Controller and Contact Information
The controller responsible for processing your personal data is:
SMART ENGINE INVEST LTD.
СМАРТ ЕНДЖИН ИНВЕСТ ООД
СМАРТ ЕНДЖИН ИНВЕСТ ООД
- Company Registration Number (UIC/EIK): 208733152
- VAT Identification Number: BG208733152
- Registered Office and Address: Bulgaria, 9023 Varna, Vladislav Varnenchik District, Vladislav Varnenchik Residential Complex, Block 70, Entrance 3, Floor 3, Apartment 310
- Email: smartengine.invest@gmail.com
- Website: https://dipetane-bg.com
You may contact us at the email address above with questions regarding the processing of your personal data or to exercise your data protection rights.
3. Personal Data We Collect
Depending on how you use our online store, we may process the following categories of personal data.
3.1. When Placing an Order
When you place an order, whether as a guest or a registered customer, we collect the information necessary to process and fulfil it:
- Customer's or recipient's first and last name;
- Email address;
- Contact telephone number;
- Country, city, postal code, and delivery address;
- Selected courier, courier office, or delivery address;
- Ordered products, quantities, and prices;
- Selected payment method;
- Information regarding order, delivery, and payment status.
For orders placed on behalf of a legal entity, we may additionally collect the company name, Bulgarian Unified Identification Code (UIC/EIK), VAT identification number, billing address, and details of the responsible or authorised company representative, where applicable.
This information is used to receive, process, confirm, deliver, and account for customer orders.
3.2. When Registering a Customer Account
When creating a customer account, we process your name, email address, telephone number, addresses, and additional company details if you register a business account.
Passwords are not stored in readable form. They are stored using secure cryptographic password hashing.
Registered customers can manage their personal information and delivery addresses, and review the history and current status of their orders.
3.3. When Contacting Us
When you submit an inquiry through our contact form or by email, we may process your name, email address, telephone number, company name (where applicable), the content of your message, and any related correspondence.
3.4. When Requesting Withdrawal, Returns, or Complaints
When you exercise your consumer rights, we may process your order number, contact details, information about the returned product, supporting documents, your signature when using an electronic form, and bank account details where necessary for the lawful reimbursement of a payment.
Where the system generates a signed PDF document, it may be retained as evidence of the submitted request and its handling.
3.5. Technical Data Collected During Website Visits
To ensure the proper functioning and security of our online store, we may process technical information such as:
- IP address;
- Browser and device information;
- Pages visited;
- Date and time of access;
- Technical identifiers;
- Events related to website security and normal system operation.
Where the relevant functionality is enabled, approximate geographical information obtained from trusted technical sources may also be processed.
4. Purposes and Legal Bases for Processing
We process personal data only where an applicable legal basis exists under the GDPR.
Performance of a Contract — Article 6(1)(b) GDPR
We process personal data where necessary to perform a contract with you or to take steps at your request before entering into a contract.
This includes:
- Receiving and fulfilling orders;
- Creating and managing customer accounts;
- Communicating regarding purchases;
- Arranging deliveries;
- Processing payments;
- Responding to pre-contractual inquiries.
Compliance with a Legal Obligation — Article 6(1)(c) GDPR
We process personal data where necessary to comply with tax, accounting, and other applicable legal obligations, including the retention of legally required documents.
Legitimate Interests — Article 6(1)(f) GDPR
We may process personal data where necessary for our legitimate interests, subject to an appropriate assessment of those interests and the rights of the individuals concerned.
Such purposes may include:
- Protecting our information systems;
- Preventing fraud and misuse;
- Resolving technical issues;
- Establishing, exercising, or defending legal claims.
Consent — Article 6(1)(a) GDPR
Where required, we rely on your consent for optional functionality, including non-essential cookies, certain statistical activities, and external services that require prior permission.
Consent to optional functionality is not a condition for purchasing products from our online store.
5. Sharing Personal Data with Speedy AD
To fulfil customer orders, our online store uses the courier services of SPEEDY AD (СПИДИ АД), Bulgarian Company Registration Number (UIC/EIK) 131371780, with which the merchant maintains a contractual relationship.
When an order is created and processed for delivery through Speedy, we provide the personal data necessary to arrange and complete the delivery.
Such information may include:
- Recipient's first and last name;
- Contact telephone number;
- Email address, where required for delivery;
- City, delivery address, or selected courier office;
- Shipment and delivery information;
- Cash-on-delivery amount, where applicable;
- Shipment tracking number and tracking information.
Purpose of Data Sharing
The information is provided for the purposes of arranging and completing delivery, contacting the recipient, tracking the shipment, processing cash-on-delivery payments, and complying with applicable legal obligations.
Sharing the personal data necessary to fulfil an order is part of the contractual delivery process and does not require separate marketing consent.
For its courier and postal services, Speedy AD also processes certain personal data as an independent data controller, in accordance with its own legal obligations and contractual relationships.
You can review Speedy's Privacy Policy at:
Our online store does not share customer account passwords or complete bank card details with the courier.
6. Payment Processing Through BORICA
When you select online payment by bank card, the payment is processed through an integration with BORICA AD, together with the relevant participating banks and payment service providers.
Bank card information is entered and processed within the secure payment environment of the respective payment service provider.
Our online store does not store complete bank card numbers, CVV/CVC security codes, or other sensitive card authentication data.
To process orders and verify payment transactions, the online store may retain:
- Transaction identifier;
- Payment status;
- Transaction amount;
- Currency;
- Transaction date;
- Technical information necessary for verification, refunds, and accounting.
Payment service providers process personal data in accordance with their own applicable privacy policies and legal obligations.
7. Other Recipients of Personal Data
Where necessary and lawful, certain personal data may be shared with:
- Hosting and server infrastructure providers;
- Email and communication service providers;
- Technical maintenance and support providers;
- Accounting and legal advisers;
- Courier and payment service providers involved in the relevant order;
- Competent public authorities where a legal basis exists.
Only the information necessary for the relevant service or legal obligation is disclosed.
Where a service provider processes personal data on our behalf, we apply the contractual and organisational requirements prescribed by the GDPR.
8. Cookies and Technical Identifiers
Our online store uses cookies to support the proper functioning of the shopping cart, customer sessions, form security, and privacy preferences.
8.1. Essential Cookies
| Cookie | Purpose | Duration |
|---|---|---|
| dipetane_cart | Stores an opaque shopping cart identifier | Up to 24 hours from the first product added |
| Session cookie | Supports login, sessions, and essential functionality | According to session settings |
| CSRF identifiers | Protect forms and requests against unauthorised submissions | According to technical settings |
| dipetane_privacy | Stores privacy preferences | Up to 180 days |
| dipetane_privacy_csrf | Protects changes to privacy preferences | Up to 20 minutes |
These cookies are necessary to support the normal and secure operation of the website.
8.2. Optional Statistics
With your consent, the website may use the dipetane_source cookie, which stores a random identifier until the next midnight in the Europe/Sofia time zone.
This cookie supports limited statistical reporting about the origin of website visits, such as:
- Google;
- Facebook;
- Direct visits;
- Other sources.
Only limited categories of information are retained, including the traffic source, page category, and date.
We do not store full referring URLs, advertising click identifiers, or search queries for this purpose.
As of the date of this Privacy Policy, the online store does not use Google Analytics, Meta Pixel, or any external analytics SDK.
8.3. External Maps and Services
When interactive maps or other external components provided by Google or courier service providers are used, certain technical information, including your IP address, may be transmitted to the respective provider.
Where such functionality requires prior consent, the external component is loaded only after you have provided the necessary permission.
8.4. Managing Your Cookie Preferences
You may change or withdraw your privacy preferences at any time using the privacy settings link in the website footer.
Rejecting non-essential cookies does not prevent you from browsing the online store or placing orders.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
9. Personal Data Retention Periods
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected or to comply with applicable legal obligations.
Information relating to orders, invoices, and accounting transactions is retained in accordance with the applicable statutory requirements.
Under Article 12 of the Bulgarian Accountancy Act, certain accounting registers, financial statements, and documents relevant to tax control are subject to a 10-year retention period, calculated from 1 January of the following reporting period.
Customer account information is processed for as long as the account is required to provide the service. Following account closure, only information for which another lawful basis for retention exists will be retained.
Inquiries, technical logs, statistical records, and information submitted through forms are retained according to their purpose, the need to protect legitimate interests, and applicable internal policies.
The expiration of a cookie does not necessarily mean that all related server-side records or backup copies are automatically deleted.
Deletion or restriction of personal data is carried out in accordance with applicable requirements and the technical capabilities of the system, including manual processing of requests where necessary.
10. Personal Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, unlawful alteration, loss, or disclosure.
Our security measures include:
- Secure HTTPS communication;
- Access control mechanisms;
- Restricted administrative permissions;
- Secure password protection;
- Application and infrastructure security measures.
Access to personal data is limited to individuals who require it to perform their duties.
Although no information system can guarantee absolute security, we strive to maintain safeguards appropriate to the nature and risks of the processing activities.
11. International Transfers of Personal Data
The primary market of our online store is the Republic of Bulgaria.
When external technology service providers are used, certain personal data may be processed or accessed outside the European Economic Area (EEA).
Where an international transfer takes place, it must have an applicable legal basis and the appropriate safeguards required under Chapter V of the GDPR.
These safeguards may include an adequacy decision or appropriate contractual and other measures, where necessary.
Information about the safeguards applicable to a particular transfer may be requested using the contact details provided in this policy.
12. Your Rights Under the GDPR
Under the GDPR, and subject to the applicable legal conditions, you have the following rights:
- Right to information and access: You may request information about the processing of your personal data and obtain access to it.
- Right to rectification: You may request the correction of inaccurate or incomplete personal data.
- Right to erasure: You may request the deletion of your personal data where the legal conditions are met.
- Right to restriction of processing: You may request that certain processing activities be restricted.
- Right to data portability: You may request your personal data in a structured, commonly used, machine-readable format where this right applies.
- Right to object: You may object to processing based on legitimate interests, subject to the applicable legal conditions.
- Right to withdraw consent: You may withdraw consent at any time where processing is based on consent.
- Rights relating to automated individual decision-making: You have the protections provided under Article 22 of the GDPR where applicable.
The right to erasure is not absolute. Certain personal data may need to be retained to comply with tax, accounting, or other legal obligations.
To exercise your rights, please contact us at:
We may request additional information to verify your identity where necessary and proportionate.
We will respond to your request within one month of receiving it, unless the GDPR permits an extension due to the complexity or number of requests. In such cases, we will notify you accordingly.
13. Right to Lodge a Complaint
If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with the competent supervisory authority.
Commission for Personal Data Protection (CPDP)
Комисия за защита на личните данни (КЗЛД)
Комисия за защита на личните данни (КЗЛД)
Address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
Email: kzld@cpdp.bg
Website: https://www.cpdp.bg
You also have the right to seek judicial remedies in accordance with applicable legislation.
14. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in legislation, our business activities, the technologies used by the online store, or our service providers.
The latest version will be published at https://dipetane-bg.com, together with the date of the most recent update.
Where applicable law requires additional notification or renewed consent for a particular processing activity, we will take the necessary steps.