Privacy policy

Privacy Policy

Last updated: 6 September 2026.

This policy explains how “ДАРНОКС” ООД (DARNOX OOD) processes personal data when you use darnox.com and the associated partner portal, including orders.darnox.com once it is activated, when we service partner accounts and in our relationships with business partners. The website is intended for business customers. Data about a legal entity are not, in themselves, personal data, but the names and contact details of its representatives and employees may be.

1. Who is responsible for the data

The controller of personal data is “ДАРНОКС” ООД (DARNOX OOD), company identification number (EIK) 103853524, with registered office and management address: Bulgaria, Varna 9000, Odesos district, 8 Baba Rada St., floor 1, apartment 1. For questions about your personal data and to exercise your rights, you can contact us at info@darnox.com, by telephone on +359 2 4838383 or at the address above.

2. What data we process and where we obtain them

  • Partner account and contact details: name, professional role, email address, telephone number, company, company identification number (EIK)/VAT number, addresses, access status and individual partner pricing terms.
  • Enquiries and business relationships: correspondence, goods and quantities ordered, agreed prices, and details relating to invoicing, delivery, payment, complaints and service.
  • Technical data: IP address, browser and device type, session data, visits and actions on the website, language and privacy preferences, and records necessary for security.
  • Communication preferences: consent given or withdrawn for marketing emails and the records needed to demonstrate it.

We obtain data directly from you, from the company you represent and its authorised persons, and from our existing customer and business records, including GenSoft. Technical data are obtained when you use the website. When payment is made through an external payment provider, the data it requires for payment are processed through its system; you should not send us card numbers or security codes by email.

When we obtain your data from another source, we provide this information within a reasonable period, no later than one month, or, if we contact you or disclose the data to another recipient earlier, no later than the first contact or first disclosure.

3. Why we use the data and on what basis

  • Accounts, verification of authority to represent a company, partner prices and communication with company representatives: our legitimate interest in establishing and servicing business relationships and restricting access to agreed terms — Article 6(1)(f) of the GDPR.
  • Entering into and performing a contract to which you personally are a party, including as a sole trader: Article 6(1)(b). This basis does not automatically apply to an employee merely because their employer is our customer.
  • Accounting, tax and other mandatory records: compliance with a legal obligation — Article 6(1)(c).
  • Protecting the website, preventing misuse and establishing, exercising or defending legal claims: legitimate interest — Article 6(1)(f).
  • Marketing emails when you subscribe to them: your freely given consent — Article 6(1)(a). Refusal does not restrict access to the partner account.
  • Analysis of website use and advertising measurement through optional technologies you have permitted: consent — Article 6(1)(a). This includes collecting and sharing the relevant events through the Meta integration.
  • Optional cookies and similar technologies: consent where required by law. Technologies necessary for the service you have requested are used to provide that service.

The email field, details of the company you represent and other fields marked as mandatory are necessary for the relevant account, verification or request. Without them, we may be unable to provide access or fulfil the request. Optional data and consent to marketing are not a condition of service.

4. Service notifications and marketing emails

You sign in to your partner account using a one-time code sent by Shopify to the email address provided. Verification of the email address does not mean automatic approval for partner prices or orders. This access requires an account approved by DARNOX and confirmed individual partner terms. The browser may retain the session; a new code may be requested when it expires, after signing out or for another verification.

Messages concerning sign-in and security, account access, specific orders, invoices, deliveries and material changes affecting your service are service communications. Sending them does not depend on a marketing subscription. We do not use this distinction to present promotional offers as mandatory service communications.

Subscription to news and offers is separate and optional. You can withdraw your consent through the unsubscribe link in the marketing email or by writing to us. Withdrawal does not affect the lawfulness of processing before withdrawal and does not stop necessary account or order communications.

5. Who may receive the data

Authorised employees and service providers have access where necessary for the relevant service. Categories of recipients include:

  • Shopify: the platform for the website, accounts and order processing. For the core services, Shopify processes data on our behalf. Shopify Network Intelligence is also enabled in the store. For the associated enhanced services, Shopify may use data about your interactions with the store and other merchants for personalisation, analysis, service improvement and advertising, acting as an independent controller. According to Shopify's policy, targeted advertising to people in the EEA is based on consent. You can manage your rights and choices in relation to Shopify through its privacy portal. Details: Shopify Consumer Privacy Policy and Shopify Data Processing Addendum.
  • BSS Commerce: the applications for partner access and individual pricing. Depending on the function used, they may process account identifiers, contact details, applicable partner terms and data necessary for the request. Details: BSS Commerce Privacy Policy.
  • Meta — Facebook and Instagram: an integration with a web pixel for analytics and advertising events is installed on the website. It is configured to require permission for the analytics and marketing categories. Where use is permitted, it may provide Meta with device data and website interactions, such as products viewed and order events. More about Meta's processing: Meta Privacy Policy. Settings for optional technologies are described in section 8.
  • Providers of email, information systems, technical support and accounting services: for communication, system maintenance and mandatory reporting.
  • Couriers, carriers, banks and payment providers: where they are involved in the selected delivery or payment.
  • Competent authorities and professional advisers: where required by law or necessary to protect rights.

Recipients process data according to their role — on our instructions as processors or on their own legal basis as independent controllers. Access for technical support does not authorise arbitrary use of the data for other purposes.

6. Processing outside the European Economic Area

Using international providers may involve processing outside the European Economic Area. Shopify describes the applicable mechanisms for international transfers, including adequacy decisions and standard contractual clauses, in its data processing addendum. In its policy, BSS Commerce states that it uses storage through Linode in the United States and Amazon S3, and gives a contact location in Vietnam.

You may ask us for information about the specific recipients, countries and applicable safeguards, as well as a copy of or access to the relevant contractual safeguards. The mere existence of a provider's privacy policy does not replace the requirements of Chapter V of the GDPR for international transfers.

7. Retention periods

  • Account data and business contacts: for as long as necessary for the active account and the relationship with the company represented; thereafter, only to the extent that a legal obligation or a need relating to legal claims exists.
  • Orders, invoices and accounting documents: for the applicable mandatory periods under accounting and tax legislation, depending on the type of document.
  • Correspondence and claims: until the matter is concluded and the relevant limitation periods expire, where retention is necessary to protect rights.
  • Consent to marketing: until it is withdrawn; a minimal record of the refusal and evidence of consent may be retained to respect the refusal and establish the lawfulness of earlier sending.
  • Technical records and cookies: according to the security purpose, session type and lifetime of the relevant technology. Session cookies end with the session, while persistent cookies have their own lifetime.

Deleting an account does not automatically delete documents we are required to retain. On request, we will specify the particular period or criterion for the data concerned and the grounds for any continued retention.

8. Cookies and similar technologies

The website uses necessary technologies for sign-in, sessions, security, preferred language, the cart and remembering your privacy choices. Analytics and advertising technologies are not necessary merely because the platform uses them; where the law requires consent, they should be activated following your choice.

A cookie preference panel is enabled for visitors from Bulgaria, the other EEA countries and the United Kingdom. In it, you can accept, refuse or configure optional categories. They are not preselected. You can subsequently change your choice through the cookie settings link at the bottom of the website. Merely browsing the website does not constitute consent to optional cookies. Deleting or blocking necessary cookies in your browser may sign you out or prevent essential functions from working. Technical information about the cookies used by the platform is also available in Shopify's description.

9. Your rights

Subject to the conditions of the GDPR, you have rights of access, rectification, erasure, restriction of processing, objection and portability. Portability applies to data you have provided that are processed by automated means where the basis is consent or contract. Where we rely on legitimate interest, you may object on grounds relating to your particular situation. You may object to processing for direct marketing at any time.

Write to info@darnox.com. We respond without undue delay, normally within one month. Where requests are complex or numerous, the period may be extended by up to a further two months, and we will notify you of the reasons within the first month. If we have reasonable doubts, we may request minimal additional information to confirm your identity.

You have the right to lodge a complaint with the Commission for Personal Data Protection: cpdp.bg, kzld@cpdp.bg, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, as well as with the competent supervisory authority in your place of habitual residence, place of work or place of the alleged infringement. You do not have to contact us first.

10. Partner terms and automation

The portal uses the company's individual partner terms confirmed by DARNOX to display the corresponding agreed prices. The automatic display of a price is not, in itself, a decision about the representative's creditworthiness or other personal characteristics. You can request a review by a DARNOX employee if the partner terms are incorrect or access is restricted.

11. Security and changes

Provide only data necessary for the partner relationship. Do not send passwords, sign-in codes, payment card details or copies of identity documents through ordinary correspondence. Contact us immediately if you suspect unauthorised access.

When changes occur, we publish an updated policy with a new date. If new consent or separate notice of a new purpose is required, changing the text does not replace these. This policy provides information; it is not a waiver of your rights and does not make consent to marketing a condition of access.