Privacy

Who is responsible for your data

The controller of your personal data is Rollpalmer, the seller on this website.

• Office: 58 Lyuben Karavelov St., 1142 Sofia, Bulgaria
• Telephone: +359 89 453 1700
• Email: rollpalmer@abv.bg

Write or call us about anything on this page.

What we collect

• With a request: your first name and surname, phone number, email address and town or city; a company name, a delivery preference and a note, if you add them; the products and quantities; the page’s language; and your confirmation that you are 18 or older and have read this notice.
• The site adds the request’s number and the time it was sent.
• For security: your IP address and email address. The site reads your IP address to limit attempts. The limits count it, and your email address, only as hashes (codes that do not show the address itself), and log lines about attempts, accepted or refused, record the IP address with its last part removed. Cloudflare, which hosts the site, sees your IP address and technical data about your browser whenever you open a page.
• If you call or write to us: what you tell us.

The site uses no analytics, advertising or tracking. Your request basket stays in your own browser until you send it: see Cookies.

No law obliges you to give us these details, but without your name, phone, email and town or city we cannot handle a request. The company name, the delivery preference and the note are optional.

Why we use it, and on what legal basis

• To handle your request: to send it to our mailbox, contact you about availability, price and delivery, check that it came from you, make you an offer and carry out any contract that follows. Basis: steps taken at your request before a contract, and the contract itself (Art. 6(1)(b) GDPR).
• To keep the form and the site secure against abuse and automated submissions. Basis: our legitimate interest in a site that works and cannot be used to send unwanted mail (Art. 6(1)(f) GDPR).
• To meet our accounting, tax and consumer-protection duties once there is a sale, such as invoices and the register of complaints. Basis: legal obligation (Art. 6(1)(c) GDPR).

Consent is not the basis for any of this. The box on the form records only that you have read this notice.

Who receives it

• Cloudflare, Inc. (United States) hosts the site, runs its database and sends each request by email to our mailbox, as our processor. The site’s database runs and stores its data in the European Union. Pages, the requests you send and emails pass through Cloudflare’s network, which also reaches beyond the EU. For transfers to the United States Cloudflare relies on its certification under the EU-U.S. Data Privacy Framework, which the European Commission has found adequate, and otherwise on the Commission’s standard contractual clauses: see Cloudflare’s privacy policy.
• Нет Инфо ЕАД (Net Info), ЕИК 202632567, 10 Nedelcho Bonchev St., 1528 Sofia, Bulgaria, provides the abv.bg mailbox rollpalmer@abv.bg, where requests arrive and from which we answer. Its privacy policy says it keeps data on servers in Bulgaria.
• Couriers and accountants, when we use them for your order: only what they need, such as a name, phone and delivery address, or the details on an invoice.
• Public authorities, when the law requires it.

We do not transfer your data outside the EU in any other way, and we do not sell it.

How long we keep it

• A request you send: it goes by email to our mailbox at once. A copy of that email stays in the site’s database only until it has left. If sending fails, the copy stays until a later attempt succeeds, so that your request is not lost.
• Security data: the limits on attempts hold your IP address and email address only as hashes, and those records are deleted after about 2 hours. A hash that recognises a repeated request is deleted after 24 hours. Log lines with a shortened IP address are kept for up to 3 days.
• Backups: the database’s restore history (Cloudflare D1 Time Travel) can hold deleted data for up to 7 days, for recovery after a fault only.
• Email records: Cloudflare’s mail service keeps a record of each email it sends (recipient, time, result and the subject line, which carries your name and the request’s number) for up to 31 days.
• In our mailbox: requests and our correspondence stay as long as needed to handle them and any contract or complaint that follows, and for the periods tax and accounting law set. Under Art. 12 of the Accountancy Act that is 10 years for registers and documents for tax control, and 3 years for other accounting records.

Cloudflare also keeps technical records of its own: see its privacy policy.

Your rights

You have the right to:

• get access to your data and a copy of it;
• have it corrected if it is wrong or incomplete;
• have it erased, unless the law requires us to keep it or we need it for a legal claim;
• have its use restricted;
• receive the data you gave us in a machine-readable form, or have it passed to someone else;
• object at any time to its use on the basis of our legitimate interest.

To use any of these, write to rollpalmer@abv.bg or call +359 89 453 1700. It costs nothing, and we answer within one month.

The form does not verify the details it receives, so someone else could enter yours. If we contact you about a request you did not send, tell us and we will delete it.

Complaints to the supervisory authority

If you think we handle your data unlawfully, you can complain to the Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria; telephone 02/91-53-519; kzld@cpdp.bg; cpdp.bg.

No marketing list, no automated decisions

A request does not put you on a marketing list. We use your details for that request and what follows from it, send you no advertising because of it, and add you to no mailing list.

We take no decisions about you by automated means alone and do no profiling. The form’s automatic checks only refuse invalid or automated submissions, and you can always call us instead.

Last changed: 9 November 2026.