Privacy policy

How we collect, use and protect your personal data

1. Data controller

ECO OIL RESOURCE EOOD, with registered office at 1 Elov Dol St., 1220 Sofia, Bulgaria, is the data controller responsible for your personal data
For any question about the processing of your personal data, and to exercise the rights listed in section 9, contact us at info@ecooilresource.com or +359 889 228 876

2. What data we collect and through which channels

We collect only the data you enter yourself into one of the forms on this website, plus the technical data without which your request cannot be served
The channels are:

  • Contact form (on the Contacts page) — name (required), company (optional), email address (required), phone number (optional), message (required), and the box confirming that you have read this policy
  • Membership application form (on the Membership page) — company name, UIC (Bulgarian unified identification code), email address, phone number (optional), the types of oils you place on the market (optional), an additional message (optional), and the box confirming that you have read this policy
  • Newsletter subscription (in the footer of every page) — email address only
    The address receives an email with a confirmation link and is recorded as consent only once you confirm on the page it opens
  • Portal 2.0 — the member portal runs on a separate system at portal.ecooilresource.com
    This site carries no sign-in form; the “Portal 2.0” page only links to it, and the sign-in and anything entered there are handled by the portal itself

About the UIC: the UIC identifies a legal entity and is not personal data in itself
Where the applicant is a sole trader or another natural person with a trade registration, the UIC does identify a natural person, and in that case we treat it as personal data on a par with the other fields

Hidden technical fields: every form carries an invisible trap field and a timestamp of the moment the form became ready for input
They serve solely to filter out automated submissions, are filled in by the browser, and contain no information about you

We do not knowingly collect data from persons under 18 — our services are directed exclusively at businesses
We do not process special categories of personal data within the meaning of Art. 9 GDPR

Every time a form is successfully submitted, we record evidence of the submission
For the contact and membership application forms the record shows that you were informed about the processing and have read this policy — processing through those forms is not based on consent (see section 4); for the newsletter it shows the consent you gave
The record contains:

  • the date and time of submission (in UTC) and a unique record identifier;
  • what was ticked in the form — that the box was ticked, which box it was, and the value received;
  • the address of the privacy policy that was in force at that moment;
  • the address of the page the form was submitted from, and its language version;
  • the data you entered yourself in that particular form — your email address and, depending on the form, your name, company and UIC;
  • a checksum (SHA-256) of the email address — it lets us find your records on request without searching by the address itself;
  • the IP address the form was sent from — as Cloudflare passes it to the application
    For the newsletter there are two: the one you subscribed from and the one you confirmed the subscription from — they may differ if you opened the email on another device;
  • technical data about the request — the browser (the User-Agent field, truncated), the origin, the country as reported by Cloudflare, and how the form was submitted;
  • the period the record is kept for

The record is kept in two places
It is attached to the internal email we receive at info@ecooilresource.com, and separately from it in our own consent register in Cloudflare’s infrastructure, for the period stated in section 7
In that register every record is reachable both chronologically and by the checksum of the email address, so a request under Art. 15 – 17 GDPR can be answered without going through the whole mailbox

An IP address is personal data
We process it for two distinct purposes on two distinct legal bases:

  • Demonstrating the submission — for the newsletter: so that we are able to show that you gave consent, as required by Art. 7(1) GDPR; legal basis: Art. 6(1)(c) GDPR (compliance with a legal obligation) in conjunction with Art. 7(1)
    For the contact and membership application forms: so that we are able to show that we informed you under Art. 13 GDPR (accountability under Art. 5(2)); legal basis: Art. 6(1)(f) GDPR (legitimate interest)
  • Rate limiting and abuse protection — see section 5
    Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in keeping the site operational and limiting automated submissions)

The IP address is not used for profiling, cross-site tracking, advertising or visit analytics
Its retention period is stated in section 7

We process your data for the following purposes:

  • Answering an inquiry sent through the contact form — on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in responding to an inquiry addressed to us
  • Processing a membership application — in order to take steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR), and, where a contract is concluded, to perform it
  • Sending the newsletter — on the basis of your consent (Art. 6(1)(a) GDPR)
    Consent is given in two steps: you enter your address and we send you an email with a one-time link, valid for 7 days
    While we wait for you to confirm, your address is held temporarily — together with your IP address, your browser and the page you subscribed from — for 7 days, after which it expires by itself
    If you never confirm, that temporary record disappears, nothing enters the consent register, and you hear nothing further from us
    You may withdraw it at any time via the unsubscribe link in every email or by writing to us
    Withdrawal does not affect the lawfulness of processing carried out before it
  • Demonstrating that consent was given (newsletter) — Art. 6(1)(c) in conjunction with Art. 7(1) GDPR, and for the contact and membership application forms, demonstrating that you were informed, on the basis of our legitimate interest (Art. 6(1)(f) GDPR) (see section 3)
  • Website security and protection against automated and abusive submissions — our legitimate interest (Art. 6(1)(f) GDPR)
  • Remembering your cookie choice — stored on your own device so that you are not asked again (see section 8)

We do not carry out automated decision-making, including profiling, within the meaning of Art. 22 GDPR

5. Technical data of your request

This website is served through the Cloudflare Pages platform
As with any website, serving a request means the provider processes technical data about it — IP address, browser and operating system, date and time, requested address — in order to deliver the pages and to protect the infrastructure against attacks

Form submissions are additionally rate limited by us: the IP address is held briefly in the memory of the process serving the request, for a window of 60 seconds, so that no more than 3 submissions per minute are accepted (5 for the newsletter subscription)
This data is not written to any database and is not kept beyond that window

6. Recipients and processors

We do not sell, rent or trade your personal data to third parties for marketing purposes

Your data reaches the following recipients, each of which processes only what its service requires:

  • Resend — our email delivery provider
    It processes the content of the form you submitted and the record described in section 3, in order to deliver them to us as an internal notification email
    Where a newsletter list is configured, your email address is also stored in a list at Resend
  • Cloudflare — hosting and delivery of the website (Cloudflare Pages) and protection of the infrastructure (see section 5)
  • Cloudflare Turnstile — the protection of the forms against automated submissions
    The widget is loaded when a form comes within 300 pixels of the visible part of the screen or when you touch one — on pages whose form sits high, that is as soon as the page opens — and with that download alone Cloudflare receives your IP address and the technical headers of the request; when a form is submitted our server also sends your IP address to Turnstile in order to verify the token it issued
    Set out in detail in our Cookie Policy
  • Competent public authorities — only where the law obliges us to disclose data

Transfers outside the EEA: some of these providers also process data outside the European Economic Area
Where that happens, the transfer takes place on the basis of a European Commission adequacy decision or of standard contractual clauses under Art. 46(2)(c) GDPR included in the contract with the provider
You may request information about the applicable safeguards at info@ecooilresource.com

7. Data retention

10 years is the ceiling of retention for the data collected through the forms on this website — not a period that is waited out
A record is deleted as soon as the purpose it was collected for falls away; the ceiling is technically the same for all three forms so that one and the same kind of record does not carry three diverging promises

The basis of that period, however, is not the same for all three forms
Accounting and tax legislation governs the records of membership and contractual relationships and does not apply to an inquiry submitted through the contact form
For an inquiry the period rests on the general five-year limitation period under Article 110 of the Bulgarian Obligations and Contracts Act and on our legitimate interest in being able to demonstrate that we informed you (Article 5(2) and Article 6(1)(f) GDPR)

  • An inquiry from the contact form — kept for as long as the matter it concerns is being dealt with and for as long as it is needed to defend against a claim connected with it
    Deleted once that interest falls away, and at the latest 10 years from submission
    Accounting legislation is not the basis of this period
  • A membership application that did not lead to an agreement — 10 years from submission
  • A membership application that led to an agreement — for the term of the contractual relationship and, after its termination, for the periods laid down by the applicable accounting, tax and environmental legislation
  • An unconfirmed newsletter subscription — 7 days
    The temporary record expires by itself; if you never confirm it disappears and nothing enters the register
  • A newsletter email address — 10 years
    Sending stops immediately upon unsubscribing; the record itself is kept until the period expires, so that it remains demonstrable when and on what basis you subscribed and when you unsubscribed
  • The record described in section 3 (date and time, IP address, policy address, page address) — 10 years, together with the corresponding inquiry, application or subscription
  • The IP address used for rate limiting — up to 60 seconds, in memory only (see section 5)
  • Your cookie choice — stays on your own device until you clear the site data in your browser

8. Cookies and local storage

This website sets no tracking cookies of its own
The only thing we store on your device is your choice from the cookie banner — a value under the key eor_cookies in your browser’s local storage
Separately from us, the protection provider Cloudflare Turnstile may set strictly necessary technical values — see the Cookie Policy

As of September 2026 no web analytics tool is deployed on this website and no analytics or marketing cookies are used
For details of what exactly is stored and how to manage it, see our Cookie Policy

9. Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you and obtain a copy of it (Art. 15)
  • Rectification of inaccurate or incomplete data (Art. 16)
  • Erasure of your data — the “right to be forgotten” (Art. 17)
  • Restriction of processing (Art. 18)
  • Data portability — to receive your data in a structured, machine-readable format (Art. 20)
    This right covers only the data we process on your consent or for the performance of an agreement and by automated means; it does not cover the data we process under a statutory obligation — for example the declared quantities and the reports under the Waste Management Act
  • Object to processing based on our legitimate interest (Art. 21)
  • Withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3))
  • Lodge a complaint with a supervisory authority (Art. 77)

To exercise any of these rights, contact us at info@ecooilresource.com
We reply without undue delay and in any case within one month of receiving the request (Art. 12(3) GDPR)

You also have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP), the Bulgarian supervisory authority:

2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria · kzld@cpdp.bg · www.cpdp.bg (in Bulgarian, opens in a new tab)

10. Data of representatives and of persons named in published documents

Besides the data you enter in the forms yourself, the site shows personal data of a few individuals
This section explains who they are, on what basis the data is public, and for how long

What data and where

  • the full name of the manager — in the “Mandatory information” section of the home page and in the General Terms and Conditions;
  • names and professional details of persons named in the official acts the organization is required to publish — the permit under Art. 81(1) of the Waste Management Act and the orders of the Minister of Environment and Water.

On what basis

The processing rests on Art. 6(1)(c) of the General Data Protection Regulation — compliance with a legal obligation
There are three such obligations

  • Art. 4 of the Electronic Commerce Act and Art. 13(1) of the Commerce Act — identification of the trader: name, registered seat and address of management, unified identification code and contact details; the manager’s name stands next to those because the company acts through its manager, and the power of representation is publicly entered in the Commercial Register;
  • Art. 92(2) of the Waste Management Act — the organization informs the public of the issue of the permit and of any subsequent amendment; that provision requires the fact to be announced, while publishing the text itself rests on the next basis;
  • item 21 of Annex 1 to the permit — the permit itself is public and is published on the organization’s website.

Where the data comes from

The manager’s data comes from the Commercial Register and from the company itself
The data of persons named in the official acts comes from those acts, issued by the Ministry of Environment and Water, and not from the persons themselves — Art. 14 of the Regulation applies to them

For how long

For as long as the publication duty lasts
For the company details — for as long as the person represents the company
Published acts remain available after they cease to be in force, so that it stays traceable which act applied when

What we do not publish

The company’s unified identification code has been redacted from the published permit
Beyond that, the organization does not edit the content of an official act it is required to publish

Your rights

The same as in section 9 — access, rectification, erasure, restriction, objection and a complaint to the Commission for Personal Data Protection
Portability under Art. 20 has the scope described there: it does not cover data processed under a statutory obligation
If you are a person whose name appears in a document published here, write to info@ecooilresource.com

11. Data of members’ representatives and staff

The sections above cover the data that passes through this website
This section covers different processing — the data of the natural persons who represent a member of the collective system or are named as contacts under the agreement
Art. 52(6) of the General Terms and Conditions (Bulgarian text) refers here for the details

Which persons

  • the persons who represent the member and sign the agreement;
  • the member’s contact persons and staff named for the performance of the agreement who are not a party to it.

What data

Names, position, email address, telephone, and data relating to the qualified electronic signature

On what basis

For the member’s representatives — Art. 6(1)(f) of the General Data Protection Regulation (legitimate interest in concluding and performing the agreement under which they act as representatives) and Art. 6(1)(c) (compliance with statutory obligations under the Waste Management Act and the Waste Oils Ordinance)

For contact persons and staff who are not a party to the agreement — Art. 6(1)(c) and Art. 6(1)(f), with a legitimate interest in the performance, control and protection of rights under the agreement and in communication about it

For processing based on legitimate interest, a documented balancing assessment has been carried out
It is provided on request at the address at the end of this policy

Where the data comes from

We do not receive these data from you but from the member who named you — in the agreement, in its annexes or through a request in Portal 2.0
The data of the representatives are also verified against the Commercial Register, which is public
We tell you this under Art. 14 of the Regulation, because you did not give us the data yourself; providing them is a condition for concluding and performing the agreement for the member, not an obligation of yours

Who receives the data

The data may be provided to the Executive Environment Agency, the Ministry of Environment and Water, the regional environmental inspectorates, the National Revenue Agency, the Customs Agency, the Enterprise for Management of Environmental Protection Activities, to auditors and to the operators — in so far as this is necessary to comply with a statutory obligation

Where a recipient processes the data on behalf of and on the instructions of the organization — including the operators under Art. 42 of the General Terms and Conditions and the provider of Portal 2.0 — it acts as a processor and the relationship is governed by a contract under Art. 28(3) of the Regulation

For how long

10 years after the agreement is terminated
The period is justified by the statutory accounting and tax retention obligations and by the reporting duties under the Waste Management Act, in line with the storage limitation principle in Art. 5(1)(e) of the Regulation

Your rights

Access, rectification, erasure, restriction of processing and the right to object under Art. 21 of the Regulation where the processing is based on legitimate interest
Portability under Art. 20 — with the scope set out in section 9: only for data processed on consent or for the performance of an agreement and by automated means
Right to lodge a complaint — with the Commission for Personal Data Protection

12. Changes to this policy

We may update this Privacy Policy from time to time
The current version is always available on this page
Last updated: 29 September 2026