Skip to content
Free delivery over €50

Privacy Policy

How we collect, use and protect your personal data when you shop at Arfa7 Fit, and what your rights are.

Last updated: 22 October 2026

Contents

1. Who processes your data

The controller of your personal data is ARFA ES EOOD, UIC 205173951, registered office ul. Inzh. Stoimen Sarafov 3, 1756 Sofia, Bulgaria.

For questions about personal data, e-mail [email protected] or call +359 877 900 982.

We process data under the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act.

2. What we process, why, and for how long

  • Customer account

    Data
    name, e-mail, hashed password, phone, delivery addresses, age (18+) declaration, preferences
    Legal basis
    contract (Art. 6(1)(b) GDPR)
    Retention
    until you delete the account

  • Orders, delivery, invoicing

    Data
    name, phone, e-mail, delivery address or office, items, amounts, payment method, notes, invoice details
    Legal basis
    contract; legal obligation (Art. 6(1)(c))
    Retention
    5 years from the order; accounting records for the periods required by Bulgarian accounting and tax law

  • Age check for “18+” products

    Data
    declaration (checkbox), date and time
    Legal basis
    legal obligation (Child Protection Act)
    Retention
    with the order

  • Withdrawals, complaints, support (e-mail, phone, contact form, chat)

    Data
    contact details, order number, messages, photos; for withdrawals also IP address, date and time
    Legal basis
    contract; legal obligation; legitimate interest in answering you and defending our rights (Art. 6(1)(f))
    Retention
    3 years after the case is closed; chat not linked to an order — 12 months

  • Newsletter (confirmed by e-mail)

    Data
    e-mail, language, date and time of the subscription and of its confirmation; unconfirmed requests are deleted after 7 days
    Legal basis
    consent (Art. 6(1)(a))
    Retention
    until you unsubscribe; proof of consent up to 3 years after

  • Security and abuse prevention

    Data
    IP address, browser, date and time, sign-in attempts
    Legal basis
    legitimate interest (Art. 6(1)(f))
    Retention
    up to 6 months

  • Cookies and browser storage

    Data
    see the Cookie Policy
    Legal basis
    necessity / consent
    Retention
    see the Cookie Policy

Order data are required to perform the contract; without them we cannot deliver your order. We do not use automated decision-making, including profiling, that produces legal effects for you.

3. Health-related information

We do not ask for or collect information about your health. Please do not send us such information (e.g. diagnoses or medication) via the chat, the contact form or order notes. The contents of your orders are confidential, visible only to staff who process them, and never used for profiling or advertising without your explicit consent.

4. Who receives your data

  • couriers (Econt, Speedy, BoxNow, Sameday and Pigeon) — name, phone, delivery address or office and the cash-on-delivery amount;
  • hosting and e-mail service providers under a data processing agreement with us;
  • accountants, IT support and lawyers — where needed and under a duty of confidentiality;
  • public authorities (National Revenue Agency, Consumer Protection Commission, BFSA, courts) where required by law.

We do not sell personal data. If a provider processes data outside the European Union or the European Economic Area, this happens only with appropriate safeguards (e.g. EU standard contractual clauses).

Product pictures. Some product pictures are loaded directly from the websites of the manufacturers and their suppliers. When your browser shows such a picture, that server receives the technical data every internet request carries — your IP address, the type of browser and the time. We do not send it the page you are viewing or any other data about you. These servers are run by the manufacturers and suppliers themselves, who are responsible for processing those data.

5. Security

The site uses a secure connection (HTTPS). Passwords are stored as cryptographic hashes. Access to data is restricted to authorised staff.

6. Your rights

You have the right to:

  • access your data;
  • rectification;
  • erasure (you can also delete your account yourself under “My account”);
  • restriction of processing;
  • data portability;
  • object, including an absolute right to object to direct marketing;
  • withdraw your consent at any time, without affecting processing before the withdrawal.

Write to [email protected]; we reply within one month. You may complain to the Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, [email protected], cpdp.bg (opens in a new tab).

7. Minors

The shop is intended for adults (18+) only. We do not knowingly collect data of minors; if we learn that we have, we delete it.

8. Cookies

Which cookies and browser storage we use and how to change your choice is explained in the Cookie Policy.

9. Changes

We will announce material changes to this policy on the site or by e-mail.