Skip to main content

PRIVACY STATEMENT & COOKIES POLICY

(Updated to reflect Bulgarian legislation – Закон за защита на личните данни – ЗЗЛД)

1. Data‑controller (Data‑processing holder)

Sfer Oil And Gas Ltd, represented by its legal representative, is the data‑controller for the personal data processed through the website https://www.sferoilandgasltd.com.

  • Registered office: 16 B, Zlaten Rog Str., Office 10, 1407 Sofia, Bulgaria
  • VAT number: BG 203838968
  • Company registration number: 20151216152054

The controller determines the purposes and means of processing in accordance with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act (ЗЗЛД).

2. Legal basis for processing

Processing of personal data is carried out on one or more of the following lawful grounds (Art. 6 GDPR, Art. 4 ЗЗЛД):

Purpose of processing
Legal basis (GDPR)
Legal basis (Bulgarian law)
Providing information or services requested by the user (e.g., replies to contact‑form submissions)
Consent of the data subject (Art. 6 (1)(a)) or performance of a contract (Art. 6 (1)(b))
Consent of the data subject (Art. 4 (1) ЗЗЛД) or necessity for contract performance (Art. 5 (1) ЗЗЛД)
Storing log‑files, IP addresses, browser data for security, statistical or troubleshooting purposes
Legitimate interests of the controller (Art. 6 (1)(f))
Legitimate interests of the controller (Art. 5 (1) ЗЗЛД)
Transferring data to a third‑party processor for the provision of the website (hosting, email, analytics)
Contractual necessity (Art. 6 (1)(b))
Same as GDPR; additionally, the processor must be bound by a written contract in accordance with Art. 5 (2) ЗЗЛД.
International transfers outside the EU/EEA (e.g., backup services)
Adequacy decision, appropriate safeguards, or explicit consent (Arts. 44‑50)
Same as GDPR; must respect Art. 5 (2) ЗЗЛД and be approved by the Commission for Personal Data Protection (CPDP) if no adequacy decision exists.


3. Rights of the data subjects

In line with GDPR Art. 15‑22 and ЗЗЛД Art. 14‑26, you have the right to:

  1. Access your personal data (right of access).
  2. Rectify inaccurate or incomplete data (right to rectification).
  3. Erase data when it is no longer necessary or you withdraw consent (right to erasure).
  4. Restrict processing under certain circumstances.
  5. Data portability – receive your data in a structured, commonly used format.
  6. Object to processing for direct‑marketing or legitimate‑interest reasons.
  7. Withdraw consent at any time without affecting the lawfulness of prior processing.

Requests can be submitted through the Contact Us form on the website.

If you consider that your rights have been infringed, you may lodge a complaint with the Commission for Personal Data Protection (CPDP):

  • Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Commission for Personal Data Protection.
  • E‑mail: kzld@cpdp.bg
  • FAX: +3592/91-53-525

4. Retention periods

Personal data are retained no longer than necessary for the purpose for which they were collected, in accordance with Art. 5 (1)(e) GDPR and Art. 5 (1) ЗЗЛД. Typical retention periods:

Category
Retention period
Contact‑form submissions / enquiries
2 years (or as required for contractual follow‑up)
Log‑files (IP, timestamps, user‑agent)
12 months (statistical/anonymised use thereafter)
Newsletter subscription data
Until you unsubscribe or request deletion
Contracts / invoices (if any)
10 years (tax/legal requirement under Bulgarian Commercial Law)

5. Transfer of data to third countries

When personal data are transferred outside the EU/EEA, Sfer Oil & Gas Ltd. ensures adequate protection in line with GDPR Arts. 44‑50 and ЗЗЛД Art. 5 (2). This may involve:

  • an Adequacy Decision by the European Commission,
  • Standard Contractual Clauses (SCCs) approved by the CPDP, or
  • Explicit, informed consent from the data subject for the specific transfer.

All third‑party recipients are bound by a written data‑processing agreement that obliges them to respect the same data‑protection standards.

6. Cookies

The website uses session and persistent cookies as described in the original text. The following Bulgarian‑specific notes have been added:

  • The use of cookies is considered processing of personal data when they can identify a natural person (e.g., via IP address). Consequently, the consent model required by Art. 6 (1)(a) GDPR and Art. 4 (1) ЗЗЛД applies.
  • Users may withdraw consent at any time by closing the banner, adjusting browser settings, or using the “No” button. The withdrawal does not affect the legality of processing performed before the withdrawal.
  • For analytics or advertising cookies that are not strictly necessary, we obtain explicit consent before setting them, in line with the e‑privacy directive transposed into Bulgarian law (Regulation (EU) 2022/2065).

7. Updates to this privacy statement

This statement may be amended to reflect changes in legislation (e.g., amendments to ЗЗЛД, new CPDP guidelines, or EU regulatory updates). The effective date of the latest version will be indicated at the top of the page. Users are encouraged to review the statement regularly.

How to contact us

If you have any questions, wish to exercise your rights, or need further clarification, please use the Contact Us form on the website or write to:

Sfer Oil And Gas Ltd
Attn: Data‑Protection Officer (or Legal Department)
16 B, Zlaten Rog Str., Office 10, 1407 Sofia, Bulgaria
E‑mail: info@sferoilandgasltd.com