This Privacy and Cookie Policy explains how MarmaMATER EOOD, UIC/VAT No. 208623649, with registered office and management address at 1 Ravnogor Str., Sofia, Bulgaria, hereinafter referred to as “PHIBBA”, “we”, “us” or “the Controller”, collects, uses, stores and otherwise processes personal data when you visit or use https://phibba.com, place an order, create an account, contact us, subscribe to marketing communications or otherwise interact with our services.

We are committed to protecting your privacy and processing personal data in accordance with Regulation (EU) 2016/679, commonly known as the General Data Protection Regulation (“GDPR”), the applicable Bulgarian data protection legislation and other applicable laws.

1. GENERAL INFORMATION

1.1. Personal Data

For the purposes of this Privacy Policy, personal data means any information relating to an identified or identifiable natural person.

This may include, for example:

• name;
• postal address;
• email address;
• telephone number;
• billing and delivery details;
• account information;
• IP address;
• device and browser information;
• order and transaction information;
• communication history;
• online identifiers;
• cookie identifiers;
• browsing and interaction data.

An identifiable natural person is a person who can be identified directly or indirectly, including by reference to an identifier such as a name, identification number, online identifier, location data or other information relating to that person.

1.2. Data Controller

The controller responsible for processing personal data through the PHIBBA website and related services is:

MarmaMATER EOOD
UIC/VAT No.: 208623649
Registered office and management address: 1 Ravnogor Str., Sofia, Bulgaria
Website: https://phibba.com
Email: hi@phibba.com
Telephone: +359 88 70 70 170

1.3. Your Rights

Subject to the conditions provided by applicable law, you have the following rights concerning your personal data:

• Right of access – to obtain confirmation as to whether we process your personal data and, where applicable, access to that data;
• Right to rectification – to request correction of inaccurate or incomplete personal data;
• Right to erasure – to request deletion of your personal data where the applicable legal requirements are met;
• Right to restriction of processing – to request that processing of your personal data be restricted in certain circumstances;
• Right to data portability – to receive certain personal data you have provided to us in a structured, commonly used and machine-readable format and, where applicable, to transmit it to another controller;
• Right to object – to object to processing based on legitimate interests and, at any time, to processing for direct marketing purposes;
• Right to withdraw consent – where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal;
• Right not to be subject to certain automated decisions – where applicable under Article 22 GDPR.

To exercise any of these rights, please contact us at hi@phibba.com.

We may need to verify your identity before responding to a request in order to protect your personal data against unauthorised disclosure.

You also have the right to lodge a complaint with the competent supervisory authority. In Bulgaria, this is the Commission for Personal Data Protection (CPDP).

1.4. Disclosure to Public Authorities

We may disclose personal data to courts, law enforcement authorities, regulatory bodies, tax authorities or other competent public institutions where we are legally required to do so or where disclosure is necessary to establish, exercise or defend legal claims.

Such disclosures will only be made where there is an appropriate legal basis.

2. DATA COLLECTED WHEN YOU VISIT OUR WEBSITE

When you visit https://phibba.com purely for informational purposes and do not place an order, create an account or otherwise actively provide information to us, certain technical information may nevertheless be automatically transmitted by your browser or device.

This may include:

• IP address;
• date and time of access;
• requested page or resource;
• referring website;
• browser type and version;
• operating system;
• device type;
• language settings;
• technical identifiers;
• server log information.

We process this information where necessary to:

• display and operate our website;
• ensure the security and stability of our systems;
• detect and prevent abuse, fraud or cyberattacks;
• diagnose technical problems;
• maintain website functionality.

The legal basis for this processing may be Article 6(1)(f) GDPR – legitimate interests, including our legitimate interest in maintaining a secure, functional and reliable website.

Where processing is strictly necessary for the provision of a service expressly requested by you, another applicable legal basis may also apply.

We may share relevant technical data with service providers involved in hosting, website infrastructure, security, content management or technical support.

3. COOKIES AND SIMILAR TECHNOLOGIES

3.1. What Are Cookies?

When you visit https://phibba.com, cookies and similar technologies such as pixels, tags, local storage or comparable identifiers may be stored on or accessed from your device.

For simplicity, we refer to these technologies collectively as “cookies” in this Privacy Policy.

Cookies are small files or pieces of information that allow a website or third-party service to recognise a browser or device and store certain information.

Cookies may be:

• first-party cookies, set by PHIBBA;
• third-party cookies, set by external service providers.

Depending on their purpose, cookies may help us:

• keep the website functioning;
• remember your preferences;
• maintain your shopping cart;
• keep you logged in;
• measure website performance;
• understand how visitors use our website;
• improve content and usability;
• measure advertising performance;
• personalise advertising where you have consented.

3.2. Categories of Cookies

We may use the following categories of cookies:

A. Strictly Necessary Cookies

These cookies are necessary for the Website to function properly and cannot normally be switched off through our consent management interface.

They may be required for functions such as:

• website security;
• shopping cart functionality;
• checkout;
• payment processing;
• account login;
• fraud prevention;
• remembering privacy choices;
• load balancing;
• basic technical operation.

Strictly necessary cookies do not require consent where their use is necessary for providing a service explicitly requested by the user.

Their legal basis may include Article 6(1)(b) GDPR where processing is necessary for performance of a contract or steps requested before entering into a contract, and/or Article 6(1)(f) GDPR where processing is necessary for legitimate technical or security purposes.

B. Functional and Preference Cookies

Functional cookies enable the Website to remember choices you make, such as:

• language;
• region;
• display preferences;
• account-related preferences;
• previously selected settings.

Where such cookies are not strictly necessary, we use them only where permitted by applicable law and, where required, after obtaining your consent.

C. Analytics and Performance Cookies

Analytics cookies help us understand how visitors interact with our Website.

They may allow us to analyse information such as:

• number of visitors;
• pages viewed;
• duration of visits;
• navigation patterns;
• traffic sources;
• device categories;
• approximate geographic location;
• interactions with Website features.

Where required by applicable law, analytics cookies are activated only after obtaining your consent.

The legal basis for processing based on such consent is Article 6(1)(a) GDPR.

D. Marketing and Advertising Cookies

Marketing cookies may be used to:

• measure advertising performance;
• understand whether users interact with advertisements;
• build advertising audiences;
• display advertisements that may be more relevant to your interests;
• perform remarketing or retargeting;
• limit how often advertisements are displayed.

Where required by applicable law, these technologies are used only after obtaining your consent.

The legal basis is Article 6(1)(a) GDPR.

3.3. Managing Cookie Preferences

Where available, you can manage your cookie choices through the cookie settings or consent banner displayed on https://phibba.com.

You may withdraw or modify your consent at any time with effect for the future.

You can also configure your browser to:

• block all cookies;
• block third-party cookies;
• delete existing cookies;
• notify you before cookies are stored.

Please note that blocking strictly necessary cookies may prevent parts of the Website from functioning correctly.

4. GOOGLE ANALYTICS

Where enabled and subject to your cookie choices, PHIBBA may use Google Analytics, an analytics service provided by Google, to better understand how visitors use our Website.

Google Analytics may process information such as:

• page views;
• interactions;
• session information;
• device information;
• browser information;
• approximate geographic location;
• referral information;
• cookie or device identifiers.

We use this information to analyse Website usage, improve performance, optimise content and understand general visitor behaviour.

Where required under applicable law, Google Analytics is activated only after obtaining your consent.

Legal basis: Article 6(1)(a) GDPR.

Google may process certain information on servers located outside the European Economic Area. Where personal data is transferred internationally, appropriate safeguards must be used in accordance with Chapter V GDPR.

Where applicable, such safeguards may include an adequacy decision, including the EU–US Data Privacy Framework, or Standard Contractual Clauses approved by the European Commission.

You can withdraw your consent through our cookie settings at any time.

Google also provides tools and browser options allowing users to restrict Analytics tracking.

5. GOOGLE TAG MANAGER

Where enabled, we may use Google Tag Manager to manage website tags and integrations.

Google Tag Manager itself primarily provides the technical infrastructure through which other tools may be activated.

The data-processing implications therefore depend on the specific services and tags configured through Google Tag Manager.

Where a tag requires consent, we endeavour to configure it so that the relevant technology is activated only after the required consent has been provided.

6. GOOGLE ADS AND CONVERSION MEASUREMENT

Where enabled and subject to your consent, PHIBBA may use Google Ads and related conversion-measurement technologies.

These services help us understand whether users interact with advertisements and whether an advertising interaction results in actions such as:

• visiting the Website;
• viewing a product;
• adding a product to the shopping cart;
• completing an order;
• performing another relevant conversion.

Google may use cookies or similar identifiers to measure these activities.

We generally receive aggregated or statistical advertising information rather than information designed to directly identify individual users.

Legal basis: Article 6(1)(a) GDPR – consent.

You may withdraw your consent at any time through our cookie settings.

7. GOOGLE REMARKETING

Where enabled and subject to your consent, we may use Google remarketing or similar advertising functions.

These technologies may allow advertisements for PHIBBA products to be displayed to users who have previously visited our Website.

Google and its partners may use cookies, device identifiers or comparable technologies to determine that a browser or device previously interacted with https://phibba.com.

Legal basis: Article 6(1)(a) GDPR – consent.

You may withdraw your consent at any time through our cookie settings.

8. META PIXEL AND META ADVERTISING

Where enabled and subject to your consent, https://phibba.com may use technologies provided by Meta Platforms, such as the Meta Pixel.

The Meta Pixel may allow us to:

• measure the effectiveness of advertising;
• determine whether users interact with advertisements;
• create or measure advertising audiences;
• perform remarketing;
• understand interactions between our Website and advertisements on Meta platforms such as Facebook and Instagram.

Depending on the technology and your interaction with Meta services, information such as browser data, device information, Website activity, IP address, cookie identifiers and advertising-related events may be transmitted to Meta.

If you are logged into a Meta account, Meta may be able to associate certain activity with your account in accordance with its own privacy practices.

Legal basis for our use of non-essential Meta technologies: Article 6(1)(a) GDPR – consent.

You may withdraw your consent through our cookie settings.

For further information on Meta’s processing activities, please consult Meta’s current Privacy Policy and advertising settings.

9. SOCIAL MEDIA LINKS AND PLUGINS

Our Website may contain links, buttons or integrations relating to social networks such as:

• Facebook;
• Instagram;
• Pinterest;
• X or other social platforms.

Where a simple link is used, data is generally transferred to the relevant social network only when you follow that link.

Where an embedded plugin or interactive integration is used, data may potentially be transmitted to the relevant provider when the integration loads or when you interact with it.

Where applicable and legally required, such functionality will only be activated after your consent.

The relevant social network acts independently in relation to processing carried out through its own services. We recommend reviewing the privacy policy of the relevant platform.

10. SOCIAL LOGIN

Where PHIBBA offers the ability to create an account or log in through a third-party social network or identity provider, that service may transfer certain information to us after you authorise the connection.

Depending on the provider and permissions selected, this may include:

• your name;
• email address;
• account identifier;
• profile information necessary to authenticate you.

Before completing a social login process, the relevant provider will normally inform you which information will be shared.

We process this data to authenticate you, create or access your PHIBBA account and provide the requested account functionality.

The applicable legal basis may be Article 6(1)(b) GDPR, where processing is necessary to provide the requested account service.

Additional optional processing will only occur where another lawful basis applies.

11. CONTACTING PHIBBA

When you contact us, for example by email, contact form, telephone or another communication channel, we may process information including:

• your name;
• email address;
• telephone number;
• order number;
• details of your inquiry;
• any other personal data included in the communication.

We process this information in order to:

• respond to your inquiry;
• provide customer support;
• handle complaints or returns;
• assist with an order;
• maintain relevant business correspondence.

Where your communication relates to an existing or potential contract, the legal basis is generally Article 6(1)(b) GDPR.

Where processing is necessary for general customer service, record keeping, dispute prevention or protection of our business interests, the legal basis may be Article 6(1)(f) GDPR.

We retain correspondence only for as long as necessary for the relevant purpose or as required by applicable legal retention periods.

12. ORDERS AND PURCHASES

When you place an order through https://phibba.com, we process personal data necessary to complete and fulfil the purchase.

This may include:

• name;
• email address;
• telephone number;
• billing address;
• delivery address;
• products ordered;
• order value;
• payment status;
• selected delivery method;
• transaction and order identifiers;
• communications relating to the order.

We process this data in order to:

• accept and process your order;
• take or confirm payment;
• dispatch and deliver your order;
• communicate with you about your order;
• process returns or refunds;
• issue invoices and accounting documents;
• prevent fraud;
• comply with tax, accounting and other legal obligations.

The primary legal basis is Article 6(1)(b) GDPR – performance of a contract.

Certain information is also processed under Article 6(1)(c) GDPR – compliance with a legal obligation, particularly in relation to tax and accounting requirements.

13. PAYMENT SERVICE PROVIDERS

Where you pay electronically, payment data may be processed by banks, card networks or third-party payment service providers.

PHIBBA generally does not need to store your full payment card number where payment is processed directly through an authorised payment provider.

The payment provider may process personal data under its own privacy terms and applicable financial regulations.

Information such as transaction identifiers, payment status and limited payment details may be shared with PHIBBA where necessary to verify payment, issue refunds, prevent fraud or maintain transaction records.

14. DELIVERY AND COURIER SERVICES

Where necessary to fulfil your order, we may share relevant personal data with courier, logistics or fulfilment providers.

This may include:

• name;
• telephone number;
• email address where necessary;
• delivery address;
• pick-up location;
• shipment identifier;
• other information required to complete delivery.

The legal basis is Article 6(1)(b) GDPR – performance of the purchase contract.

Delivery providers may process information independently where required for their own legal or operational obligations.

15. CUSTOMER ACCOUNTS

Where account registration is available, we may process information including:

• name;
• email address;
• password in protected form;
• addresses;
• order history;
• saved preferences;
• account activity.

We process this information to provide account functionality requested by you.

Legal basis: Article 6(1)(b) GDPR.

Creating a PHIBBA account does not automatically constitute consent to personalised advertising or marketing communications.

Where we wish to use account information for optional marketing or profiling requiring consent, we will request that consent separately where required by law.

You may request deletion of your account at any time, subject to information we must retain for legal or contractual purposes.

16. NEWSLETTER AND DIRECT MARKETING

Where you subscribe to our newsletter or otherwise consent to receiving marketing communications, we may process:

• your name, where provided;
• your email address;
• subscription status;
• communication preferences;
• interactions with marketing emails, where permitted.

We may use this information to send:

• PHIBBA news;
• new product information;
• offers;
• promotions;
• educational or editorial content;
• invitations to campaigns or events.

Legal basis: Article 6(1)(a) GDPR – consent, where consent is required.

You may unsubscribe at any time by:

• using the unsubscribe link included in marketing emails; or
• contacting us at hi@phibba.com.

Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

We do not make continued access to ordinary Website services conditional upon subscription to marketing communications.

17. PRODUCT RATINGS AND REVIEWS

Where the Website allows users to submit product ratings or reviews, we may process:

• username or display name;
• review content;
• rating;
• date of submission;
• relevant account or order information where needed to verify authenticity;
• technical information used to prevent abuse.

Reviews may be publicly visible on the Website.

We recommend avoiding unnecessary personal information in publicly posted reviews.

We may moderate, refuse or remove content where necessary to:

• comply with applicable law;
• protect third-party rights;
• prevent abusive or fraudulent content;
• enforce Website rules;
• maintain the integrity of the review system.

The legal basis may include Article 6(1)(b) GDPR where the service is requested by you and/or Article 6(1)(f) GDPR based on our legitimate interest in operating and protecting our review system.

18. PROMOTIONS, GIVEAWAYS, SURVEYS AND PRODUCT TESTING

Where PHIBBA organises promotions, competitions, giveaways, surveys or product-testing campaigns, we may process personal data provided by participants.

Depending on the campaign, this may include:

• name;
• contact information;
• delivery address;
• competition entry;
• survey responses;
• eligibility information.

We process this information to:

• administer the campaign;
• communicate with participants;
• select and contact winners where applicable;
• deliver prizes or products;
• comply with campaign terms and legal obligations.

The applicable legal basis may be Article 6(1)(b) GDPR where processing is necessary to administer participation under campaign terms.

Where optional marketing consent is requested, it will be treated separately.

Specific information may also be provided in the rules or privacy notice relating to the relevant campaign.

19. A/B TESTING AND WEBSITE OPTIMISATION

Where enabled and subject to applicable cookie requirements, we may conduct A/B testing or similar Website optimisation activities.

This means different visitors may be shown different layouts, wording, design elements or Website functionality so that we can measure which version performs better.

Depending on the implementation, analytics identifiers or cookies may be used.

Where such processing requires consent, we carry it out only after you have provided that consent.

Legal basis: Article 6(1)(a) GDPR, where consent is required.

20. SERVICE PROVIDERS AND RECIPIENTS

We may engage trusted third parties to process personal data on our behalf or provide services necessary for the operation of PHIBBA.

Depending on the relevant service, recipients may include:

• website hosting providers;
• e-commerce platform providers;
• cloud infrastructure providers;
• payment processors;
• courier and logistics companies;
• customer support providers;
• email and newsletter providers;
• analytics providers;
• advertising and marketing providers;
• IT and cybersecurity providers;
• accountants, auditors and professional advisers.

We disclose only the personal data reasonably necessary for the relevant purpose.

Where third parties act as processors on our behalf, they are required to process personal data in accordance with our instructions and applicable data protection requirements.

Some recipients may act as independent controllers for certain processing activities, in which case their own privacy policies may also apply.

21. INTERNATIONAL TRANSFERS OF PERSONAL DATA

Some of our service providers may process personal data outside the European Economic Area.

Where personal data is transferred to a country outside the EEA, we use a lawful transfer mechanism where required under Chapter V GDPR.

Depending on the recipient and destination, this may include:

• an adequacy decision adopted by the European Commission;
• the EU–US Data Privacy Framework, where applicable to an eligible participating US organisation;
• European Commission-approved Standard Contractual Clauses;
• another lawful transfer mechanism permitted by the GDPR.

Where appropriate, additional safeguards may also be implemented.

22. DATA RETENTION

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Retention periods depend on the type of information and purpose of processing.

For example:

• order, accounting and invoicing information may be retained for legally required tax and accounting periods;
• customer service correspondence may be retained for a reasonable period to resolve inquiries and establish or defend legal claims;
• marketing data is retained until consent is withdrawn or the relevant data is no longer necessary;
• account information is generally retained while your account remains active, subject to legal retention obligations;
• cookie data is retained according to the lifespan of the relevant cookie or technology.

When personal data is no longer required, we delete or anonymise it where reasonably possible and legally permitted.

23. SECURITY

We take appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access;
• unlawful processing;
• accidental loss;
• destruction;
• alteration;
• unauthorised disclosure.

Measures may include, where appropriate:

• encrypted communications;
• access controls;
• secure hosting;
• authentication measures;
• restricted internal access;
• security monitoring;
• regular software updates;
• contractual safeguards with service providers.

No Internet-based system can guarantee absolute security, but we take reasonable measures proportionate to the risks involved.

24. CHILDREN

The PHIBBA Online Store is not intended for children to independently enter into purchase contracts.

We do not knowingly seek to collect personal data from children for marketing purposes without the consent or other legal basis required under applicable law.

If we become aware that personal data has been collected unlawfully from a child, we will take reasonable steps to delete or otherwise appropriately handle the data.

25. WITHDRAWAL OF CONSENT

Where processing is based on Article 6(1)(a) GDPR – consent, you may withdraw your consent at any time.

Withdrawal applies to future processing and does not affect the lawfulness of processing carried out before consent was withdrawn.

Depending on the processing activity, consent may be withdrawn through:

• our cookie settings;
• an unsubscribe link;
• account settings;
• contacting us at hi@phibba.com.

26. RIGHT TO OBJECT

Where we process personal data on the basis of Article 6(1)(f) GDPR – legitimate interests, you may object to the processing on grounds relating to your particular situation.

We will stop the relevant processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing is necessary for the establishment, exercise or defence of legal claims.

Direct Marketing

You have the right to object at any time to the processing of your personal data for direct marketing purposes, including related profiling.

If you object to direct marketing, we will stop processing your personal data for that purpose.

To exercise this right, contact:

Email: hi@phibba.com
Telephone: +359 88 70 70 170

27. AUTOMATED DECISION-MAKING AND PROFILING

PHIBBA may use limited profiling for purposes such as marketing personalisation, audience creation or Website optimisation where legally permitted.

Where profiling relies on consent, it will only be carried out after the necessary consent is obtained.

We do not intend to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you unless such processing is permitted by Article 22 GDPR and the required safeguards are implemented.

28. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy and Cookie Policy from time to time to reflect:

• changes to our Website or services;
• changes to technologies we use;
• changes to service providers;
• changes to applicable law;
• regulatory guidance;
• changes to our processing activities.

The current version will be published on https://phibba.com.

Where changes materially affect the way we process personal data, we may provide additional notice where required by law.

29. CONTACT

For questions concerning this Privacy and Cookie Policy, the processing of your personal data or the exercise of your rights, please contact:

MarmaMATER EOOD
PHIBBA
UIC/VAT No.: 208623649
Registered office and management address: 1 Ravnogor Str., Sofia, Bulgaria
Website: https://phibba.com
Email: hi@phibba.com
Telephone: +359 88 70 70 170