Privacy Policy

Version: September 27, 2026.
Effective from: September 27, 2026.

1. Administrator

The personal data administrator is:

„"DR. DIMITAR MARINOV" EOOD
UIC: 206584610
Address: Varna 9000, Odessos district, 112 Vladislav Varnenchik Blvd.
Phone: 0896 779 770
Email for questions and exercising rights: dr.marinov.md@gmail.com

The policy explains what data is processed when visiting drmarinov.com, contacting us, booking a consultation, and ordering a product. GDPR requires that the identity of the controller, the purposes, the legal basis, and applicable information about the processing be specified upon collection.

2. Principles

Only data that is relevant and necessary for a specific, clearly defined purpose is processed. Data is kept for no longer than necessary, except where a regulatory act imposes a longer period, and is protected by appropriate organizational and technical measures.

3. Categories and purposes

"Consent" is not used as a basis for the execution of the order: the necessary data is processed for the contract and legal obligations. The GDPR explicitly allows processing when it is necessary for a contract, pre-contractual actions or compliance with a legal obligation.eur-lex.europa+1

4. Health data

Health data is a special category of personal data and enjoys additional protection. The term covers not only medical records, but also information from which inferences can be drawn about physical or mental health.

The guide order form is not intended for health data. Do not enter diagnoses, medications, body weight, lab results, or other medical details.

Where health data are necessary for a separately requested medical consultation or provision of healthcare, they shall be processed separately only to the extent necessary and on a valid basis under Art. 6 and Art. 9 GDPR and national health legislation. Art. 9 GDPR generally prohibits the processing of health data, except where a specific exception applies, including for medical diagnosis or provision of healthcare under appropriate safeguards.eur-lex.europa+1

If a user submits unsolicited health information through a general form, it is restricted, redirected to an appropriate secure channel, or deleted when there is no reason to keep it.

5. Mandatory data

Fields marked as mandatory when placing an order are required for the conclusion and performance of the contract. Without them, the order may not be accepted or delivered. Subscription to marketing, analytical and advertising cookies is not a condition of purchase.

6. Recipients

Data may only be provided in the necessary volume to:

• website hosting, maintenance and security provider;

• courier or logistics partner for delivery and return;

• bank, payment operator or cash on delivery/postal money order provider;

• accountant, auditor or legal consultant if necessary;

• email, newsletter and customer service provider;

• providers of statistics, advertising, video or embedded content - only in accordance with applicable consent;

• competent public authorities when provision is required by law.

Data is not sold. Providers who process data on behalf of the controller must be bound by appropriate contractual obligations, confidentiality and instructions.

7. Google and external services

The site may use Google services, including Google Analytics, Google Tag and Google AdSense, as well as embedded content from external platforms. These services must not store or read non-strictly necessary identifiers before valid consent. The Court of Justice of the EU has held that a pre-ticked box is not valid and that the visitor must be informed about the duration of cookies and third-party access.

When the relevant category is enabled, the external provider can obtain online identifiers, technical data and interaction information. The detailed up-to-date list, provider, purpose and term of each technology are displayed in the panel „"Cookie Settings"“.

8. Transfers outside the EEA

Some technology providers may process data outside the European Economic Area. Where applicable, the transfer is based on an adequacy decision, standard contractual clauses or other mechanism under the GDPR, with appropriate risk assessment and additional measures.

9. Deadlines

• Data for an active order is kept until it is fulfilled, and then for the periods necessary for complaints, legal claims, accounting and tax reporting.

• Accounting records and financial statements are kept for 10 years, and other relevant media may be subject to a 5-year or other legal period depending on their type.

• General inquiries are kept until the correspondence is completed and usually for 12 months thereafter, unless they are part of a contract, medical records, dispute, or there is another reason.

• Newsletter data is kept until consent is withdrawn. A minimal record of the unsubscribe may be kept to prevent the address from being added again and to prove compliance.

• Security logs are kept for a limited period of time, determined according to risk and technical necessity.

• The expiration date of specific cookies is displayed in the settings panel.

When the period expires, the data is deleted or irreversibly anonymized, unless the law or a pending claim requires retention. The principle is that personal data should not be kept longer than necessary for the purpose.

10. Rights

Under the terms of the GDPR, the subject may request:

• information and access to the processed data;

• correcting inaccurate or incomplete data;

• deletion when there is no reason for continued storage;

• restriction of processing;

• portability for applicable data;

• objection to processing based on legitimate interest;

• object at any time to direct marketing;

• withdrawal of consent going forward;

• information on applicable logic and protection in decisions based solely on automated processing, where such decisions have significant consequences.

The request can be sent to the contact email. In case of reasonable doubt about the identity, additional minimum information may be requested for confirmation. The right to erasure does not apply to information that must be kept by law or is necessary for legal claims. GDPR provides for rights of access, restriction and objection, including against profiling on the relevant grounds.

11. Complaint to a supervisory authority

The subject has the right to file a complaint with:

Personal Data Protection Commission
Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
Email: kzld@cpdp.bg
Website: https://www.cpdp.bg

The contact details are published by the CPDP.

12. Security

Appropriate measures are used according to risk, including access control, updates, secure connection, backups, restriction of rights, contracts with processors and incident procedures. No Internet system can be guaranteed to be absolutely secure.

13. Minors

Products and medical advice are not intended for independent purchase by minors. If it is determined that a child's data has been provided without appropriate justification or involvement of a parent/guardian, action will be taken to restrict or delete it as appropriate.

14. Changes

The policy may be updated as the site, providers, or the law change. The new version will be posted with a date. In the event of a material change, appropriate notice will be provided, and when new consent is required, it will be requested separately.