1. Controller and contact
The company identified above is the controller of personal data processed to operate BulkMarket. Contact info@cargoviant.com or the registered postal address for privacy questions and rights requests. This notice covers visitors, account holders, company representatives, buyers, sellers and people communicating with us. Companies' data may also identify natural persons, so personal contact details remain protected.
2. Data and sources
We receive account identifiers, name, email, password hash, role, company and VAT details, address, telephone, country, language, time zone, business hours and website from registration and profile updates. We process listings, photographs, public descriptions, favourites, saved searches, messages, reviews, disputes and notification preferences. Payment records include order references, amounts, currency, method, status, subscription entitlements and provider references; we do not receive or store full card numbers or security codes through the hosted checkout. Security data may include IP-derived login-rate-limit identifiers, session and reset-token data, action logs and hosting access logs. Information may come from another participant, a payment confirmation, a verification record or an authority, not only directly from you.
3. Purposes and legal bases
Account operation, subscriptions, enquiries, messaging and service notices rely on GDPR Article 6(1)(b) where you are the contracting individual. For employees or representatives acting for an organisation, necessary business communications and account administration rely on Article 6(1)(f), the legitimate interests of providing the service to that organisation. Verification, fraud prevention, security, proportionate moderation and defending legal claims also rely on legitimate interests, subject to balancing against your rights. Accounting, lawful authority requests and other mandatory duties rely on Article 6(1)(c). An optional promotional newsletter relies on consent under Article 6(1)(a); selecting no newsletter or withdrawing consent does not cancel necessary service notices. We do not use acceptance of the General Terms as consent to every processing purpose.
4. Visibility and recipients
Public listing content, seller/company identity and general location may be seen by visitors and indexed by search engines. Seller contact details are disclosed according to the platform's subscription rules; messages are available to the conversation participants. Authorised administrators may access necessary records for support, security, moderation, disputes and legal duties, with access limited to the task. HostingX provides hosting infrastructure in Bulgaria; authorised hosting, maintenance, accounting and professional advisers receive only necessary information under applicable confidentiality and data-protection arrangements. SumUp and the banks process payment information under their respective legal roles and privacy notices. Authorities receive information where legally required. We do not sell personal contact databases. Do not publish information about another person without an appropriate basis.
5. External services and international transfers
The website may request externally hosted illustrative images, including images.unsplash.com; the image provider receives connection data such as the IP address when the browser requests the image. Following a seller link or opening the hosted payment page takes you to another provider with its own notice. The application does not intentionally send account databases outside the EEA merely to display a page. Where a service provider's documented processing involves a third-country transfer, the controller must use the applicable GDPR Chapter V mechanism, such as an adequacy decision or standard contractual clauses with necessary supplementary safeguards. Ask us for the relevant recipient and safeguard details for the processing affecting you; this notice does not assert that every external provider processes exclusively inside the EU.
6. Retention criteria
Account data is retained while the account and associated service relationship require it. After closure, information unnecessary for a continuing duty is deleted or anonymised; access may first be restricted where erasure would conflict with an accounting obligation, a pending dispute, an authority order or the applicable period for establishing or defending a claim. Messages, complaints and transaction evidence are retained only for the relationship, resolution and applicable limitation-period needs, not for unrestricted reuse. Bulgarian accounting registers, financial reports and related tax-control records are retained for the legally prescribed period, generally 10 years from the relevant statutory starting point. Security records are assessed against the incident-prevention and investigation purpose; expired reset tokens and excessive technical history should not be kept as a permanent user dossier. Backups are access-restricted and removed or overwritten through the hosting backup cycle; data is not restored for unrelated new use. Ask us for the applicable period or legal hold for a specific record.
7. Your rights
Subject to the GDPR's conditions, you may request access and a copy, correction, erasure, restriction and portability, and object to processing based on legitimate interests. You may object to direct marketing at any time and withdraw consent as easily as it was given, without affecting earlier lawful processing. Use the profile to change available details and newsletter preferences, or email us for other requests and account closure. We may request proportionate evidence of identity, not excessive identification by default. We normally respond within one month; a lawful extension of up to two further months is explained within the first month. You may complain to the Bulgarian Commission for Personal Data Protection, Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., cpdp.bg, or another competent EU supervisory authority, and seek a judicial remedy.
8. Required information and decision-making
Information marked as required is necessary for the relevant account, order, verification or legal duty; without it the corresponding function may be unavailable. Optional fields and marketing choices are not a condition for basic account registration unless clearly necessary for the chosen service. Access checks, filters and subscription expiry may be applied automatically, but the platform does not use solely automated decisions producing legal or similarly significant effects as an undisclosed substitute for human review. You may contact us to challenge a restriction or request human assessment. The General Terms and Cookie Policy provide related information; a new incompatible processing purpose requires the appropriate information and lawful basis before it begins.