Privacy Policy

1. Data controller

The controller responsible for your personal data is Innovation Europe EOOD (Bulgarian single-member limited liability company (ЕООД)), registered office bul. Stefan Stambolov 34, fl. 3, office 303, 1000 Sofia, Bulgaria; VAT BG207340527.

For any privacy question or to exercise your rights, contact us at legal@ie-energy.eu.

2. Personal data we collect

We collect only the data we need to open and operate a trade account and to fulfil orders:

• Account & business data: company name, VAT number, business address, and the name, business email, phone and role of the contact person you designate.
• Order & transaction data: quotes, purchase orders, invoices, delivery details and payment status.
• Technical & usage data: IP address, device/browser information, and — only with your consent — analytics about how you use the site.
• Communications: messages you send us via forms or email, including support and escalation history.

3. Purposes and legal bases

We process personal data for the following purposes, each with a GDPR legal basis:

• To create and manage your trade account and provide the platform — performance of a contract (Art. 6(1)(b)).
• To validate your VAT number via the EU VIES system and apply the correct VAT treatment — legal obligation and legitimate interest (Art. 6(1)(c), (f)).
• To process orders, invoicing, delivery, and returns and warranty claims — performance of a contract and legal obligation.
• To keep accounting and tax records — legal obligation under Bulgarian and EU law.
• To secure the platform and prevent fraud — legitimate interest.
• For optional analytics and marketing — your consent (Art. 6(1)(a)), which you can withdraw at any time via the cookie settings.
• To answer your support questions in the trade portal, including through an AI assistant that looks up your own orders, invoices, stock and account data in order to reply — performance of a contract and our legitimate interest in supporting you (Art. 6(1)(b), (f)). Using the assistant is optional: you can write to us by email instead, at any point.

4. VAT validation (VIES)

To open a trade account and to invoice EU business customers under the reverse-charge regime, we validate your VAT number against the European Commission's VIES service. We store the fact and timestamp of a validation to justify the VAT treatment applied to your invoices, as required by tax law.

5. Cookies and similar technologies

We use strictly necessary cookies to run the site (for example, session and cart). These do not require consent. Any analytics or marketing technologies are loaded only after you agree to them.

You can review and change your choices at any time through the cookie settings, reachable from the consent banner. Non-essential technologies are off by default until you opt in.

Operational analytics: to run and improve the trade service, we record key account events — account creation, approval, and orders placed — linked to your account rather than to anonymous browsing. We process this on the basis of our legitimate interest in operating and improving the platform, and it is processed within the EU. This is separate from the optional website analytics described above, which run only with your consent.

6. Sharing with processors and partners

We do not sell personal data. We share it only with service providers acting on our instructions under a data-processing agreement, and only as needed:

• Hosting and infrastructure providers for the website and commerce backend (Vercel; Hetzner).
• Our supplier V-TAC Europe OOD and logistics partners, to fulfil and deliver your orders (V-TAC acts as an independent controller for its own fulfilment and warranty processing).
• Payment providers, to take and reconcile payment for your orders (Stripe, which is responsible for its own regulated payment processing). Where you pay by a method operated by another provider through Stripe's checkout, that provider processes your payment data on its own responsibility. We do not offer credit or financing and share no data for that purpose.
• Email, productivity and support tools used to communicate with you (Google Workspace; Resend for transactional email).
• Product analytics (PostHog, EU region): the account-level operational events described in section 5, on the basis of our legitimate interest; browser analytics from the same provider run only if you opt in.
• Website analytics, subject to the cookie settings (Plausible — cookieless; Google Analytics only if you opt in).
• Error monitoring (Sentry), which receives technical diagnostics when something fails: the request or page involved and the state of the application at that moment. It is configured not to send request bodies, cookies or account identifiers, but diagnostic data can incidentally contain personal data.
• AI language-model provider (Anthropic), when you use the assistant in the trade portal: your message, the conversation so far, and the account, order or product data the assistant retrieved in order to answer it. Anthropic acts as our processor under a data-processing agreement and is contractually prohibited from training its models on this content. It deletes inputs and outputs within 30 days, keeping them for up to 2 years only where content is flagged under its usage policy. This processing takes place outside the EEA — see section 7.

7. International transfers

We aim to keep processing within the EU/EEA. Where a provider processes data outside the EEA, we rely on a European Commission adequacy decision or on Standard Contractual Clauses (SCCs), together with supplementary technical and organisational measures where required. Our processor register is reviewed whenever a new vendor is introduced. Our AI assistant provider (Anthropic) processes data outside the EEA on the basis of Standard Contractual Clauses.

8. How long we keep data

We keep personal data only as long as necessary to fulfil contractual obligations, accounting and tax obligations, warranty administration and legal-defence requirements. Where several legal retention obligations apply, the longest mandatory period prevails.

We maintain an internal retention schedule covering every category of data we hold, and an automated nightly process enforces it. In outline: accounting records — invoices, credit notes, orders and the VAT-validation evidence behind them — are kept for the period required by Bulgarian accounting and tax law; sign-in and password-reset tokens are removed once they expire; a basket that never became an order is deleted after 90 days; the public link to a client quotation is withdrawn 30 days after the quotation lapses; our record of the emails we sent you is kept for up to 24 months, and only 7 days where it contains a sign-in link; a conversation with the support assistant, including the questions you typed, is deleted 180 days after its last message; and a trade application we declined is reduced to the company and the fact of the decision after 12 months.

Deletion takes effect in our live systems straight away. Encrypted backups are taken daily and are overwritten on a rolling basis within 30 days, so data we have deleted may still exist in a backup until then; we do not restore deleted data from a backup.

9. Your rights

Subject to the conditions in the GDPR, you have the right to access, rectify, erase or restrict the processing of your personal data, to data portability, and to object to processing based on our legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting prior processing.

Where the law requires us to keep a record — an invoice, for example, and the VAT-validation evidence that justifies its tax treatment — we cannot erase it on request. In that case we restrict its use to that legal purpose, erase everything not covered by the obligation, and tell you which records are affected.

To exercise any of these rights, contact legal@ie-energy.eu. We respond within the time limits set by law.

10. Contact

Questions about this policy or our data practices: legal@ie-energy.eu. Postal address: Innovation Europe EOOD, bul. Stefan Stambolov 34, fl. 3, office 303, 1000 Sofia, Bulgaria.

11. Changes to this policy

We may update this policy as our services or the law evolve. We will post the updated version here with a new date and, where appropriate, notify account holders.

Right to lodge a complaint

You have the right to lodge a complaint with a data-protection supervisory authority:

• Lead authority (Bulgaria): Комисия за защита на личните данни (KZLD) — www.cpdp.bg/