Sendaro Privacy Policy

1. Controller and scope of this policy

This Privacy Policy explains how Sendaro processes personal data, what rights you have and how to exercise them. Please read it carefully.

The Sendaro service (sendaro.bg, app.sendaro.bg) is a B2B SaaS platform for online merchants. With regard to data protection, we act in two different roles:

— Controller — for the personal data of the merchants themselves (account, company and payment data). We are responsible for this data, and it is governed in full by this policy.

— Processor — for the personal data of the merchants’ end customers (the recipients of orders). The controller of this data is the respective merchant, and the processing is governed by a separate Data Processing Agreement (DPA) — see section 4.

The controller within the meaning of the GDPR is: Vladov Komers EOOD („Владов Комерс“ ЕООД), UIC (EIK) 203224076, VAT No. BG203224076, Byala, Ruse Province, Bulgaria, email support@sendaro.bg, tel. +359 884 963 484.

Data Protection Officer (DPO): no data protection officer (DPO) has been appointed; for data protection questions: support@sendaro.bg.

For questions about this policy and to exercise your rights: support@sendaro.bg.

2. What data we collect about merchants

When you register and use Sendaro as a merchant, we process the following categories of personal data:

— Account and profile data: first and last name, email address, phone number, password (stored only in hashed form), roles and settings of your users.

— Company and billing data: company name, UIC (EIK), VAT number, registered office/address, contact person, subscription details and payment history. Payments are processed through Revolut (see section 7); we do not store full bank card details.

— Communication and support: the messages you send us (email, chat, tickets), including when they are processed using artificial intelligence (see section 6).

— Technical data and logs: IP address, date and time of access, actions in the platform, browser/device identifiers, system log files.

— Usage and configuration data: connected stores, integrations, couriers, templates and settings that you create in the platform.

3. Purposes and legal bases for processing merchants’ data

We process merchants’ data for the purposes set out below and on the following legal bases under Art. 6 GDPR:

— Providing, maintaining and administering the service, including creating and managing your account — performance of a contract (Art. 6(1)(b)).

— Invoicing, accounting and compliance with tax and accounting obligations — performance of a contract (point (b)) and legal obligation (point (c)), e.g. under the Bulgarian Accountancy Act.

— Support, responding to enquiries and communicating with you — performance of a contract (point (b)) and/or our legitimate interest (point (f)).

— Security, prevention of fraud and abuse, diagnostics and stability of the service — our legitimate interest (point (f)).

— Improving the service and aggregated (summary) statistics — our legitimate interest (point (f)).

— Direct marketing of our own services to merchants — yes: we send information about our own services to merchants and prospective customers on the basis of legitimate interest; every message contains a clear option to opt out, which applies from then on.

— Compliance with legal obligations and the defence of legal claims — legal obligation (point (c)) and legitimate interest (point (f)).

Where we rely on legitimate interest, we can provide you, on request, with information about the balancing-of-interests assessment we have carried out.

Providing account and billing data is necessary for entering into and performing the contract. Without it, we cannot provide you with the service.

4. Data of merchants’ end customers (Sendaro as processor)

In order to provide our services to the merchant, we process personal data of the merchant’s end customers (the recipients of orders): name, phone number, email address, delivery address or courier office/parcel locker, order contents and the cash-on-delivery amount.

The merchant is the controller of this data, and Sendaro acts as processor. We process it only on the merchant’s documented instructions — to create waybills, calculate prices, send notifications (SMS/email), provide tracking, handle returns, print labels and for related functions.

The full terms of this processing (subject matter, duration, security measures, sub-processors, assistance with data subjects’ rights, deletion/return of the data) are set out in a Data Processing Agreement (DPA) under Art. 28 GDPR, which forms part of the terms between Sendaro and the merchant.

We receive this data from the merchant and/or directly when an order is placed through the embedded checkout. For the purposes of Art. 14 GDPR, the source of the data is the merchant and the merchant’s store.

If you are an end customer and wish to exercise your rights over your data, please contact the merchant you ordered from (the merchant is the controller). As processor, we assist the merchant in responding to your request.

4.1. Shopify app “Sendaro Delivery”

When a merchant installs the “Sendaro Delivery” app from the Shopify App Store, Sendaro processes the store’s order data received from Shopify (customer name, shipping address, phone number, email address and the ordered items) only to show the orders in the app, create courier waybills, print labels and send tracking information back to Shopify, on behalf of that merchant (Sendaro as processor).

Customer data of one merchant is never shared with or used for another merchant: stores connected through “Sendaro Delivery” are excluded from Sendaro’s cross-merchant phone-based checks (the delivery risk registry and the cash-on-delivery trust score — see section 5).

Data is shared with the courier that the merchant connects (Econt, Speedy or Pigeon Express) only as needed to create and deliver the shipment.

Shopify’s mandatory privacy webhooks are honoured: on a customers/data_request request, Sendaro emails the merchant the customer’s data held for that store; on customers/redact and shop/redact requests, the data is deleted.

App charges are billed by Shopify (Shopify App Pricing); Sendaro does not collect payment card data through the app.

Contact: support@sendaro.bg.

5. Sendaro’s own processing as controller (incl. COD Trust)

In some cases we ourselves determine the purposes and means of the processing and are therefore the controller — even where the data originates from orders. This processing is governed not by the DPA but by this policy:

— COD Trust registry: a platform-level registry of flags concerning recipients who do not collect cash-on-delivery parcels. Across different stores, a flag is shown only in anonymised form (e.g. “N stores”), without revealing the specific merchants. The person concerned can dispute the flag via a dedicated page. Legal basis: our legitimate interest (Art. 6(1)(f)) — reducing fraud and losses from uncollected parcels on the platform.

— Product and aggregated analytics for developing the service — our legitimate interest (point (f)).

— Our own invoicing and subscription management (see section 3).

Flags are taken into account for 24 months from the date of the event; after that, they no longer count towards the assessment. Only an uncollected parcel is recorded automatically — when courier tracking shows it as returned to the sender and it was NOT delivered; voluntary returns are not recorded. A merchant may submit a flag only with evidence — a specific order. A flag may be withdrawn by the party who submitted it. A data protection impact assessment (DPIA) for the registry is carried out separately.

6. Artificial intelligence (AI assistant)

We use artificial intelligence (the Anthropic Claude API) for an AI assistant (chat and voice) that helps with confirming orders and processing messages.

Anthropic acts as a sub-processor. Under contract, input data and generated responses are not used to train models; the API’s operational logs are deleted within 7 days by default.

AI processing of end customers’ messages is carried out on the merchant’s instructions (processor role); processing of the merchant’s own messages is based on performance of a contract and/or legitimate interest.

Anthropic processes data in the USA — for transfers, see section 8.

7. Recipients and sub-processors

We do not sell personal data. We disclose it only to trusted providers (sub-processors), to separate controllers (the couriers) and to competent authorities where required by law.

We use the following sub-processors and providers:

— Railway — hosting and PostgreSQL database. Region: EU.

— Revolut (the Revolut group company named in the merchant acquiring agreement) — processing of subscription payments (card, Apple Pay, Google Pay) via a hosted payment page. Card details are entered directly with Revolut and do not pass through our systems; we receive limited payment information (status, amount, order identifier). Revolut acts as an independent controller of payment data under its own legal obligations as a payment service provider. Subscription invoices are issued by us (see section 1), not by Revolut.

— Anthropic — processing of messages using artificial intelligence (USA); AWS is a sub-sub-processor for Anthropic’s infrastructure.

— SMSAPI — sending SMS notifications (EU-based provider).

— SMTP email provider — sending email notifications: JetHost.

— Courier companies (Econt, Speedy, Sameday, BoxNow, Pigeon Express, euShipments) — we pass delivery data to them. The couriers are separate (independent) controllers under their own legal obligations as carriers, not our sub-processors.

— Google Fonts — fonts from Google are loaded on the marketing pages, which involves transmitting the visitor’s IP address to Google (USA).

Current list of sub-processors: /legal/privacy-en.html (Bulgarian version: /legal/privacy.html). For merchants: when a sub-processor is added or replaced, we notify you in advance, and you have the right to object in accordance with the DPA.

8. International data transfers

Some of our recipients are located outside the European Economic Area (EEA) — for example Anthropic (USA), possibly Railway depending on the selected region, and Google when fonts are loaded.

For such transfers we apply appropriate safeguards under Chapter V GDPR: (i) where the recipient is currently certified under the EU–U.S. Data Privacy Framework — on that basis; and/or (ii) the European Commission’s Standard Contractual Clauses (SCCs 2021/914, Module 2 and Module 3), which are deemed to be concluded through the relevant agreement, with the addenda for the United Kingdom and Switzerland where necessary.

Anthropic: certified under the DPF and additionally covered by SCCs.

Railway: EU.

We do not rely solely on the DPF; we also maintain a Transfer Impact Assessment.

You may request a copy of, or information about, the safeguards applied at: support@sendaro.bg.

9. Retention periods

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law:

— Account and profile data: for the term of the contract and 90 days after its termination.

— Invoicing and accounting data: for the statutory period of up to 10 years.

— Technical data and logs: up to 12 months (raw webhook messages from connected platforms — up to 90 days).

— Messages processed with AI: operational logs at Anthropic — up to 7 days; our retention period — up to 12 months.

— End customers’ data (processor role): for the period during which the service is provided to the merchant, plus a 30-day export window and the expiry of backups — in accordance with the DPA; subject to statutory exceptions.

— COD Trust registry: 24 months from the date of the event.

Backups: data is deleted immediately from active systems, while backups expire in the rotation cycle within up to 90 days; data restored from a backup is not returned to active processing.

10. Your rights as a data subject

Under the GDPR, you have the following rights in relation to your personal data:

— The right of access to your data and to a copy of it.

— The right to rectification of inaccurate or incomplete data.

— The right to erasure (“the right to be forgotten”), where the conditions for it are met.

— The right to restriction of processing.

— The right to data portability.

— The right to object to processing based on legitimate interest, including to direct marketing.

— The right to withdraw your consent at any time where processing is based on consent (withdrawal does not affect the lawfulness of processing before the withdrawal).

— The right not to be subject to a decision based solely on automated processing with legal or similarly significant effects (see section 14).

— The right to lodge a complaint with a supervisory authority (see section 11).

11. How to exercise your rights and the right to lodge a complaint

To exercise any of your rights, contact us at: support@sendaro.bg. We respond without undue delay and within one month; for complex or numerous requests, this period may be extended by a further two months, in which case we will inform you.

To protect your data, we may ask you to verify your identity.

If you are an end customer of a merchant using Sendaro, please address your request to that merchant (the controller); we will assist the merchant.

You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP): 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia; tel. +359 2 915 3518; email kzld@cpdp.bg; website www.cpdp.bg. (Please check the current contact details on the CPDP website.)

12. Cookies and similar technologies

In the app.sendaro.bg application we use a session login cookie, which is strictly necessary for authentication and security — no consent is required for it.

The marketing website does not use analytics or advertising trackers.

When a partner link (/join) is opened, we set a referral cookie, sendaro_ref (valid for 90 days), for the purposes of the partner programme.

Details of all cookies — type, purpose, duration, legal basis and how to manage them — are set out in the separate Cookie Policy: /legal/cookies.html (in Bulgarian).

13. Data security

We apply appropriate technical and organisational measures to protect personal data, including:

— Encryption of sensitive credentials and tokens (stored only in encrypted form).

— Role-based access control and isolation of each merchant’s data (by tenantId).

— Encryption in transit (TLS/HTTPS) and infrastructure protection.

— Access logs and internal confidentiality policies for staff.

In the event of a personal data breach, we notify the affected controllers without undue delay (e.g. within 48 hours), so that they can meet their obligation to notify the supervisory authority within 72 hours.

14. Automated decision-making and profiling

We do not carry out solely automated decision-making with legal or similarly significant effects concerning merchants within the meaning of Art. 22 GDPR.

The COD Trust registry involves the automatic creation of flags, but provides for human review and a page for disputing them; a flag is for information only and does not replace the merchant’s own decision on whether to fulfil a given order.

The AI assistant supports the confirmation of orders. The final decision on each order is made by the merchant. The AI assistant only prepares and suggests — it is not permitted to change the status of an order on its own. In the live chat, any conversation can be taken over by a human. There is no solely automated decision within the meaning of Art. 22 GDPR.

15. Changes to this policy

We may update this Privacy Policy. In the event of material changes, we will notify you by email or through a message in the platform.

Date of last revision: 29.07.2026. Version: 1.0.

16. Contact

For questions about this policy or the processing of your personal data: Vladov Komers EOOD, Byala, Ruse Province, Bulgaria, support@sendaro.bg, tel. +359 884 963 484 (no DPO has been appointed).