Who is responsible
The controller of the personal data described here is Ma Ko Ma Grup EOOD, company number 208349002, VAT BG208349002, with its registered office at Yuzhen Park residential complex, block 91V, entrance 1, apartment 4, Triaditsa district, 1421 Sofia, Bulgaria, represented by its director Yavor Ivanov Iliev. Post can be sent to the company's correspondence address, Lagera residential complex, 5 Balkandji Yovo Street, entrance B, floor 1, apartment A, 1612 Sofia, Bulgaria.
For anything in this notice, including a request about your data, write to yavor.makomagrup@gmail.com or call +359 87 9038396.
Where the data comes from
Personal data reaches the company either directly from you, when you send an email or make a telephone call, or from the organisation you are writing on behalf of. No personal data is bought, rented or collected from data brokers, and this website has no contact form, no account system and no newsletter sign-up.
Providing your data is voluntary. There is no legal or contractual obligation to give it, but without contact details an enquiry cannot be answered.
What is processed, why, and on what lawful basis
Answering your enquiry
Your name, the organisation you represent, your email address or telephone number and whatever you write in your message. The purpose is to read the enquiry and reply to it. The lawful basis is Article 6(1)(b) GDPR, taking steps at your request before entering into a contract, or Article 6(1)(f) GDPR, the legitimate interest in responding to business correspondence where you write on behalf of an organisation. This correspondence is normally kept while the enquiry is open and for up to twelve months afterwards.
Managing a business relationship
Contact and order details of the people who act for a customer or supplier, processed so that an agreement can be prepared, performed and administered. The lawful basis is Article 6(1)(b) GDPR where you are the contracting party, and Article 6(1)(f) GDPR where you are a contact person acting for a company. The data is kept for the duration of the relationship.
Accounting and tax records
Data contained in invoices, contracts and payment records, processed because the law requires the company to keep them. The lawful basis is Article 6(1)(c) GDPR, and the data is kept for the retention periods laid down by Bulgarian accounting and tax legislation.
Delivering this website securely
The hosting provider processes technical request data such as IP address, user agent, requested address and time of request, in order to serve the pages and protect the service against abuse. The lawful basis is Article 6(1)(f) GDPR, the legitimate interest in a reliable and secure website. These server records are held for the short operational periods set by the hosting provider. The company does not use them to build profiles or to identify individual visitors.
Legal claims
Where necessary, correspondence and contract records are processed to establish, exercise or defend a legal claim, on the basis of Article 6(1)(f) GDPR, and are kept until the relevant limitation period ends.
Who receives the data
Personal data may be made available to:
- the email and telephone providers used to receive and answer messages;
- the hosting provider that serves this website;
- accountants, auditors and legal advisers bound by professional confidentiality;
- public authorities and courts, where disclosure is required by law.
Personal data is never sold, rented or exchanged, and it is not passed to advertising networks or data brokers. Service providers act on instructions under a processing agreement wherever they process data on the company's behalf.
Transfers outside the European Economic Area
Some widely used communication and hosting services are operated by providers established outside the European Economic Area, or store data there. Where that happens, the transfer relies on the safeguards required by Chapter V of the GDPR, such as an adequacy decision by the European Commission under Article 45 or standard contractual clauses under Article 46. You can ask at the contact address above which providers are in use and on what basis a transfer takes place.
Automated decisions and profiling
No automated decision-making that produces legal effects, and no profiling within the meaning of Article 22 GDPR, takes place.
Children
This website addresses businesses and is not directed at children. No personal data is knowingly collected from children.
Your rights
Under the GDPR you may:
- ask whether your data is processed and receive a copy of it (Article 15);
- have inaccurate data corrected and incomplete data completed (Article 16);
- have your data erased where one of the grounds applies (Article 17);
- have processing restricted while a dispute about it is resolved (Article 18);
- receive data you provided in a structured, commonly used, machine-readable format and have it transmitted to another controller (Article 20);
- object at any time to processing based on legitimate interests, on grounds relating to your particular situation (Article 21);
- withdraw consent at any time, with effect for the future, where processing is based on consent (Article 7(3));
- be informed of the reasoning and ask for human intervention if you are ever subject to a solely automated decision (Article 22).
How to exercise your rights
Send your request to yavor.makomagrup@gmail.com. Say which right you are exercising and give enough detail to locate your data. If there is a genuine doubt about who you are, further information may be requested to confirm your identity.
A reply follows within one month of receipt. Where a request is complex, or where several requests are made, that period may be extended by up to two further months and you will be told within the first month that this has happened and why. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.
Complaints
If you believe your data is being handled unlawfully, please raise it at the contact address above first. You also have the right to lodge a complaint with a supervisory authority, in particular the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Boulevard, 1592 Sofia, Bulgaria, email kzld@cpdp.bg, cpdp.bg.
You may instead complain to the supervisory authority of the European Union member state where you live, where you work, or where the alleged infringement took place, and you have the right to an effective judicial remedy under Articles 78 and 79 GDPR.
Cookies
This website does not set cookies and does not use analytics or advertising technology. The cookie policy explains this in full.
Version
This notice may be updated if the website or the company's data practices change. Last updated 22 September 2026.