Legal
Privacy Policy
Last updated: 5 November 2026 · Applies to stamarmed.com
This policy explains what personal data we collect when you use stamarmed.com, contact us or apply for a job with us, why we collect it, how long we keep it and what rights you have. We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act.
1. Who is responsible for your data
The data controller is Stamar 2013 Ltd., a company registered in Bulgaria under UIC 202777423 (VAT No. BG202777423), with registered office at 72 Rayko Daskalov Str., ground floor, 4000 Plovdiv, Bulgaria, and head office at 12-14 Tserova Gora, Sofia, Bulgaria (“Stamarmed”, “we”, “us”).
For any question about this policy or your personal data, write to privacy@stamarmed.com or send a letter to the address above.
2. What data we collect, why and for how long
| When | Data | Purpose and legal basis | Retention |
|---|---|---|---|
| Contact form, e-mail or phone enquiry | Name, e-mail address, company and phone number (if you provide them), the content of your message. | To answer your enquiry and, if you represent a manufacturer, a clinic or an institution, to prepare an offer or a partnership proposal. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). | 12 months after our last exchange, or for the duration of the business relationship and the statutory limitation periods that follow it. |
| Job application | Name, e-mail address, phone number, area of interest, your CV and any message or documents you attach. | To assess your application and contact you about it. Legal basis: steps taken at your request before entering into an employment contract (Art. 6(1)(b) GDPR). | Deleted within 6 months after the end of the selection procedure, as required by Art. 25k of the Bulgarian Personal Data Protection Act — unless you consent to us keeping your application for future openings for up to 12 months. |
| Visiting the website | IP address, browser type and version, device type, pages visited, date and time of the visit, referring page (server log data). | To deliver the website securely, detect abuse and fix technical problems. Legal basis: our legitimate interest in the security and stability of the website (Art. 6(1)(f) GDPR). | 30 days, unless a security incident requires longer analysis. |
| Cookies | See our Cookie Policy. | Strictly necessary cookies are used on the basis of our legitimate interest; all other cookies only with your consent (Art. 6(1)(a) GDPR). | See the Cookie Policy for each cookie. |
We do not use your data for automated decision-making or profiling, and we do not sell personal data.
3. Who receives your data
Your data is accessible only to the Stamarmed employees who need it to handle your enquiry or application. In addition, we use the following categories of service providers, who process data on our behalf under a data processing agreement:
- Web hosting — Automattic Inc. (WordPress.com), USA;
- E-mail and office software — Google Workspace (Google Ireland Limited), EU;
Where your enquiry concerns one of the group’s brands (for example Ototon hearing centres or ENT.bg), we may pass it to the responsible group company so that it can answer you directly. We disclose personal data to public authorities only when the law requires it.
4. Transfers outside the European Economic Area
We store and process personal data within the EU/EEA. If a service provider processes data in a country outside the EEA, we rely on an adequacy decision of the European Commission or on the Standard Contractual Clauses approved by the Commission (Art. 46 GDPR), and apply additional safeguards where necessary.
5. Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy of it;
- rectification of inaccurate or incomplete data;
- erasure of your data (“right to be forgotten”), where there is no overriding reason to keep it;
- restriction of processing in the cases provided by law;
- data portability — to receive the data you gave us in a structured, machine-readable format;
- object to processing based on our legitimate interests;
- withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before the withdrawal.
To exercise any of these rights, write to privacy@stamarmed.com. We will answer within one month; in complex cases this period may be extended by two further months, and we will tell you if that is the case. We may ask you to confirm your identity before acting on a request.
If you believe that we process your data unlawfully, you have the right to lodge a complaint with the Bulgarian supervisory authority: the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg. We would appreciate the chance to address your concern first.
6. How we protect your data
We apply technical and organisational measures appropriate to the risk — encrypted connections (HTTPS), access control, regular updates and backups of our systems, and internal procedures that form part of our ISO 9001 quality management system. Access to personal data is limited to employees and providers who need it for the purposes described above and who are bound by confidentiality.
7. Links to other websites
This website links to the websites of the group’s brands and partners and to LinkedIn. Each of these websites has its own privacy policy, and we are not responsible for their content or their processing of your data.
8. Children
This website is addressed to business partners, medical professionals and job candidates. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us and we will delete it.
9. Changes to this policy
We may update this policy when our services or the law change. The current version is always published on this page with the date of the last update. Material changes will be announced on the website.
