Privacy Policy

Invictus 1928 Ltd ("we", "us", "our") is a licensed consumer products company registered in Sofia, Bulgaria. This Privacy Policy explains how we collect, use, and protect personal data submitted through invictus1928.com, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Bulgarian data protection law.

We collect personal data only through the following forms on our website:

• Trade Enquiry Form: Company name, contact name, email address, country, products of interest, estimated quantity, and message
• Partner Registration Form: Company name, contact name, email address, country, business type, and trading information

We do not collect sensitive personal data (as defined by GDPR Article 9), nor do we collect data from individuals under 18 years of age. This website is a B2B platform and is not directed at consumers or minors.

The personal data you provide is used exclusively for the following purposes:

• To respond to your trade enquiry or partner registration request
• To assess suitability for a B2B commercial relationship
• To send commercial communications relating to our product catalogue, new licences, and trade fair appearances — only where you have expressly consented or where a legitimate business relationship exists
• To comply with legal and regulatory obligations

We do not sell, rent, or share your personal data with third parties for marketing purposes.

We process your personal data on the following legal bases under GDPR:

• Legitimate interest (Art. 6(1)(f)): processing enquiries from business professionals and potential trade partners
• Performance of a contract (Art. 6(1)(b)): managing existing trade partner relationships
• Consent (Art. 6(1)(a)): for any direct marketing communications
• Legal obligation (Art. 6(1)(c)): where required by Bulgarian or EU law

All personal data submitted through this website is stored securely on Supabase infrastructure hosted in the European Union (Frankfurt, Germany — AWS eu-central-1). Supabase is GDPR-compliant and operates under a Data Processing Agreement.

We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. Access to personal data is restricted to authorised Invictus 1928 Ltd personnel only.

We retain personal data for the following periods:

• Trade enquiries: 3 years from the date of submission, or until the enquiry is resolved
• Partner registrations: For the duration of the commercial relationship, plus 5 years thereafter for legal and accounting purposes

After these periods, data is securely deleted or anonymised.

As a data subject under GDPR, you have the following rights:

• Right of access — to obtain a copy of the personal data we hold about you
• Right to rectification — to correct inaccurate or incomplete data
• Right to erasure — to request deletion of your data ("right to be forgotten")
• Right to restriction — to request that we limit processing of your data
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at info@invictus1928.com. We will respond within 30 days. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) at www.cpdp.bg.

We may update this Privacy Policy from time to time. The date of the most recent revision is shown at the top of this page. Continued use of the website following any changes constitutes acceptance of the revised policy.