PRIVACY POLICY

Effective Date: December 11, 2025
Last Updated: December 11, 2025

INTRODUCTION

Welcome to the Privacy Policy of trudive.eu

This website, together with all its sub-domains and sub-pages (collectively "the Website" or "the Site"), constitutes the official online presence and e-commerce platform for the TruDive brand wetsuits and diving equipment.

www.trudive.eu respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit our Site, make a purchase, subscribe to our newsletter, or interact with us in any way.

This policy complies with the General Data Protection Regulation (GDPR - Regulation (EU) 2016/679) and the Bulgarian Personal Data Protection Act.

Please read this Privacy Policy carefully. You should be fully aware of how we handle your personal data and what rights you have regarding the information we collect.

1. WHO WE ARE – DATA CONTROLLER

Personal Data Controller:

Company Name: TruDive Europe OOD (TruDive Europe Ltd)
VAT Number: BG208571825
Registered Address: Tsar Samuil 7, Pleven 5800, Bulgaria
Data Protection Officer (DPO) Email: [email protected]

The Data Protection Officer is available to respond to all queries regarding the processing and protection of your personal data. You can contact the DPO at: [email protected]

Data Subjects: This policy applies to individuals (consumers or business representatives) who visit the Website, place orders, subscribe to newsletters, or interact with trudive.eu in any capacity ("you" or "the Customer").

2. SUPERVISORY AUTHORITY

You have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP) of the Republic of Bulgaria, which is the national supervisory authority for data protection matters.

CPDP Contact:

Website: https://www.cpdp.bg
Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Email: [email protected]

We encourage you to contact us first at [email protected] so that we can address your concerns directly.

3. WHAT PERSONAL DATA WE COLLECT

Personal data refers to any information that identifies or can identify a natural person. We may collect, use, store, and share various categories of personal data, including the following:

3.1. Data Collected for Order Processing and Delivery (Contractual Basis)

Identity and Contact Data:

First name and last name
Email address
Phone number
Delivery address (street, city, postal code, country)
IP address

Financial Data:

Payment method selected (card payment via DSK Bank terminal, including Apple Pay and Google Pay, or bank transfer)
Transaction reference numbers (we do NOT store full credit card details)

Order Data:

Products ordered (wetsuit model, size, quantity)
Order history
Order status and tracking information

3.2. Accounting and Invoicing Data (Legal Obligation)

When legally required or requested by you:

Full name
Company name (for business customers)
VAT identification number (for business customers)
Billing address
Invoice details as required by the Bulgarian Value Added Tax Act

3.3. Customer Support Data (Legitimate Interest)

To provide administrative and technical support:

Contact details (email, phone)
Order details and purchase history
Support ticket or email correspondence
Chat conversations
Feedback and reviews

When you explicitly consent to receive marketing communications:

Email address
Name
Marketing preferences
Email engagement data (opens, clicks)

3.5. Website Usage and Technical Data (Legitimate Interest)

For website functionality, security, and improvement:

IP address
Browser type and version
Device type and operating system
Pages visited and time spent on pages
Referral source
Geographic location (country/city level)
Cookies and similar tracking technologies (see Section 11)

If you choose to create an account on trudive.eu:

Username and password (encrypted)
Email address and phone number
Saved delivery addresses
Order history
Wishlist items
Marketing preferences

Note: Creating an account is entirely optional. You can place orders as a guest without registering.

When you participate in contests, surveys, or promotions:

Name and email address
Phone number (when needed for prize delivery)
Address (when needed for prize delivery)
Any additional information specifically required for that campaign

3.8. Data We Do NOT Collect

We do not collect special categories of personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, sexual orientation, or criminal records.
We do not verify age. While our products are suitable for all ages, parents/guardians are responsible for purchases made by minors.
We do not store full credit/debit card details on our servers. Payments are processed securely by third-party payment providers.

4. HOW WE COLLECT YOUR PERSONAL DATA

We collect personal data through the following methods:

4.1. Direct Interactions

You provide data directly when you:

Place an order on www.trudive.eu
Create a user account
Subscribe to our newsletter
Contact us via email, phone, or contact form
Participate in contests, surveys, or promotions
Leave product reviews or feedback
Request customer support

4.2. Automated Technologies

When you visit our Website, we automatically collect:

Technical data via cookies, server logs, and similar technologies
Usage data through analytics tools (Google Analytics)

See Section 11 for the detailed Cookie Policy.

4.3. Third-Party Sources

We may receive data from:

Payment providers (DSK Bank, banks) confirming successful transactions
Courier services are updating the delivery status
Social media platforms (Facebook/Instagram), when you interact with our ads or pages
Analytics providers (Google Analytics) provide aggregated usage statistics

5. HOW AND WHY WE USE YOUR PERSONAL DATA

We process your personal data for specific purposes based on lawful grounds under GDPR:

Purpose	Data Types Used	Legal Basis
Processing and fulfilling orders – Creating, confirming, and delivering your wetsuit purchases	Identity, Contact, Order, Financial Data	Performance of contract – necessary to fulfill our obligations to you
Payment processing and invoicing – Processing payments, issuing invoices, handling refunds	Financial, Accounting Data	Performance of contract & Legal obligation (tax/accounting laws)
Delivery coordination – Arranging shipment with courier services	Identity, Contact, Delivery Address	Performance of contract
Customer support – Responding to inquiries, resolving issues, processing returns/exchanges	Identity, Contact, Order, Support Data	Legitimate interest – providing quality customer service
Account management (if you register) – Maintaining your account, order history, and preferences	Account Data	Consent – account creation is optional
Newsletter and marketing communications – Sending promotional emails, new product announcements, special offers	Email, Marketing Data	Consent – you can opt out anytime
Website functionality and security – Ensuring the Site works properly, preventing fraud, protecting against cyber threats	Technical Data, IP Address	Legitimate interest – maintaining a secure and functional website
Analytics and improvement – Understanding how customers use the Site to improve user experience	Technical, Usage Data (anonymized)	Legitimate interest – improving our services
Legal compliance – Fulfilling accounting, tax, and other legal obligations	Accounting, Transaction Data	Legal obligation
Marketing performance tracking – Measuring effectiveness of Facebook/Instagram advertising campaigns	Technical Data, Cookie Data	Consent (via cookie consent) & Legitimate interest
Contests and promotions – Managing participation and prize delivery	Contest Data	Consent – voluntary participation

What is "Legitimate Interest"?

Legitimate interest refers to our business need to operate effectively and provide you with a high-quality and secure experience. We always assess these interests against your rights and freedoms. We do not use your data in ways where your interests outweigh ours, unless you have given consent or the law requires or allows us to do so.

What is "Performance of Contract"?

When you place an order, we enter into a contract with you. Processing certain personal data (name, address, payment info) is necessary to fulfill that contract. Without this data, we cannot complete your purchase or deliver your wetsuit.

We may share your personal data with the following categories of third parties, strictly for the purposes outlined above:

6.1. Essential Service Providers

Courier and Postal Services:

DPD
DHL
GLS

We share your name, delivery address, and phone number to enable delivery of your order.

Payment Processors:

DSK Bank (card payments, including Apple Pay and Google Pay)
Banks (for bank transfers)

We share necessary payment data to process transactions and refunds.

6.2. Marketing and Communications

Email Service Providers:

Internal system: OpenCart’s built-in mail functionality with our server’s mail service
Klaviyo

We share email addresses and marketing preferences solely to deliver newsletters and promotional campaigns, and only when you have given your consent.

Social Media Platforms:

Facebook / Instagram (Meta Pixels)

We share limited data (hashed email, IP address) for advertising targeting and measuring campaign effectiveness (based on cookie consent).

6.3. Analytics and Website Infrastructure

Website Analytics:

Google Analytics

We share anonymized/pseudonymized usage data to understand website traffic and user behavior.

Hosting Provider:

Contabo

Our website is hosted by Contabo. They may technically access data stored on our servers, but they are contractually obligated to protect it.

6.4. Professional Advisors and Legal Requirements

Consultants and Advisors:

Accountants, lawyers, auditors (as needed for compliance and business operations)

Government Authorities:

Tax authorities, regulatory bodies, law enforcement (when legally required)

6.5. Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred to the new owner. You will be notified of any such change.

7. DATA PROTECTION MEASURES

All third parties are required to:

Respect the security of your personal data
Process it only according to our instructions
Implement appropriate technical and organizational security measures
Comply with GDPR and Bulgarian data protection laws

We have contracts (Data Processing Agreements) in place with all service providers who process personal data on our behalf.

We NEVER sell your personal data to third parties.

8. INTERNATIONAL DATA TRANSFERS

Your personal data is primarily processed within the European Union (EU) and European Economic Area (EEA).

Some of our service providers may be located outside the EEA (e.g., some servers, analytics tools). When we transfer data outside the EEA, we ensure appropriate safeguards are in place:

Adequacy decisions – Transfers to countries deemed by the European Commission to provide adequate data protection
Standard Contractual Clauses (SCCs) – EU-approved contracts ensuring data protection
Privacy Shield (for US providers, where applicable) – or successor frameworks ensuring equivalent protection

Shipping destinations: We ship to EU countries and select neighboring countries (Switzerland, Andorra, Luxembourg, Monaco). Personal data related to delivery is shared with couriers operating in these regions.

9. HOW LONG WE KEEP YOUR PERSONAL DATA

We retain your personal data only as long as necessary for the purposes collected and to comply with legal obligations:

Data Category	Retention Period
Order and contract data	Duration of contract + limitation periods for legal claims under Bulgarian law (generally 5 years)
Accounting and tax records	As required by Bulgarian law (typically 10 years from the end of the fiscal year)
Marketing consents and data	Until you withdraw consent (opt-out) or delete your account
User account data	Until you delete your account
Customer support records	[3 years] after last interaction
Website analytics (anonymized)	[26 months] (Google Analytics default)
Cookie data	As specified in the Cookie Policy (Section 11)

After retention periods expire, personal data is securely deleted or anonymized and cannot be restored.

Exception: Data may be retained longer if required for ongoing legal proceedings, investigations, or regulatory requirements – only until the matter is resolved.

You have the following rights regarding your personal data:

10.1. Right of Access

You can request a copy of the personal data we hold about you. When you have an account, you can view much of this data in your account dashboard.

10.2. Right to Rectification

You can request correction of inaccurate or incomplete personal data. You can update most information directly in your account settings.

10.3. Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data in the following cases:

The data is no longer necessary for the purposes collected
You withdraw consent (where processing is based on consent)
You object to processing based on legitimate interest (and no overriding grounds exist)
The data has been unlawfully processed
Legal obligation requires deletion

Note: This right is not absolute. We may need to retain certain data for legal obligations (e.g., accounting records) or to establish/defend legal claims.

10.4. Right to Restriction of Processing

You can request that we limit processing of your data when:

You contest the accuracy of the data (while we verify it)
Processing is unlawful, but you prefer restriction over deletion
We no longer need the data, but you need it for legal claims
You have objected to processing based on legitimate interest (pending verification)

10.5. Right to Data Portability

You can request to receive your personal data in a structured, commonly used, machine-readable format (e.g., CSV, JSON) and transmit it to another controller. This applies when:

Processing is based on consent or contract
Processing is carried out by automated means

10.6. Right to Object

You can object to processing based on legitimate interest at any time. We will stop processing unless we demonstrate compelling legitimate grounds that override your interests, or for legal claims.

Direct Marketing: You have an absolute right to object to direct marketing at any time, including profiling for marketing purposes.

Where processing is based on consent, you can withdraw it at any time:

Newsletter/marketing emails: Click "unsubscribe" in any email or adjust preferences in your account
Cookies: Adjust settings via cookie banner or browser settings
Account: Delete your account through account settings

Withdrawal does not affect the lawfulness of processing before withdrawal.

10.8. Right to Lodge a Complaint

You can file a complaint with the Commission for Personal Data Protection (CPDP) (see Section 2) or a supervisory authority in your EU country of residence.

11. HOW TO EXERCISE YOUR RIGHTS

To exercise any of the above rights:

Via Email: Send a request to [email protected] with:
- Your full name and email address (used for orders/account)
- Description of your request
- Proof of identity (to prevent unauthorized access)
Via Account Settings: If you have an account, you can directly:
- Update your information
- Download your data
- Delete your account
- Manage marketing preferences
Response Time: We will respond within 1 month of receiving your request. In complex cases or high volumes, this may be extended by up to 2 months – we will inform you if this occurs.
Fees: Exercising your rights is free of charge, unless the request is manifestly unfounded, excessive, or repetitive – in which case we may charge a reasonable fee or refuse the request.

12. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies to enhance your experience on trudive.eu.

What are Cookies?

Cookies are small text files stored on your device when you visit a website. They help the site remember your preferences and understand how you use it.

Types of Cookies We Use

Cookie Type	Purpose	Examples
Strictly Necessary Cookies	Essential for the Website to function (e.g., shopping cart, security)	Session cookies, authentication cookies
Functional Cookies	Remember your preferences (e.g., language, region)	User preference cookies
Analytics Cookies	Help us understand how visitors use the site (anonymized data)	Google Analytics
Marketing Cookies	Track your activity to show relevant ads on social media	Facebook Pixel, Instagram Pixel, Klaviyo marketing cookies

Managing Cookies

Cookie Consent Banner: When you first visit trudive.eu, you'll see a cookie consent banner. You can:

Accept all cookies
Reject non-essential cookies
Customize your preferences

Browser Settings: You can also control cookies through your browser settings:

Block all cookies
Delete existing cookies
Set preferences for specific websites

Note: Blocking strictly necessary cookies may prevent parts of the Website from functioning properly (e.g., you won't be able to complete a purchase).

Third-Party Cookies

Third-party services set some cookies we use:

Google Analytics – Opt-out link
Facebook/Instagram – Manage ad preferences

For detailed information, see our full Cookie Policy here.

13. MARKETING COMMUNICATIONS

When you subscribe to our newsletter or opt in during checkout, you consent to receive:

New product launches
Special offers and discounts
Diving tips and wetsuit care advice
Company news and updates

How to Subscribe:

Checkbox during checkout
Newsletter signup form on the Website
Create an account and enable email preferences

How to Unsubscribe:

Click the "Unsubscribe" link at the bottom of any marketing email
Log in to your account and update email preferences
Email us at [email protected]

Transactional Emails: Even if you unsubscribe from marketing, you'll still receive essential emails about your orders (confirmations, shipping updates, etc.) – these are necessary to fulfill our contract with you.

14. DATA SECURITY

We implement appropriate technical and organizational measures to protect your personal data against:

Unauthorized access or disclosure
Accidental loss or destruction
Alteration or misuse

Security measures include:

Encryption: Data transmitted between your browser and our servers is encrypted using SSL/TLS
Access controls: Only authorized personnel can access personal data on a need-to-know basis
Secure hosting: Our Website is hosted on secure servers (Contabo) with regular backups
Password protection: Account passwords are encrypted and never stored in plain text
Regular security audits: We monitor for vulnerabilities and apply security updates

Data Breach Notification: In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and the CPDP within 72 hours as required by GDPR.

15. CHILDREN'S PRIVACY

We do not knowingly target or collect personal data from children. However, we do not verify the age of customers.

Parental Responsibility: If you are under 18, please make sure you have parental or guardian consent before making a purchase or providing any personal information.
Parental Rights: Parents/guardians can exercise rights on behalf of minors (access, deletion, etc.) by contacting us at [email protected] with proof of guardianship.

If we become aware that we have collected data from a child without parental consent, we will take steps to delete it promptly.

16. THIRD-PARTY WEBSITES AND LINKS

Our Website may contain links to third-party websites, social media pages, or services (e.g., the DSK Bank payment page, courier tracking).

We are not responsible for:

Privacy practices of third-party sites
Content or security of external links

When you leave www.trudive.eu, we encourage you to read the privacy policy of each website you visit. This Privacy Policy applies only to www.trudive.eu.

17. AUTOMATED DECISION-MAKING AND PROFILING

We do NOT use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Any personalization (e.g., product recommendations, targeted ads) is based on general trends and explicit consent, not automated profiling with legal consequences.

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect:

Changes in our business practices
Legal or regulatory requirements
New features or services

When we make changes:

The "Last Updated" date at the top will be revised
Significant changes will be notified via email (if you're subscribed) or a prominent notice on the Website
We encourage you to review this policy periodically

Your continued use of www.trudive.eu after changes constitutes acceptance of the updated Privacy Policy.

19. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

Data Protection Officer (DPO):

Email: [email protected]

General Inquiries:

Email: [email protected]
Address: TruDive Europe OOD(TruDive Europe Ltd), Pleven 5800, Bulgaria
Phone:

Commission for Personal Data Protection (CPDP):

Website: https://www.cpdp.bg
Email: [email protected]

20. GLOSSARY OF TERMS

Personal Data: Any information relating to an identified or identifiable natural person.

Data Controller: The entity TruDive Europe OOD (TruDive Europe Ltd) that determines the purposes and means of processing personal data.

Data Processor: A third party that processes personal data on behalf of the controller (e.g., courier services, payment providers).

Data Subject: The individual (you) to whom personal data relates.

GDPR: General Data Protection Regulation (EU) 2016/679 – the EU law governing data protection and privacy.

Consent: Freely given, specific, informed, and unambiguous indication of your wishes by a statement or clear affirmative action.

Legitimate Interest: A lawful basis for processing when necessary for the controller's or third party's legitimate interests, balanced against the data subject's rights.

Anonymization: Processing data so that it can no longer identify an individual, even with additional information.

Pseudonymization: Processing data so that it cannot be attributed to a specific individual without additional information kept separately.

Thank you for trusting TruDive with your personal data. We are committed to protecting your privacy and providing you with the best wetsuit shopping experience!

This Privacy Policy is governed by the laws of the Republic of Bulgaria and the GDPR.

Privacy policy