Last updated: 26 September 2026
Exallto EOOD operates the online store at exallto.com and is the controller of the personal data described here. For privacy questions or requests, contact sales@exallto.com, call +359 884 836 142, or write to Exallto EOOD, Lyulin 10, block 142, 1335 Sofia, Bulgaria.
Information we use and why
| Activity | Information | Purpose and legal basis |
|---|---|---|
| Visiting the store | IP address, browser and device information, request and security logs, and essential cookies | Deliver and protect the website. Our legitimate interests are reliable operation, fraud prevention and security. Essential cookies are needed to provide the service you request. |
| Creating and using an account | Name, email address, credentials and account activity | Provide the account you request and its features; performance of our contract with you. |
| Placing and fulfilling an order | Contact and delivery details, products ordered, order and shipment status, and payment method and status | Accept and fulfil the order, arrange payment and delivery, and provide customer support; performance of our contract with you. Payment-card details are handled by the payment provider rather than stored by us as full card numbers. |
| Invoicing and statutory records | Billing details and relevant order information needed for an invoice or to document a sale | Meet accounting and tax obligations; legal obligation. |
| Enquiries, returns, warranties and disputes | Your messages, relevant order details and supporting information | Respond to your request and perform our contractual and consumer-law obligations. Where necessary after the service has ended, we may retain limited evidence to establish, exercise or defend legal claims, based on our legitimate interests. |
| Optional advertising measurement | Online identifiers, page and interaction information and, where you have enabled measurement, purchase-event information | Measure sales, assess and improve the effectiveness of our advertising; your consent. A purchase event may include a transaction reference, currency and order value, but not your name, delivery address or full payment-card details. |
| Optional personalised advertising (remarketing) | Online identifiers and information about your activity on the store | Help show you more relevant advertising; your separate consent. Remarketing requires advertising measurement. We do not use your order information to send marketing emails merely because you bought something. |
Fields marked as required in a form are needed for the requested service or legal document. You may leave optional fields empty. Without the information needed for an order, we may be unable to accept or fulfil it.
Cookies and your choices
Essential cookies support the basket, login, checkout, security and retention of your privacy choice. They do not require consent when strictly necessary for the service you request. Google advertising measurement and personalised advertising are optional and remain off unless you allow them. The short banner lets you accept both or decline both. The separate Cookie settings page, linked from the banner and site footer, lets you allow advertising measurement without remarketing. Remarketing requires measurement. You may change your choices there at any time. Withdrawing consent stops future optional measurement or personalisation; it does not invalidate processing carried out while your consent was in force. Your order can still be placed when you decline optional cookies.
| Cookie or category | Purpose | Maximum lifetime |
|---|---|---|
PrestaShop-* |
Basket, account and checkout continuity | 20 days |
PHPSESSID |
Essential server session | Until the browser session ends |
exallto_cookie_consent |
Remember your privacy choices | 1 year |
_ga, _ga_* |
Google advertising measurement, only with measurement consent | 2 years |
_gcl_* and similar Google advertising cookies, where used |
Advertising attribution, only with measurement consent | 90 days |
The site may use payment-provider security technology during checkout. Its strictly necessary cookies are governed by the provider's own notice. You can also manage cookies in your browser, although blocking essential cookies may prevent the basket, login or checkout from working.
If you are inactive on the site for 30 minutes, your next visit starts a new server-side PHP session. This does not by itself sign you out of your shop account or clear the separate basket/account cookie.
We keep an order in the shop to fulfil our contract even if you decline optional measurement. When measurement is enabled, a limited internal order-event record may be created to prevent duplicate purchase reporting; it is not itself a transmission to Google.
Recipients and transfers
We share only information needed for the relevant service with payment providers (including Stripe where that payment method is used), the delivery provider selected for your order (such as Speedy or Econt), and hosting and IT service providers. We provide invoice and statutory accounting information to our accounting service provider. Public authorities receive information when required by law. Google receives optional advertising measurement or remarketing information only for the purposes you have enabled. Some recipients act as independent controllers and provide their own privacy notices.
Some providers, including Google and Stripe, may process information outside the European Economic Area. Where a transfer takes place, we rely on an applicable European Commission adequacy decision or appropriate safeguards such as the European Commission's standard contractual clauses, as relevant to that provider and transfer. You can request details and a copy of the relevant safeguards from us. Further information is available in the Google Privacy Policy and Stripe Privacy Centre.
How long we keep information
| Information | Retention period |
|---|---|
| Orders and related invoices, accounting or tax documents | We keep the necessary information for up to 10 years for accounting and tax purposes, starting on 1 January of the year following the accounting period to which it relates. |
| Account profile | While your account is open. If it is closed, we keep only information still needed for an outstanding order, a legal obligation, a warranty, a dispute or a legal claim, under the relevant period or criteria below. |
| Customer enquiries | While needed to handle your enquiry and any related order, warranty or dispute; afterwards only where needed to establish, exercise or defend a legal claim. |
| Technical and security logs | Routine shop-application logs are cleared after 30 days. Reverse-proxy and security/incident records are retained while needed for operation, investigation or a legal claim; their retention is not covered by the shop-application cleanup. |
| Privacy-choice record | While needed to apply and demonstrate your current choice and respond to a related compliance question or claim. The choice cookie itself lasts up to 1 year. |
| Google Analytics event and user data under our current settings | Event data: 14 months. User data: 14 months; the user-data period resets when the user is active again. Aggregated reports that no longer identify a person may be retained longer. |
These periods and criteria refer to information needed for the stated purpose, not every field in an order or account. If you believe information is no longer needed, you may request erasure. We assess such requests against any continuing legal obligation or active claim.
Your rights
Under the conditions of the GDPR, you may request access, correction, erasure, restriction or portability of your personal data. You may object to processing based on our legitimate interests. You may withdraw consent for optional advertising measurement or remarketing at any time through Cookie settings. Contact us at sales@exallto.com to exercise a right. We may need to verify your identity before disclosing or changing personal data. If you are dissatisfied, you may complain to the Bulgarian Commission for Personal Data Protection or another competent EU supervisory authority.
We do not use your information for decisions made solely by automated means that have legal or similarly significant effects on you.
Changes to this policy
We will publish the current policy on this page and update the date above when it changes materially.