This Privacy Policy explains which personal data are collected when you use the website https://quickair.org/, place an order, submit an enquiry, publish a review, subscribe to the newsletter or contact QuickAir; for which purposes and on which legal bases they are processed; to whom they may be disclosed; how long they are stored; and what rights the user has.
This Policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), the Personal Data Protection Act of the Republic of Bulgaria and other applicable legislation.
1. Data controller
1.1. The controller of the personal data collected through the QuickAir website is:
1.2. In this Policy, УИН ТУ УИН ГЛОБАЛ ЕООД is referred to as the “Controller”, “Seller”, “QuickAir”, “we” or “us”, and the person whose data are processed is referred to as the “User”, “Buyer”, “Client” or “data subject”.
1.3. A separate data protection officer has not been appointed, unless such appointment is mandatory under the law. All requests concerning the processing of personal data may be sent to ventshop.ec@gmail.com.
2. Which personal data we process
2.1. Depending on how you interact with the website, we may process the following categories of data:
Enquiry and consultation data:
- name;
- telephone number;
- email address;
- type of equipment: fireplace, boiler, barbecue or other;
- the selected or desired smoke extractor model;
- preferred means of contact: Viber, WhatsApp or Telegram;
- comments and other information that the User voluntarily provides in the form.
Order and delivery data:
- first and last name or company name;
- telephone number and email address;
- country, city, street, house number, apartment, postcode and other information required for delivery;
- name, quantity and price of the goods ordered;
- chosen payment method;
- order number, date, status and fulfilment history;
- data on dispatch, receipt, return, warranty service or complaints;
- payment details to the extent received from the bank, payment institution or delivery service. The Controller should not receive or store full bank card details where the payment is processed by a separate payment provider.
Review data:
- name or pseudonym;
- product rating;
- text of the review;
- date of submission;
- technical data required to prevent spam and abuse.
Subscription data:
- email address;
- date and source of subscription;
- records of the giving or withdrawal of consent, where these are kept by the system.
Correspondence and enquiry data:
- contact details;
- the content of emails and messages;
- photographs, videos, documents and other materials sent to us;
- information required to reply, select a model, fulfil an order or handle a complaint.
Technical data:
- IP address;
- date and time of access;
- addresses of the pages requested;
- browser type and version;
- device type and operating system;
- language and regional settings;
- referral source;
- server logs, error data and records of attempted abuse;
- cookie, localStorage or sessionStorage identifiers, where used.
2.2. We do not ask Users to send special categories of personal data, in particular data concerning health, biometric or genetic data, political opinions or religious beliefs. Such information should not be entered in free-text fields of forms or in correspondence unless it is objectively necessary and has been agreed with the Controller in advance.
2.3. If the User provides another person’s data, for example those of the recipient of the goods, the User must have a lawful basis for doing so and must inform that person that their data have been passed to QuickAir.
3. Sources of the data
3.1. We receive most data directly from the User when they:
- complete a model selection or order form;
- add a product to the cart;
- subscribe to the newsletter;
- leave a review;
- write an email or a message in a messenger;
- contact us about payment, delivery, returns, warranty or complaints.
3.2. Certain data may come from banks, payment institutions, postal and courier services, hosting providers and technical services in connection with the fulfilment of an order, payment, delivery, website security or the handling of a request.
3.3. Technical data may be collected automatically during a visit to the website by the server, the browser and the necessary means of storing information on the device.
4. Purposes of processing personal data
4.1. We process personal data for the following purposes:
- providing advice and help in selecting a smoke extractor model;
- accepting, checking, confirming and fulfilling orders;
- contacting the Client by telephone, email or the chosen messenger;
- accepting and recording payments;
- arranging packaging, international or domestic delivery and tracking of consignments;
- preparing invoices, accounting, tax and other mandatory documents;
- handling returns, warranty requests and complaints;
- publishing and moderating reviews;
- sending news, information about new models and offers to persons who have agreed to receive the newsletter;
- maintaining the cart, language settings and other website functions;
- ensuring security and preventing spam, fraud, unauthorised access and other abuse;
- diagnosing errors, maintaining and improving the website;
- producing aggregated or anonymous statistics;
- complying with legal requirements and requests from competent authorities;
- establishing, exercising or defending legal claims.
5. Legal bases for processing
5.1. The Controller processes data on the following legal bases:
Performance of a contract or steps taken prior to entering into a contract — Article 6(1)(b) GDPR. This basis applies to consultations at the User’s request, model selection, order placement, payment, delivery, returns and warranty service.
Compliance with a legal obligation — Article 6(1)(c) GDPR. This basis applies in particular to accounting and tax records, the storage of mandatory documents, compliance with consumer protection requirements and the provision of information to competent authorities in the cases laid down by law.
Legitimate interests of the Controller or of a third party — Article 6(1)(f) GDPR. Legitimate interests may include protecting the website and information systems, preventing fraud and spam, keeping evidence of communications and transactions, defending rights in disputes, improving service and organising internal activities. Before such processing we assess whether the rights and interests of the data subject override those interests.
Consent — Article 6(1)(a) GDPR. Consent may be the basis for the email newsletter, publishing a review together with the User’s name, using optional cookies or other operations for which the law requires consent. Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal.
6. Newsletter and marketing messages
6.1. If the User voluntarily subscribes to the newsletter, we may send information about new models, products, useful materials and QuickAir offers to the email address provided.
6.2. The User may unsubscribe at any time using the link in the message, where available, or by sending a request to ventshop.ec@gmail.com.
6.3. Withdrawal of consent to marketing messages does not affect service messages necessary for processing and fulfilling an order.
7. Reviews and public information
7.1. The rating and text of a review may be published on the QuickAir website. The User’s name or pseudonym is published together with the review only where the User has given a separate, voluntary and properly recorded expression of will for such publication. The absence of consent to publish a name or pseudonym does not prevent a review from being submitted, unless the functionality of the website provides otherwise.
7.2. A review should not contain a telephone number, email or postal address, payment details or other information that the User does not wish to make public.
7.3. The Controller may check, shorten or decline to publish reviews that contain personal data of third parties, insults, spam, unlawful material or that do not relate to QuickAir products. The content of a review is not changed in a way that distorts its essential meaning.
7.4. The author may contact ventshop.ec@gmail.com with a request to delete or correct a published review. Such a request is considered in the light of applicable law and the right to freedom of expression.
8. Cookies, localStorage and similar technologies
8.1. The website may use cookies and browser storage necessary for the operation of its core functions.
8.2. As at the date of the last update of this Policy, the website uses or may use, in particular:
- the pll_language cookie — to remember the selected language of the website; typical lifetime up to 1 year;
- the quickair_cart_v2 entry in localStorage — to keep the contents of the cart on the User’s device until the cart, the site data or the browser storage is cleared;
- the quickair_consent cookie — to remember your choice regarding optional cookies; validity up to 1 year;
- the embedded YouTube player (youtube-nocookie.com) — loaded only after your consent to multimedia; once the video starts, Google may set its own cookies in accordance with its privacy policy;
- WordPress sessionStorage for the technical emoji support check — kept for the duration of the browser session;
- server logs and technical identifiers — for the operation of forms, security, spam prevention and error diagnostics.
8.3. Necessary cookies and local storage are used to provide the functions expressly requested by the User and cannot be fully disabled without losing part of the website’s functionality.
8.4. If analytics, advertising or other optional cookies are added to the website, they must be activated only after appropriate consent has been obtained, where such consent is required by law. Information about the provider, the purpose and the lifetime must be available in the cookie settings.
8.5. The User may delete cookies, localStorage and sessionStorage through the browser settings. After deletion, the selected language, the cart and other local settings may be reset.
9. Recipients of personal data
9.1. To the extent necessary for the stated purposes, data may be received by:
- employees and authorised representatives of the Controller;
- postal, courier, transport, customs brokerage and warehousing companies;
- banks, payment institutions and payment service providers;
- accounting firms, auditors, tax and legal advisers;
- providers of hosting, email, backup, technical support, anti-spam and cybersecurity services;
- Viber, WhatsApp or Telegram, where the User has chosen the relevant communication channel;
- state, tax, customs, law enforcement, judicial and regulatory authorities, where disclosure is provided for by law;
- other persons with the User’s consent or on another lawful basis.
9.2. Service providers receive only the data necessary to perform the relevant task and must process them on the basis of a contract, the law or their own appropriate legal basis.
9.3. If the User chooses to communicate via Viber, WhatsApp or Telegram, the operator of that service may process the telephone number, account identifier, technical data and message content in accordance with its own privacy policy. These operators may act as independent controllers.
9.4. We do not sell or transfer personal data to third parties for their independent marketing without an appropriate legal basis.
10. Transfers of data outside the European Economic Area
10.1. Certain providers of email, hosting, messenger, technical or payment services may process data outside the European Economic Area (EEA) or provide access to them from third countries.
10.2. Where the GDPR requires a specific basis for such a transfer, appropriate safeguards are used, in particular:
- an adequacy decision of the European Commission;
- the European Commission’s standard contractual clauses;
- the recipient’s participation in a recognised data transfer mechanism;
- another mechanism provided for by Articles 44–49 GDPR.
10.3. Information about the applicable safeguards may be requested at ventshop.ec@gmail.com. The provision of a copy may be limited in order to protect trade secrets, security and the rights of third parties.
11. Retention periods
11.1. We store data no longer than is necessary for the stated purposes, for compliance with legal obligations and for the protection of rights. If a dispute, claim, inspection or other proceedings exist or are reasonably expected, the relevant data may be stored until their final conclusion and for the period necessary to protect the Seller’s rights, where the law permits.
11.2. Indicative retention periods:
- data on orders, payments, invoices and accounting documents — for the period laid down by Bulgarian accounting and tax law, which for certain documents may be up to 10 years;
- delivery data — until delivery is completed and for the period necessary for complaints, record-keeping and the protection of the parties’ rights;
- warranty requests and complaints — while the request is being handled and thereafter within the warranty period and the applicable limitation period;
- enquiries, consultations and correspondence that did not result in an order — as a rule up to 3 years after the last substantive contact, unless a longer period is required for a dispute or by law;
- subscription data — until consent is withdrawn, the subscription is cancelled or the newsletter is discontinued, after which minimal information may be kept in a suppression list to prevent repeated sending;
- published reviews — for as long as the review remains relevant to the website or until a justified request for deletion, unless there is a lawful basis for keeping it longer;
- security and technical logs — for the period reasonably necessary for security, diagnostics and the investigation of incidents;
- cookies and browser storage — in accordance with the periods stated in section 8.
11.3. Once the retention period has expired, the data are deleted, destroyed or anonymised, unless further storage is required by law.
12. Rights of the User
12.1. Under the conditions laid down by the GDPR, the data subject has the right to:
- obtain confirmation as to whether their personal data are being processed, and access to them;
- request the rectification of inaccurate data or the completion of incomplete data;
- request the erasure of data;
- request the restriction of processing;
- receive the data they have provided in a structured, commonly used and machine-readable format and transmit them to another controller, where the right to data portability applies;
- object to processing based on legitimate interests;
- object at any time to direct marketing;
- withdraw consent, without affecting the lawfulness of prior processing;
- not be subject to a decision based solely on automated processing which produces legal or similarly significant effects, except in the cases provided for by law;
- lodge a complaint with the competent supervisory authority;
- apply to a court for the protection of their rights.
12.2. To exercise these rights, a request must be sent to ventshop.ec@gmail.com. The request should clearly state which right it concerns and provide enough information to locate the relevant data.
12.3. To prevent unauthorised access, the Controller may ask for additional information to confirm identity. We will not request more data than is objectively necessary for verification.
12.4. A reply is provided without undue delay and, as a rule, within one month of receipt of the request. Where the request is complex or where there are many requests, that period may be extended by a further two months, of which the person is informed within the first month together with the reasons.
12.5. Exercising these rights is normally free of charge. For manifestly unfounded or excessive requests, in particular repetitive ones, a reasonable fee may be charged or the request may be refused in accordance with the GDPR.
13. Automated decision-making
13.1. As at the date of the last update of this Policy, QuickAir does not take decisions concerning the User based solely on automated processing, including profiling, which produce legal or similarly significant effects.
13.2. The automated checking of whether fields are filled in correctly, of the format of a telephone number or email address, and spam protection do not constitute such a decision.
14. Security of personal data
14.1. The Controller applies appropriate technical and organisational measures to protect data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
14.2. The website uses a secure HTTPS connection. Access to data is limited according to operational need, and service providers are engaged with regard to confidentiality and security requirements.
14.3. No method of transmitting or storing information can guarantee absolute security. In the event of a personal data breach, the Controller acts in accordance with Articles 33 and 34 GDPR, in particular by notifying the supervisory authority and the data subjects where required by law.
15. Children’s data
15.1. The QuickAir website and products are not specifically intended for children. We do not knowingly collect children’s personal data through the website for marketing purposes.
15.2. If a legal representative believes that a child has provided us with personal data without an appropriate legal basis, they may contact ventshop.ec@gmail.com so that we can check the matter and take the necessary measures.
16. Complaint to a supervisory authority
16.1. If the User believes that their personal data are being processed in breach of the law, they have the right to lodge a complaint with the supervisory authority of their country of habitual residence, place of work or of the alleged infringement.
16.2. The lead supervisory authority for the Controller in the Republic of Bulgaria is the Commission for Personal Data Protection of the Republic of Bulgaria (Комисия за защита на личните данни, CPDP):
16.3. Before lodging a complaint, the User may contact QuickAir at ventshop.ec@gmail.com so that we have the opportunity to consider the matter and remedy any possible infringement. This does not limit the right to apply directly to the supervisory authority.
17. Amendments to the Privacy Policy
17.1. The Controller may update this Policy from time to time due to changes in legislation, website functions, the range of service providers or the ways in which data are processed.
17.2. The current version is published at https://quickair.org/ with the date of the update. If changes significantly affect Users’ rights or the nature of the processing, we will take reasonable steps to provide additional notice where required by law.
17.3. If consent is required for a new purpose of processing, it will be requested separately. Silence or continued use of the website is not regarded as consent where the law requires an active expression of will.
Last updated: 4 August 2026