Company
Privacy policy
What we collect, why, and how to get it back or deleted.
1. Who is responsible
The controller of your personal data is ПОНСМЕД ДПК (PONSMED DPK), ul. Sofroniy 18A, 8000 Burgas, Bulgaria, which runs the PONS brand and ponsmix.com ("we"). Company number (EIK): 208346611. For anything about your data, write to support@ponsmix.com or call +359 899 144 854. We have not appointed a data protection officer because the law does not require one for a business of our size.
2. What we collect and why
| When | What | Why and legal basis (GDPR) |
|---|---|---|
| You place an order or subscribe | Name, email, phone, delivery and billing address, order details, payment status | To deliver the order and manage the subscription (contract, Art. 6(1)(b)); to keep invoices and accounting records (legal obligation, Art. 6(1)(c)) |
| You join a list (First 100, Source, newsletter) | Email, the list you joined, the plan you picked | To email you about launches and formulas (consent, Art. 6(1)(a)). We send a confirmation email first, and we see whether our emails are opened and clicked (see section 4). You can unsubscribe in any email. |
| You write to us or to our scientists | Name, email, your message | To answer you (legitimate interest, Art. 6(1)(f)). Please don't send medical details. If you do, we use them only to answer you, based on your explicit consent (Art. 9(2)(a)), which you give with the optional tick box on the form, and we delete them once we have answered. |
| You send us the PONS analysis questionnaire | First name, email, your answers, including health details such as sleep, stress, diet, medication and diagnosed conditions | So our team can read your answers and email you a personal analysis, ingredients to look for and, if one fits, a PONS product with a discount code (your explicit consent, Art. 9(2)(a) and Art. 6(1)(a), given with the required tick box before you send). It is not medical advice. Your answers reach us by email at support@ponsmix.com and are read only by our team. We never use them for advertising, never tag or segment you by them, and you can withdraw consent at any time by writing to support@ponsmix.com. Marketing emails only if you tick the separate optional box. To prepare the analysis we use an AI assistant (Anthropic, as our processor); a person reviews every email. Our business email provider stores the messages. Both may process data in the United States under the EU–US Data Privacy Framework or Standard Contractual Clauses. We use your answers to score them and suggest ingredients and, if one fits, a PONS product; this is profiling, but no decision with legal or similar effect is made about you. We delete your answers from our mailbox and tools 30 days after our last email. |
| We keep proof of your consent | Date, time, the form you used, your confirmation click | To show that you agreed (legal obligation, Art. 6(1)(c) with Art. 7(1)) |
| You visit the site | Device and browser data, IP address, pages viewed, cart | To run the shop and keep it secure (legitimate interest). Analytics and advertising only with your consent (see section 7). |
| You accept analytics cookies | Pages viewed, device, approximate location, cookie IDs | To measure how the site is used, with Google Analytics 4 when we use it (consent, Art. 6(1)(a); storage on your device, Art. 5(3) ePrivacy Directive) |
| You accept advertising cookies | Cookie IDs, pages viewed, add-to-cart, sign-up and purchase events; for sign-ups and orders also your email and phone in hashed (encrypted one-way) form | To measure and target our ads on Facebook and Instagram (Meta) and Google, when we run them (consent, Art. 6(1)(a)). You can withdraw consent in Cookie settings at any time. |
| Your payment is checked for fraud | Order and payment data | To prevent fraud (legitimate interest). Card numbers are handled by the payment provider; we never see or store them. |
To show you the site in Bulgarian when you are in Bulgaria, the site checks your device's time zone or the country Shopify detects from your IP address. Nothing is stored except your language choice in your own browser. We do not make decisions about you by automated means alone.
3. Who receives your data
Only the companies we need to run the shop, each bound, or to be bound before we share any data, by a data processing agreement, or acting under its own legal duties:
- Shopify (Shopify International Limited, Ireland): hosting, checkout, customer accounts and emails.
- Payment providers shown at checkout.
- Nutrend Bulgaria EOOD, Slivnitsa: manufacturing, packing and shipping of orders, as our processor.
- Couriers Speedy and Econt, for delivery.
- Google Ireland Ltd: Google Analytics 4 and Google Ads, as our processor, only if you accept those cookies and when we use these services.
- Meta Platforms Ireland Ltd: when we use the Facebook/Instagram pixel and Conversions API, we and Meta are joint controllers for collecting and sending the data (Art. 26); Meta's part is set out in its Controller Addendum. Meta then uses the data under its own policy. This happens only if you accept advertising cookies.
- Klaviyo Inc., USA: email marketing, only if we use it instead of Shopify Email.
- The subscription app we use in the shop, for subscription management, once subscriptions open.
- Our email provider, for our mailbox.
- Our accountant, and public authorities when the law requires it.
We do not sell your personal data.
4. Emails we send
Our emails may contain a small tracking pixel and tracked links so we can see whether an email was opened and which links were clicked. We use this only to improve our emails. Unsubscribing stops it.
5. Transfers outside the EU
Shopify, Meta, Google and Klaviyo (where we use them) may process data in the United States or Canada. Canada has an EU adequacy decision. For the United States we rely on the EU–US Data Privacy Framework, where the company is certified, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards.
6. How long we keep it
- Orders and invoices: 10 years, as Bulgarian accounting law requires.
- Customer account: until you delete it or ask us to.
- Do-not-email list: after you unsubscribe we keep only your address on it, so we don't write to you again.
- Sign-ups never confirmed: deleted after 30 days.
- Email lists: until you unsubscribe, or after 24 months without opening any email.
- Proof of consent: as long as you are on the list, plus 5 years.
- Messages to us: up to 2 years after our last reply. Health details you send us: deleted once we have answered.
- Analysis questionnaire answers: deleted 30 days after we send you our last email about them.
- Analytics data in Google Analytics: 14 months.
- Advertising cookies: as set out in Cookie settings, at most 13 months.
7. Cookies and similar technologies
Necessary cookies and browser storage keep the cart, checkout, login and security working. We also store your language (pons-lang), the language picked for your location (pons-geo), and which form you just sent (pons-posted, pons-plan) until you close the tab. These don't need consent. Fonts and scripts are served from our own shop, not from Google or other third parties.
Analytics and advertising cookies are used only if you accept them in the cookie banner. You can change your choice at any time with the Cookie settings link at the bottom of every page.
8. Your rights
You can ask us to show you your data, correct it, delete it, restrict or object to its use, or send it to you in a portable format. Where we rely on your consent, you can withdraw it at any time. Write to support@ponsmix.com; we answer within one month.
You can object at any time to the use of your data for direct marketing, and we will stop. You don't have to give us your data, but we need it to deliver an order, and without your email we can't add you to a list. We may ask you to confirm your identity before we answer.
You can also complain to the Commission for Personal Data Protection (КЗЛД), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, kzld@cpdp.bg, www.cpdp.bg, or to the data protection authority where you live.
9. Security
The site runs over an encrypted connection (HTTPS). Payments are handled by certified payment providers. Only the people who need your data to do their job can see it.
10. Reviews and social media
If you leave a review, we show it with your first name. If you write to us on social media, the platform also processes your data under its own policy.
11. Children
Our products and this site are not meant for anyone under 18, and we do not knowingly collect their data.
12. Changes
We may update this policy. If a change matters to you, we will tell you by email.