Effective 29 October 2026. This notice concerns the MV Hairshopy B2B service operated by TOM.KO LTD (ТОМ.КО ЕООД), VAT BG207528454, 54B Ivan Susanin St., entrance A, Sofia, Bulgaria. Contact: sales@mvhairshopy.com, +359 89 434 5433. The retail operation has separate terms and privacy information.

Information and purposes

We process names and business contact details, company and VAT information, billing and delivery addresses, business applications, orders, payment confirmations and correspondence. Website use can generate device, session, security and usage information.

Business representatives' information is used to verify and manage business relationships, communicate and protect the service, on the basis of legitimate interests balanced against their rights. Where an individual is a contracting party, steps before a contract and its performance provide the relevant basis. Accounting and tax records are processed to meet legal obligations. Consent is the basis for optional technologies where required. Information necessary to assess, invoice or fulfil an order is needed for that service; optional consent is separate.

Recipients and delivery

Shopify provides the commerce platform and associated hosting, account and order services. The B2B service operates in a shared Shopify store, with access for authorised personnel and connected service providers according to their roles.

We issue and store proformas and invoices through Micro.bg, the cloud service of Microinvest. TOM.KO's operator has the user access; no external accountant has been granted a user account. The cloud provider processes information entered in that service as needed to provide it.

Goods are delivered by suppliers to TOM.KO first. We then send the shipment to the customer through DPD or DHL. The selected courier receives the recipient name, delivery address and contact details needed for delivery. Our goods supplier does not need the end customer's delivery address for this flow. Relevant information may also be disclosed where required by law or necessary to establish, exercise or defend legal claims.

International processing

Service providers, including Shopify, may process information outside the EEA. Shopify describes its applicable transfer mechanisms and safeguards in its Data Processing Addendum. We do not represent that all processing remains within the EU. Contact us for information about safeguards relevant to your data.

Retention

• Unapproved or incomplete applications: 6 months after last contact, unless a dispute or legal obligation requires longer retention.
• Accounts: for the active business relationship, with a necessity review after 24 months of inactivity; this is not automatic unconditional deletion.
• Enquiries without an order: 12 months after closure, subject to legal or dispute requirements.
• Orders and claims: through completion and thereafter as necessary for statutory duties or legal claims.
• Invoices and accounting information: the applicable statutory period for the category. Accounting registers and financial statements have a 10-year period from 1 January of the following reporting period; tax rules may require a different or longer period for particular documents.

These are our retention criteria. We review whether data remains necessary and delete or anonymise it when the purpose and applicable retention grounds end. Keeping an invoice does not require retaining all unrelated account information. Legal holds take precedence where necessary.

Your rights

Subject to applicable conditions, you may request access, correction, deletion, restriction or portability, and object to processing based on legitimate interests. You may withdraw consent without affecting processing lawfully carried out beforehand. Use the Cookie settings control for website preferences, or contact sales@mvhairshopy.com for other requests. We may need information proportionate to verifying your identity. You may complain to the Bulgarian Commission for Personal Data Protection or another competent supervisory authority.

Website technologies

See the B2B cookie notice for website technologies, providers and preference controls. This notice may be updated to reflect changes in our services and processing.