Privacy Policy

X-Time Trade EOOD · Last updated: 20 August 2026

1. Who we are

X-Time Trade EOOD (“we”, “us”, “our”) operates the online shop www.prodive-shop.com and is the controller of your personal data.

X-Time Trade EOOD
VAT / EIK: BG204894185
10 Ivan Hadjihristov str., 6000 Stara Zagora, Bulgaria

General enquiries: [email protected]
Data protection requests: [email protected]
Telephone: +359 897 607 090

We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR. Any question about this policy or about your data will be handled by us directly at the addresses above.

2. What personal data we collect

Identity and contact data – name, email address, postal address, telephone.
Order data – products ordered, order value, order history, delivery address, invoicing details, and any comments you add to an order.
Payment data – we do not store your full card number. Card details are entered directly into a secure form provided by our payment providers and are processed by them. We receive only the result of the payment and the last four digits of the card.
Account data – your email address, password (stored encrypted) and any addresses you save.
Communications – emails you send us, product reviews and survey answers.
Technical data – IP address, browser type and version, device type, approximate location, pages viewed and referring site, collected through cookies and analytics where you have consented.

3. Why we use your data and on what legal basis

We must have a legal basis for every purpose for which we use your data. Ours are set out below.

Purpose	Data used	Legal basis
Processing and delivering your order	identity, contact, order, payment	Performance of a contract (Art. 6(1)(b))
Customer service and handling returns	identity, contact, order, communications	Performance of a contract (Art. 6(1)(b))
Keeping accounting, tax and invoicing records	order, payment, invoicing	Legal obligation (Art. 6(1)(c))
Sending newsletters and marketing emails	identity, contact, order history	Consent (Art. 6(1)(a))
Reminding you about an order you did not complete, or about consumables you may be due to replace	contact, order history	Legitimate interests (Art. 6(1)(f)) – our interest in completing sales and in reminding existing customers about products they have bought
Inviting you to review a product you have bought	contact, order history	Legitimate interests (Art. 6(1)(f))
Preventing fraud and abuse of our checkout	technical, order	Legitimate interests (Art. 6(1)(f))
Website analytics	technical	Consent (Art. 6(1)(a))
Understanding what our customers need and improving our product range	order history, aggregated	Legitimate interests (Art. 6(1)(f))

Where we rely on legitimate interests, we have weighed our interest against your rights and freedoms and concluded that our processing does not override them. You may object to this processing at any time – see section 8.

4. Cookies and analytics

Cookies are small files stored on your device. We use two kinds:

Strictly necessary cookies keep your shopping basket, keep you signed in and protect the checkout. The shop cannot work without them, and they are used without consent, as the law permits.
Analytics cookies (Google Analytics 4) help us understand how the site is used and where visitors come from. These are used only if you accept them.

When you first visit, analytics and advertising storage are switched off by default. Nothing is stored for analytics until you press “Accept”. If you press “Decline”, the shop works exactly as before, and we simply do not measure your visit.

You can change your decision at any time using the “Cookies” button at the bottom left of every page, or by deleting cookies in your browser.

5. Who we share your data with

We never sell your data, and we never pass it to other companies for their own marketing. We share it only with service providers who act on our instructions, and only with what they need:

Payment providers, to take your payment: PayPal (Europe) S.à r.l. et Cie, S.C.A., and Braintree, a PayPal service.
Delivery companies, to deliver your parcel: A1 Post, Econt and Speedy, together with the partner postal services they use to deliver abroad.
Our web hosting provider, which stores the website and its database.
Our email service providers, which deliver our order emails and, if you have subscribed, our newsletters.
Google, for website analytics, where you have consented.
Cloudflare, which protects the site against attack and speeds it up.
Our accountant, for statutory bookkeeping.
Public authorities, where we are required by law to disclose.

6. Transfers outside the European Economic Area

Some of our providers are established outside the EEA, mainly in the United States. This means that your data is transferred to a third country. In particular, the website and its database are hosted on servers located in the United States, and our analytics and payment providers may process data there.

Where such a transfer takes place, it is covered by one or both of the safeguards recognised under Chapter V of the GDPR:

the provider is certified under the EU–US Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection; or
the transfer is made under Standard Contractual Clauses approved by the European Commission.

You may ask us for a copy of the safeguards that apply by writing to [email protected].

7. How long we keep your data

We keep your data only as long as we need it, and we determine that period as follows:

Orders, invoices and accounting records – for the period required of us by Bulgarian accounting and tax legislation. We cannot delete these earlier, even at your request, because the law requires us to keep them.
Your customer account – for as long as your account remains open. If you ask us to close it, we delete it, except for the records above.
Newsletter and marketing data – until you withdraw your consent or object. After that we keep only a minimal record of your decision, so that we do not contact you again by mistake.
Website analytics data – no longer than the retention period configured in Google Analytics, after which it is deleted by Google automatically.
Emails and customer service correspondence – for as long as needed to deal with your enquiry and any question that may follow from it, and then for the period during which a claim could still be brought.

When a period ends, we delete the data or anonymise it so that it can no longer be linked to you.

8. Your rights

The GDPR gives you the following rights. Exercising them is free, and we will respond within one month.

Right of access – to be told whether we process your data, and to receive a copy of it.
Right to rectification – to have inaccurate data corrected and incomplete data completed.
Right to erasure (“right to be forgotten”) – to have your data deleted where we have no continuing legal reason to keep it.
Right to restriction of processing – to ask us to pause our use of your data in certain circumstances.
Right to data portability – to receive the data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller where this is technically feasible.
Right to object – to object at any time to processing based on our legitimate interests. If you object to direct marketing, we will stop immediately and without exception.
Right to withdraw consent – where we rely on your consent, you may withdraw it at any time. This does not affect the lawfulness of anything we did before you withdrew it.
Right not to be subject to a decision based solely on automated processing producing legal or similarly significant effects – we do not take such decisions; see section 9.

To exercise any of these rights, email [email protected] or write to us at the address in section 1. We may ask you to confirm your identity first, so that we do not disclose your data to someone else.

9. Profiling and automated decisions

We group customers according to what they have bought, so that the messages we send are relevant. For example, we may remind you that a dive computer battery bought around two years ago is likely to be due for replacement, or that o-rings and grease are usually replaced at a similar interval.

This is profiling for marketing purposes only. It has no legal effect on you and no similarly significant effect, and no decision about you is made by automated means alone. You can object to it at any time, and we will stop.

10. Is providing your data mandatory?

Providing your name, address, email address and payment details is necessary for us to enter into and perform the sales contract with you. If you do not provide them, we cannot process or deliver your order.

Providing data for newsletters, product reviews and analytics is entirely optional. If you choose not to, you can still shop with us normally.

11. How to complain

If you are unhappy with the way we handle your data, please contact us first at [email protected] – we will do our best to put it right.

You also have the right to lodge a complaint with the supervisory authority. In Bulgaria this is:

Commission for Personal Data Protection
(Комисия за защита на личните данни)
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Telephone: +359 2 915 3519
Email: [email protected]
Web: www.cpdp.bg

If you live or work in another EU or EEA country, you may also complain to the supervisory authority there.

12. Security

We take appropriate technical and organisational measures to protect your data. The whole site runs over an encrypted connection (HTTPS), access to our systems is restricted, and payments are handled by certified payment providers so that card details never reach our own servers.

13. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. If we make a significant change, we will tell you by email or by a notice on the website.