SUBMED PRIVACY POLICY

Last updated: 23 September 2026

1. Who we are

This website, submedeu.com (the "Site"), is operated by:

SUBMED BIOMEDICAL BG LTD
132 Mimi Balkanska Str.
Sofia, Bulgaria

referred to in this policy as "SUBMED", "we", "us" or "our". SUBMED is the data controller responsible for your personal data in connection with your use of this Site, under Regulation (EU) 2016/679 (the "General Data Protection Regulation" or "GDPR").

Our group also includes SUBMED USA LLC (103 Rapin Place, Buffalo, NY 14211, United States), which operates our US site, and our manufacturing headquarters at Velimeşe O.S.B Mah. 242. Sok. No:9/2, 59930 Ergene / Tekirdağ, Turkey. Where those entities process personal data on our behalf (for example, order fulfilment), they do so under our instructions and this policy.

2. What personal data we collect

We collect personal data that you provide to us directly, and some data collected automatically when you use the Site.

• Contact and enquiry data: name, email address, phone number, company/organisation, and the content of any message you send us through a contact or quote-request form.
• Order and account data: billing and delivery address, order history, invoicing details, and (if you create an account) your login credentials.
• Payment data: our payment processor collects and processes your card or payment details on our behalf. We do not store full card numbers on our own systems.
• Marketing preferences: your consent status and preferences if you sign up to receive marketing emails or SMS updates.
• Technical and usage data: IP address, browser type, device information, pages viewed, and similar data collected automatically through cookies and similar technologies (see Section 8).

3. Why we process your data and our legal basis

Purpose	Legal basis (GDPR Art. 6)
Processing and fulfilling orders, invoicing, customer support	Performance of a contract (Art. 6(1)(b))
Responding to enquiries and quote requests	Legitimate interest in operating our business (Art. 6(1)(f)) / pre-contractual steps (Art. 6(1)(b))
Sending marketing emails or SMS	Consent (Art. 6(1)(a)), which you may withdraw at any time
Complying with tax, accounting and medical-device regulatory obligations	Legal obligation (Art. 6(1)(c))
Site security, fraud prevention, analytics	Legitimate interest (Art. 6(1)(f))

4. Who we share your data with

We do not sell your personal data. We share it only where necessary, including with:

• IT and hosting providers, including our e-commerce platform provider, who process data on our behalf as data processors;
• payment service providers, to process your payment securely;
• shipping and logistics companies, to deliver your order;
• professional advisers (accountants, auditors, legal counsel) and regulators, where required by law;
• SUBMED USA LLC and our Turkey manufacturing headquarters, where relevant to fulfilling your order or providing support.

5. International data transfers

Some of our service providers (including our e-commerce platform and, where applicable, SUBMED USA LLC) are located outside the European Economic Area, including in the United States. Where we transfer personal data outside the EEA, we rely on appropriate safeguards recognised under GDPR, such as the European Commission's Standard Contractual Clauses, or transfers to providers certified under an approved data protection framework. You can request further information about these safeguards by contacting us using the details in Section 11.

6. How long we keep your data

We keep personal data only as long as necessary for the purposes described in this policy: generally, for the duration of any customer relationship plus the period required by applicable tax, accounting, and medical-device traceability obligations (which, for certain medical products, may require longer retention). Marketing data is kept until you withdraw consent or unsubscribe. Enquiry data that does not lead to an order is deleted or anonymised after a reasonable period.

7. Your rights under GDPR

Subject to certain conditions and exceptions under applicable law, you have the right to:

• Access the personal data we hold about you;
• Rectification of inaccurate or incomplete data;
• Erasure of your data ("right to be forgotten"), in certain circumstances;
• Restrict or object to our processing of your data;
• Data portability, to receive your data in a structured, machine-readable format;
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and
• Lodge a complaint with a supervisory authority, in particular the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни, cpdp.bg), or the data protection authority in your own EU member state.

To exercise any of these rights, contact us using the details in Section 11. We may need to verify your identity before responding.

8. Cookies

We use cookies and similar technologies to operate the Site, remember your preferences, and understand how visitors use the Site, including analytics and (where you consent) marketing cookies. You can control or withdraw your consent to non-essential cookies at any time through your browser settings or any cookie preference tool provided on the Site.

9. Children's privacy

This Site is intended for healthcare professionals, institutions, and adult customers. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page indicates when it was last revised. Material changes will be highlighted on this page.

11. Contact us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

SUBMED BIOMEDICAL BG LTD
132 Mimi Balkanska Str., Sofia, Bulgaria
Via our Contact page