Privacy Policy

1. Data Controller

Vassilevski Solutions EOOD, UIC (EIK) 204455150, with registered seat and management address at: Bulgaria, Sofia (1618), Krasno Selo district, Krasno Selo complex, bl. 208, entr. B, fl. 6, ap. 35.

For questions regarding personal data: [email protected].

2. Personal Data We Collect

• •Account data: name, email address, password (stored hashed).
• •Order data: recipient name, delivery address, phone, order contents.
• •Delivery and payment data: processed by Econt/Speedy for cash on delivery. We do not store bank card data.
• •Technical data: IP address, browser and device type, pages visited.
• •Communication data: emails and messages you send us.
• •Marketing preferences and consents.

3. Purposes and Legal Bases for Processing

• •Performance of a contract to sell and deliver your orders — Art. 6(1)(b) GDPR.
• •Compliance with legal obligations (accounting, tax, consumer law) — Art. 6(1)(c) GDPR; Bulgarian Accounting Act.
• •Sending marketing communications — Art. 6(1)(a) GDPR (consent), which may be withdrawn at any time.
• •Legitimate interests — site improvement, fraud prevention, statistics — Art. 6(1)(f) GDPR.

4. Retention Period

• •Accounting and tax documents — 10 years pursuant to Art. 12 of the Bulgarian Accounting Act.
• •Account data — until the account is deleted by the user.
• •Marketing consent data — until consent is withdrawn.
• •Analytics data — up to 14 months.

5. Recipients and Data Processors

We share limited personal data with the following trusted processors who help us provide our services:

• •Econt Express Ltd. and Speedy AD — courier services and cash on delivery.
• •Supabase Inc. — database and authentication (EU-hosted).
• •Cloudflare, Inc. — hosting, CDN, and image storage.
• •Resend — transactional email delivery.
• •Google LLC — site analytics (Google Analytics).
• •Meta Platforms, Inc. — advertising measurement (Meta Pixel).

6. International Data Transfers

Some of our processors are established outside the European Economic Area (primarily in the USA). Such transfers are carried out on the basis of Standard Contractual Clauses approved by the European Commission and/or the EU-US Data Privacy Framework, where applicable.

7. Your Rights

Under the GDPR you have the following rights, which you may exercise by writing to [email protected]:

• •Right of access to your personal data.
• •Right to rectification of inaccurate data.
• •Right to erasure ("right to be forgotten").
• •Right to restriction of processing.
• •Right to data portability.
• •Right to object to processing based on legitimate interest or direct marketing.
• •Right to withdraw consent at any time.
• •Right to lodge a complaint with the Commission for Personal Data Protection (CPDP): 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, email: [email protected], www.cpdp.bg.

8. Cookies

We use cookies to keep the site running, analyze traffic, and display relevant advertising. You can manage your preferences through the cookie banner presented on your first visit.

• •Necessary cookies — core functionality (cart, login, session).
• •Analytics cookies — Google Analytics, for statistics.
• •Marketing cookies — Meta Pixel, for advertising measurement.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encrypted connections (TLS), encryption at rest, access controls, and database-level Row Level Security.

10. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy. The current version is always available on this page with the last-updated date shown at the top.