Privacy Policy & Cookies

1. Who Processes Your Data (Controller)

The data controller is …, Company ID (EIK/Bulstat): …, address: …. Contact for data protection matters: info@stambolova.com.

2. What Personal Data We Collect

We collect only the data you provide yourself:

• Registration and account: email, password (stored encrypted), name, phone.
• Orders and delivery: first and last name, email, phone, address or selected courier office/locker.
• Workshop bookings: first name, last name, phone, email, selected date.
• Vouchers: sender and recipient name, recipient email.
• Newsletter: email and name (only if you subscribe).
• Technical data: anonymized visit statistics - the IP address and browser are converted into an irreversible code and are not stored in readable form.

We do not store bank card data - payments are handled entirely by Stripe.

3. Purposes and Legal Bases

• Managing accounts, orders and bookings - performance of a contract.
• Sending the newsletter - your consent, which you may withdraw at any time.
• Protection against abuse and security - legitimate interest.
• Accounting and tax obligations - legal obligation.

4. Who We Share Data With

We share data only with providers necessary to deliver the service: Stripe (payments), Mailchimp (newsletter), Speedy and Box Now (delivery), Google reCAPTCHA (form protection), and an email service provider. Some of these providers may process data outside the EU (e.g. the USA) under appropriate safeguards in accordance with the GDPR. We do not sell or rent your data to third parties.

5. Cookies

We use only strictly necessary and functional cookies that are essential for the proper operation of the website:

• Session and authentication cookies (for logging into the profile and persisting the items in the shopping cart).
• Security cookies from Google reCAPTCHA (to protect against spam and automated attacks).
• Stripe cookies (for security and fraud prevention during card payments).

We do not use advertising or tracking cookies for retargeting and marketing.

6. Retention Period

Account data is kept while the account exists; unconfirmed registrations are deleted automatically after 24 hours. Order data is kept for the period required by accounting and tax law. Newsletter subscription is kept until you unsubscribe.

7. Your Rights

Under the GDPR you have the right to access, rectification, erasure, restriction, portability and objection. To exercise your rights: info@stambolova.com. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP). We do not carry out automated decision-making or profiling.

8. Security

We apply technical and organizational measures - passwords are stored encrypted and access to the administration area is restricted.

9. Children

The site is not directed at persons under 16 and we do not knowingly collect their personal data. If we identify such data, we will delete it.

10. Changes

We may update this policy from time to time; the current version is always published on this page.