Privacy Policy
Last updated: 31.08.2026
This policy explains what personal data we collect when you shop or browse the store, why we collect it, how long we keep it, and what rights you have. It is written to be readable — without unnecessary legal jargon. We apply Regulation (EU) 2016/679 (GDPR) and the Personal Data Protection Act.
1. Who processes your data
The personal data controller is:
| Controller | "SUKCES 7" LTD |
| UIC | 201711071 |
| Registered office and management address | 4006 Plovdiv, Iztochni district, Zlatorog Str. No. 4, fl. 5, apt. 15 |
| Email for personal data inquiries | [TO BE COMPLETED: email for personal data inquiries] |
| Phone | [TO BE COMPLETED: contact phone number] |
| Data Protection Officer | [TO BE COMPLETED: DPO details, if appointed, or explicitly "no DPO appointed"] |
2. What data we collect
2.1. Data you provide to us voluntarily
- When ordering: first and last name, email, phone, shipping address, and if an invoice is desired — billing details.
- When contacting us: email, phone, and the content of your message.
- When subscribing to a newsletter: email, and sometimes name.
- For complaints or returns: order details, bank account for refunds, photos if you have sent them to us.
2.2. Automatically collected data
- IP address, device and browser type, language, approximate location by IP.
- Which pages you viewed, where you came from, what you added to the cart.
- Identifiers from cookies and similar technologies — detailed in the Cookie Policy.
2.3. Data we do not ask from you
We do not collect data about your health and do not ask you to provide it to us. If you send us such data on your own initiative — for example, in an email with a question about the product — we will use it only to answer your specific inquiry and will not add it to marketing profiles.
We do not process payment data such as card numbers. These are entered directly into the payment environment and do not reach us.
The store is not aimed at individuals under 18 years of age and we do not knowingly collect data from children.
3. Why and on what basis
| Purpose | Basis under Art. 6, para. 1 GDPR |
|---|---|
| Order processing, delivery, return, communication regarding the specific order | b. "b" — performance of a contract with you |
| Issuance and storage of accounting documents, compliance with tax and consumer obligations | b. "c" — legal obligation |
| Responding to an inquiry not related to an order | b. "f" — legitimate interest to answer questions |
| Store security, fraud and abuse prevention | b. "f" — legitimate interest |
| Newsletter and marketing communications | b. "a" — your consent |
| Analytical and marketing cookies | b. "a" — your consent through the cookie banner |
| Protection of rights in a legal dispute or complaint | b. "f" — legitimate interest |
We do not make decisions with legal effect on you solely through automated processing and do not carry out profiling with such consequences.
4. Who else sees your data
We do not sell personal data. We share it only with providers without whom the store cannot operate, and only to the necessary extent:
- Shopify — the platform on which the store operates. It hosts the site, processes orders and payments.
- Courier company — [TO BE COMPLETED: name of the courier company or companies performing the delivery]. Receives name, phone and address to deliver the shipment.
- Payment providers — [TO BE COMPLETED: payment providers used]
- Accounting services — [TO BE COMPLETED: accounting firm or in-house accounting]
- Analytics and advertising tools — [TO BE COMPLETED: exact list of analytical and advertising tools used, if any]. They operate only after consent through the cookie banner.
- Email marketing platform — [TO BE COMPLETED: newsletter platform, if used]
- State authorities — when required by law.
A processing agreement under Art. 28 GDPR is concluded with each provider who processes data on our behalf.
5. Transfer outside the EU
Some of our providers, including Shopify, may process data on servers outside the European Economic Area. In such cases, the transfer is carried out on the basis of an European Commission decision on an adequate level of protection or on the Commission's standard contractual clauses, along with additional safeguards where necessary.
Specific transfers and their grounds: [TO BE COMPLETED: list of non-EEA providers and the legal basis for the transfer]
6. How long we keep the data
| Category | Period |
|---|---|
| Accounting documents for orders (invoices, reports) | 10 years in accordance with the Accountancy Act |
| Order and delivery data outside accounting documents | [TO BE COMPLETED: retention period for order data] |
| Correspondence and inquiries | [TO BE COMPLETED: retention period for correspondence] |
| Newsletter data | Until your consent is withdrawn |
| Cookies | According to the term of each cookie — see Cookie Policy |
After the expiration of the term, the data is deleted or anonymized.
7. Your rights
Under GDPR, you have the following rights:
- Access (Art. 15) — to know what data about you we process and to receive a copy.
- Rectification (Art. 16) — to correct inaccurate or incomplete data.
- Erasure (Art. 17) — to request erasure when the data is no longer needed or you have withdrawn your consent. This right does not apply to data that we are obliged to keep by law, such as accounting documents.
- Restriction of processing (Art. 18).
- Data portability (Art. 20) — to receive your data in a structured, machine-readable format or to transfer it to another controller, where technically feasible.
- Objection (Art. 21) — against processing based on legitimate interest, including against direct marketing.
- Withdrawal of consent — at any time, without affecting the lawfulness of processing before the withdrawal. Unsubscribing from the newsletter is done via the link at the end of each email.
To exercise your rights, please write to us at [TO BE COMPLETED: email for personal data inquiries]. We respond within one month. For complex or numerous requests, the period may be extended by another two months, of which we will notify you. We may request additional information to ensure that the request comes from you.
8. Complaint to a supervisory authority
If you believe that we are processing your data unlawfully, you have the right to lodge a complaint under Art. 77 GDPR with:
Commission for Personal Data Protection
Sofia 1592, "Prof. Tsvetan Lazarov" Blvd. No. 2
cpdp.bg
We would be happy if you contact us first — usually the issue is resolved faster.
9. Security
We apply technical and organizational measures for data protection: encrypted connection (HTTPS), restricted access to the store administration only to authorized persons, and confidentiality agreements with processors. No system is absolutely protected, but we treat your data with the necessary care.
10. Changes to this policy
We may update the policy when services or legal requirements change. The current version is always on this page with the date of the last update indicated. In case of significant changes, we will notify you appropriately.