Confidentiality

1. Who processes the data?

The data controller within the meaning of the General Data Protection Regulation is:

2. What data do we collect?

When ordering: first name, surname, email address, telephone number, delivery address or chosen courier office, order details, order history.

When registering an account: email address, encrypted password, saved addresses.

When making a payment: The website does not receive or store card numbers. These are processed by Stripe. For subscriptions, only an identifier is stored, which points to a payment method saved in the Stripe system.

When using the website: IP address, browser and device type, pages visited, source of the visit. This data is collected only once consent has been given for analytics cookies.

Upon enquiry: the data that you yourself provide in an email or message.

3. Why, and on what grounds?

Performance of a contract: order processing and delivery, communication regarding the order, and subscription management. Without this data, the order cannot be fulfilled.

Legal obligation: the issuing and retention of accounting documents in accordance with tax legislation.

Legitimate interest: fraud prevention, website maintenance and security, and the handling of complaints.

Consent: analytical and marketing cookies, newsletter subscriptions. Consent may be withdrawn at any time, without this affecting the lawfulness of the processing carried out prior to the withdrawal.

4. Who we share data with

Data is only passed on to suppliers necessary for the shop’s operations, and only to the extent necessary:

Data is not sold or disclosed to third parties for their own marketing purposes.

Some suppliers process data outside the European Economic Area. In such cases, the transfer is based on standard contractual clauses approved by the European Commission.

5. How long do we retain the data?

Order details and accounting documents: in accordance with the statutory retention periods for accounting information.

Profile details: for as long as the profile exists. When a profile is deleted, the data is erased, except for that which we are required by law to retain.

Newsletter details: until consent is withdrawn.

Analytical data: depending on the retention period set in Google Analytics.

6. Your rights

As a data subject, you have the right to:

Applications should be submitted to rumyskitchenn@gmail.com. A response will be provided within one month.

You have the right to lodge a complaint with the Personal Data Protection Commission, Sofia, 2 Prof. Tsvetan Lazarov Boulevard, cpdp.bg.

7. Cookies

Cookies are small files that are stored in your browser and enable the website to function properly and remember your preferences.

Essential cookies. They are always active and do not require consent. They store the contents of your shopping basket, your login status and your cookie preferences.

Analytical cookies. Google Analytics via Google Site Kit. These help us understand which pages are useful and how to improve the website. They are only loaded once you have given your consent.

Marketing cookies. These are used to measure ad performance and for remarketing. They are only loaded once you have given your consent.

8. Security

The website operates via a secure connection. Passwords are stored only in encrypted form.

Access to personal data is restricted to those persons who need it to fulfil orders and maintain the website.

9. Changes to the policy

This policy may be updated in the event of changes to our services or to the law. The current version is always available on this page, with the date of the last update shown.