Here we explain what personal data we collect when you use this online shop, why, who we share it with, how long we keep it and what rights you have under the General Data Protection Regulation (GDPR). We collect only the data we need to fulfil your order and to run the shop.
1. Controller
The controller of your personal data is:
PREMIUM FLAGS EOOD, UIC 206910312, VAT no. BG206910312
Address: Mladost 2 residential district, block 283, entrance 2, 1799 Sofia
Email: [email protected] · Tel.: +359 888 508 788
For any question about your data, write to us at the email address above.
2. What data we collect and why
- When you order: name, delivery and invoicing address, email, phone, the products, the payment method and its status. To fulfil, deliver and invoice the order and to inform you about it (contract, Art. 6(1)(b) GDPR).
- Accounting and tax documents for the order: legal obligation (Art. 6(1)(c) GDPR).
- Card payment: card details are entered directly at myPOS. We see only whether the payment was successful.
- Bank transfer: the name, IBAN and reference of the transfer, to match the payment with the order and to refund amounts if needed (contract).
- Withdrawal and complaints: your messages, photos and our decision, including the entry in the complaints register (legal obligation; legitimate interest in defending legal claims, Art. 6(1)(f) GDPR).
- Account, if you create one: email, password (we keep it hashed), your addresses and orders (contract).
- Use of the site: IP address, browser and device data, the pages requested and the time. So that the site works and to protect it from abuse and attacks (legitimate interest).
- Cookies and browser data: are described on the page Cookies, together with how to change your choice.
We do not use your data for advertising or analytics and do not sell it. We do not make decisions based solely on automated processing. You are not obliged to give us data, but without the mandatory fields at checkout we cannot accept and deliver the order.
3. Who we share data with
- The supplier, from whose warehouse the order is dispatched: name, address and phone for delivery and the products, so that they can prepare the parcel.
- The couriers Speedy and Pigeon Express: name, address, phone and email and, for cash on delivery, the amount to pay.
- myPOS: card payments and fraud protection.
- Cloudflare, Inc.: delivery and site protection. Data is transferred to the USA under the EU–US Data Privacy Framework and standard contractual clauses.
- The hosting provider of the shop and of the email.
- Our accountant and public authorities, where the law requires it.
The suppliers who process data on our behalf do so under a contract with us and only for the purposes above.
4. How long we keep the data
- Orders, invoices and accounting documents: 10 years, as required by the Accountancy Act and the Value Added Tax Act.
- Complaints register, withdrawal notices and complaints: until the limitation period for claims on the order expires (5 years).
- Account: until you close it. We keep the orders in it as stated in the first point.
- Cart: without an account about 48 hours after your last action in the shop; when you sign in, the cart is kept in the account until you change or empty it.
- Security logs: only for as long as Cloudflare and the hosting provider keep them, after which they are deleted automatically.
5. Your rights
You have the right to request access to your data and a copy of it, rectification of inaccurate data, erasure (unless we must keep it, for example invoices), restriction of processing, portability and to object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time.
To exercise your rights, write to us at the email address in section 1. We reply within one month. We may ask you first to confirm your identity.
You have the right to lodge a complaint with the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Boulevard, 1592 Sofia, cpdp.bg, or with the supervisory authority in the EU country where you live or work.
6. Security
The site works only over HTTPS. Your card details never reach our servers. Access to orders is only for the people who need it.
7. Children
The shop is not intended for children under 14 and we do not knowingly collect their data.
8. Changes
We update this policy when our practices or the law change. If a change is important to you, we will also notify you by email or on the site.