Privacy Policy

This Privacy Policy describes how “ESVIEM” EOOD collects, uses, and protects your personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR) and the Bulgarian Personal Data Protection Act.

1. Data Controller

Controller: “ESVIEM” EOOD
Company registration number (EIK): 205366174
Brand / website: Svetulkovi Gradini — svetulkovigradini.com
Email for data protection queries: hello@svetulkovigradini.com
Phone: +359 878 831 466

2. What Personal Data We Collect

Depending on how you interact with the site, we may collect the following categories of data:

When placing an order: full name, delivery address, phone number, email address, billing details (where needed), and transaction information. We do not store payment card data — payments are processed by a licensed payment provider.
When contacting us via a form or email: name, email address, and the content of your message.
When subscribing to our newsletter: email address.
Automatically when visiting the site: IP address, device and browser type, and site behaviour data — collected via cookies (see Section 8).

3. Purposes and Legal Bases for Processing

Processing and delivering orders — legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Issuing invoices and accounting records — legal basis: legal obligation (Art. 6(1)(c)).
Responding to inquiries and communication — legal basis: legitimate interest (Art. 6(1)(f)).
Sending newsletters and marketing communications — legal basis: consent (Art. 6(1)(a)).
Site analysis and improvement, marketing cookies — legal basis: consent (Art. 6(1)(a)).

4. Recipients of Your Data

To fulfil the purposes above, we may share data with the following categories of recipients (data processors):

Courier companies — Speedy and BoxNow, for order delivery (name, address, phone).
Payment provider IrisPay (Iris Solutions) — for processing payments.
Google (Google Tag Manager / analytics tools) — for traffic analysis, only where consent has been given.
Meta Platforms (Meta Pixel — Facebook/Instagram) — for marketing purposes, only where consent has been given.
Hosting, IT, and email service providers — for site maintenance and sending communications.
Competent public authorities — where required by law.

We do not sell or share your personal data with third parties for their own marketing purposes.

5. International Data Transfers

Some of the tools we use (e.g. Google and Meta) may transfer data outside the European Economic Area (EEA), including to the United States. In such cases, the transfer is carried out on the basis of an EU adequacy decision or standard contractual clauses approved by the European Commission, which ensure an appropriate level of protection.

6. Data Retention Period

Order and invoice data — up to 5 (five) years, in accordance with accounting and tax legislation.
Contact form / inquiry data — up to 1 (one) year, or until the correspondence is closed.
Newsletter data — until consent is withdrawn (unsubscribed).
Cookies — according to the retention period of each specific cookie (see the Cookie Policy).

7. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

Right of access — to obtain information and a copy of the data we hold about you.
Right to rectification — to request correction of inaccurate data.
Right to erasure (“right to be forgotten”) — where the legal conditions are met.
Right to restriction of processing.
Right to data portability — to receive your data in a structured, machine-readable format.
Right to object — to processing based on legitimate interest or for direct marketing purposes.
Right to withdraw consent — at any time, without affecting the lawfulness of processing carried out before the withdrawal.
Right to lodge a complaint — with a supervisory authority.

To exercise your rights, you can contact us at hello@svetulkovigradini.com.

You also have the right to file a complaint with the Commission for Personal Data Protection (CPDP):

Address: 1592 Sofia, 2 Prof. Tsvetan Lazarov Blvd.
Phone: 02 915 3518
Website: www.cpdp.bg

8. Cookies

The site uses cookies, including analytics cookies (via Google Tag Manager) and marketing cookies (via Meta Pixel). Detailed information about the types of cookies used, their purposes, and how to manage your consent can be found in our Cookie Policy.

9. Data Security

We apply appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, or destruction. All communication with the site takes place over a secure SSL/TLS connection (HTTPS).

10. Changes to This Policy

We reserve the right to update this Policy in the event of changes in legislation or in how the site operates. We recommend checking this page periodically.

Last updated: 25 June 2026.