Privacy Policy

Who processes your data

The data controller is [ИМЕ НА ФИРМАТА/ЕТ], company ID (ЕИК) [ЕИК], registered address [АДРЕС] (referred to below as “we” or “C&F Craft”).

For any question about your personal data you can reach us at [ИМЕЙЛ] or by phone at [ТЕЛЕФОН].

What data we collect

We collect only the data needed to fulfil your order or answer your enquiry:

• order and delivery data: recipient name, phone, chosen courier (Econt or Speedy) and the office or delivery address;
• contact data for a custom-work enquiry: your name and email or phone, plus the description you send us;
• the email address we receive from the payment provider so we can send you a confirmation;
• technical order data (items, configuration, amount, payment reference).

We do not collect card details. Payment happens entirely on Stripe's secure page — your card number never passes through, and is never stored on, our website.

Purposes and legal basis

• Fulfilling the sales contract and arranging delivery — Art. 6(1)(b) GDPR (performance of a contract).
• Issuing and keeping accounting records — Art. 6(1)(c) (legal obligation under Bulgarian accounting and tax law).
• Answering a custom-work enquiry — Art. 6(1)(b) (pre-contractual steps) or (f) (our legitimate interest in replying to you).

Who we share data with

We share data only with service providers who help us operate, and only to the extent needed. They act as data processors on our behalf:

• Stripe — card payment processing;
• Resend — sending order email notifications;
• Google Cloud (servers within the European Union) — hosting the site and database;
• the couriers Econt and Speedy — to deliver your order.

We never sell or rent your personal data. We disclose data to public authorities only where the law requires it.

How long we keep data

Accounting records related to orders (invoices, receipts) are kept for 10 years as required by Art. 12 of the Bulgarian Accounting Act. Custom-work enquiries are kept until the conversation is closed and for a reasonable period afterwards, then deleted.

Your rights

In relation to your personal data you have the following rights:

• the right of access to the data we process about you;
• the right to have inaccurate data corrected;
• the right to erasure (“right to be forgotten”), unless we are legally required to keep the data;
• the right to restrict processing;
• the right to data portability;
• the right to object to processing based on legitimate interest.

To exercise any of these rights, write to us at [ИМЕЙЛ]. If you believe your rights have been infringed, you may lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd, Sofia, www.cpdp.bg.

Cookies and local storage

We do not use tracking, advertising or analytics cookies. The site stores only two technical values in your browser's local storage: the contents of your cart and your chosen theme (light or dark). These stay on your device, are never sent to us, and you can clear them at any time via your browser settings.

Changes to this policy

We may update this policy if our activity or the law changes. The current version is always published on this page.