Effective from 14 October 2026

This policy explains what personal data the online shop zoomagazina.bg (“Sorela Pet Shop”) collects, why it processes it, to whom it discloses it and what your rights are. This policy has been prepared in accordance with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act.

1. Data controller

• KIMSE OOD, UIC 201359225, VAT No. BG201359225
• Registered office and management address: 23 Tsacho Shishkov St., Lovech 5500, Bulgaria
• Phone: 0883 72 22 72
• Email for personal data enquiries: sorela13@abv.bg

2. What data we collect

• When you place an order: first and last name, phone number, email, delivery address or courier office/locker, order notes, ordered products and order history;
• When an invoice is issued: company name, UIC/VAT number, registered address, manager;
• When you register: email, username and password (the password is stored encrypted);
• When you pay: details of the payment made. Your bank card details are entered directly with the payment provider and are not stored by us;
• When returning goods or filing a complaint: description of the problem, photos, IBAN for refunds;
• When subscribing to the newsletter (if available): email address;
• When you contact us: the content of the correspondence;
• Technical data: IP address, browser and device type, cookies. See Cookie Policy.

We do not collect special categories of data and do not knowingly collect data from persons under 16 years of age.

3. Purposes and legal bases

Purpose	Legal basis (Art. 6 GDPR)
Accepting, processing and delivering orders, communication about the order	Performance of a contract – Art. 6(1)(b)
Creating and maintaining a customer account	Performance of a contract – Art. 6(1)(b)
Issuing invoices and accounting documents, tax obligations	Legal obligation – Art. 6(1)(c)
Handling returns, complaints and warranty claims	Legal obligation and performance of a contract – (c) and (b)
Sending newsletters and promotional offers	Consent – Art. 6(1)(a) (may be withdrawn at any time)
Website security, fraud prevention, protection in disputes	Legitimate interest – Art. 6(1)(f)
Analytics and marketing cookies	Consent – Art. 6(1)(a)

4. Who we share data with

We share only the data necessary for the relevant purpose with:

• Courier companies and delivery partners: Speedy AD, Econt Express OOD, BOX NOW and Sameday. We provide them with your name, phone number, delivery address/office and the cash-on-delivery amount;
• Payment providers and banks: when paying by card or bank transfer;
• Website hosting and maintenance provider: as a data processor under a contract;
• Accounting firm: to fulfil accounting and tax obligations;
• Public authorities (National Revenue Agency, Consumer Protection Commission, courts, etc.): only where required by law.

We do not sell or share data with third parties for their own marketing purposes. Data is processed within the European Union. If a provider (e.g. of analytics services) transfers data outside the EU, this is done with appropriate safeguards under Art. 46 GDPR.

5. Retention period

• Order and invoice data: up to 10 years, in accordance with the Accountancy Act and tax legislation;
• Customer account: until you close it or after 3 years of inactivity;
• Complaints and returns: 5 years (the general limitation period);
• Newsletter: until consent is withdrawn;
• Correspondence: up to 2 years, unless related to an order or a dispute;
• Cookies: according to the periods set out in the Cookie Policy.

6. Your rights

You have the right:

• to access your personal data and obtain a copy (Art. 15 GDPR);
• to rectification of inaccurate data (Art. 16);
• to erasure (“the right to be forgotten”) where there is no legal obligation to retain the data (Art. 17);
• to restriction of processing (Art. 18);
• to portability of your data (Art. 20);
• to object to processing based on legitimate interest and to direct marketing (Art. 21);
• to withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, write to sorela13@abv.bg or to the company’s address. We will respond within 1 month. If necessary, we will ask for information to confirm your identity.

If you believe your rights have been violated, you can lodge a complaint with the Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg.

7. Security

We apply appropriate technical and organisational measures to protect data: encrypted connection (SSL/HTTPS), restricted access to the site administration, encrypted password storage, regular updates and backups. In the event of a security breach that poses a risk to you, we will notify the Commission for Personal Data Protection and, where necessary, the affected individuals.

8. Automated decision-making

We do not use automated decision-making, including profiling, that produces legal effects for you.

9. Changes to this policy

We may update this policy. The current version is published on this page with its effective date.