Legal
Privacy Policy
This policy describes how we process personal data under the GDPR and the Bulgarian Personal Data Protection Act. It is not a substitute for independent legal advice.
Last updated: 16 August 2026. This policy explains what personal data we collect when you use this website or place an order, why we collect it, how long we keep it, and what rights you have.
1. Data Controller
The data controller is FERA TARTUFI EOOD (ФЕРА ТАРТЮФИ ЕООД), a single-member limited liability company registered in the Commercial Register at the Registry Agency of the Republic of Bulgaria under UIC/EIK 205718469, VAT ID BG205718469, with registered seat at 31 Izgrev, 8230 Nesebar, Bulgaria. The company is managed by Iliya Ivanov Kalchev.
We do not appoint a Data Protection Officer because our core activity is not large-scale systematic monitoring or processing of special categories of data (GDPR Art. 37). For any privacy question or to exercise your rights, write to hello@feratartufi.com. We respond within one month, as required by GDPR Art. 12(3).
2. What Personal Data We Collect
Order and customer data: name, email address, phone number if you provide one, billing and shipping address, and order history — provided when you place an order or contact us.
Payment data: we do not collect or store your card details. Payments are processed by Stripe Payments Europe, Ltd. (and related Stripe entities). Stripe handles card data under its own privacy notice and PCI-DSS obligations.
Technical data: IP address, browser type, device information, and pages visited, collected automatically in hosting/server logs needed to deliver and secure the site.
Marketing data: your email address only if you subscribe to the newsletter, used solely to send the communications you asked for.
Language preference: a strictly necessary cookie (NEXT_LOCALE) remembers whether you chose English or Bulgarian.
3. Purpose and Legal Basis
Performing your order (name, address, email, order details): GDPR Art. 6(1)(b) — necessary to perform a contract.
Customer service and complaints: GDPR Art. 6(1)(b) and, where needed, Art. 6(1)(f) — our legitimate interest in resolving issues and keeping accurate records.
Invoicing, VAT and accounting: GDPR Art. 6(1)(c) — legal obligation under the Bulgarian Accountancy Act, VAT Act and tax law. FERA TARTUFI EOOD has been VAT-registered under BG205718469 since 4 July 2019.
Newsletter: GDPR Art. 6(1)(a) — your opt-in consent, which you may withdraw at any time.
Security and abuse prevention (server logs): GDPR Art. 6(1)(f) — legitimate interest in keeping the shop secure.
4. How Long We Keep Data
Order, invoice and tax records are kept for 10 years, which is the standard retention period for primary accounting documents under Bulgarian accounting and tax practice (and at least 10 years for EU OSS/cross-border VAT records).
Newsletter data is kept until you unsubscribe. Contact-form messages are kept only as long as needed to answer you and handle any follow-up, then deleted unless a legal claim requires longer retention.
Technical logs are kept for a short period for security and troubleshooting, then deleted or anonymised.
5. Your Rights (GDPR Art. 15–22)
You may request access to your data, correction of inaccurate data, erasure, restriction of processing, data portability, and you may object to processing based on legitimate interest or to direct marketing.
Email hello@feratartufi.com to exercise these rights. We will answer within one month. If we refuse, we will explain why and remind you of your right to complain.
6. Who Else Sees Your Data
Stripe — payment processing. Stripe acts as an independent controller for the payment data it collects; see Stripe’s privacy policy.
Vercel, Inc. — website hosting. Vercel processes technical data (server logs, IP addresses) as our processor in order to deliver the site.
The courier we use to ship your order — name, delivery address and phone if provided, solely to deliver the parcel.
We do not sell personal data. We share it only where needed to run the shop, fulfil an order, or comply with the law.
8. Transfers outside the EEA
Some processors (including Stripe and Vercel) may process data outside the European Economic Area. Where that happens we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses.
9. Complaints
You may lodge a complaint with the Commission for Personal Data Protection of the Republic of Bulgaria (Комисия за защита на личните данни, CPDP): https://www.cpdp.bg. You may also complain to the supervisory authority in the EU member state where you live or work.