Privacy and Personal Data Protection Policy

Personal data controller: CandleArt

Company ID (EIK): [EIK]

Address: [registered address]

Phone: +359 899 942 093

Contact email for personal data questions: sale@candleart.bg

Depending on what you do on the Site, we may process the following categories of personal data:

• Identification data – first and last name.
• Contact data – email, phone, delivery address, town.
• Order and payment data – order history, chosen payment method (card or cash on delivery), order value. For card payments, card details are processed by the payment provider and are not stored by us.
• Communication and feedback – the content of enquiries sent through the contact form, email correspondence.
• Technical data and logs – IP address, device type, operating system and browser, language and time zone, screen resolution, pages visited and time spent on them, the source of the visit (including ad click identifiers such as gclid, fbclid and ttclid, and UTM parameters), date and time of the visit, cookies used.
• Marketing data (only with consent) – newsletter subscription.

We process personal data only where there is a valid legal basis under Art. 6 GDPR:

• Concluding and performing a contract – accepting and handling orders, delivery by the chosen courier (Speedy or Econt), card payment or cash on delivery (Art. 6(1)(b) GDPR).
• Compliance with legal obligations – accounting and tax requirements (Art. 6(1)(c) GDPR).
• Legitimate interest – Site security, analysing how the Site is used, detecting and preventing fraudulent and automated clicks on our online ads (Google, Meta, TikTok), defending legal claims (Art. 6(1)(f) GDPR).
• Consent – for the newsletter and marketing messages, and for marketing and statistics cookies (Art. 6(1)(a) GDPR). You can withdraw consent at any time.

The Site uses cookies and similar technologies so pages work properly, to remember your preferences and to collect statistics about how the Site is used. With your consent, cookies for personalised advertising or extended statistics may also be used.

Our own technical cookies (ca_vid, ca_sid, ca_attr) store an anonymous browser and session identifier and the ad the visit came from (for up to 30 days). We use them for security, to detect fraudulent ad clicks and to know which ad led to an order; they are not shared with third parties.

We keep personal data no longer than necessary for the purposes for which it was collected, unless the law requires a longer period.

• Order and invoicing data – up to 10 years, as required by accounting and tax law.
• Marketing data – until you withdraw consent or unsubscribe.
• Technical visit logs (including IP address) – up to 90 days, after which they are deleted.

We do not sell or rent your personal data. We may share it with third parties only where necessary for the purposes above:

• Courier companies — Speedy AD and Econt Express OOD: name, phone, delivery address/office, cash-on-delivery amount (where applicable).
• Payment providers and banks — for card payments, card details are processed by the payment provider as an independent controller; we do not store full card details.
• Accounting firms — for accounting and financial control.
• IT and hosting providers — for maintaining and developing the Site’s infrastructure.
• Competent public authorities — where required by law (National Revenue Agency, courts, police).

As a rule, we do not transfer your personal data to countries outside the European Union / European Economic Area. If that becomes necessary, we will ensure an adequate level of protection through a European Commission adequacy decision or standard contractual clauses.

We apply appropriate technical and organisational measures to protect personal data, including:

• a secure (SSL) connection;
• limited staff access to the data;
• regular updates of systems and software;
• backups;
• incident response procedures.

As a data subject, you have the following rights under the GDPR and the Bulgarian Personal Data Protection Act:

• The right of access to your personal data;
• The right to have inaccurate or incomplete data corrected;
• The right to erasure (“the right to be forgotten”);
• The right to restrict processing;
• The right to data portability;
• The right to object to processing;
• The right to withdraw your consent;
• The right to lodge a complaint with a supervisory authority — the Commission for Personal Data Protection.

You can exercise your rights by sending a written request to sale@candleart.bg. We will reply without undue delay and no later than one month after receiving it.

If you believe your personal data rights have been infringed, you can lodge a complaint with the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg, kzld@cpdp.bg.

We use an automated assessment of technical visit data (IP address, device, behaviour on the Site) to detect fraudulent and automated clicks on our ads and to exclude such addresses from ad campaigns. This assessment does not lead to decisions with legal or similarly significant effects on you and does not limit your access to the Site or your ability to order. We do not use your personal data for any other automated decision-making.

We may update this Policy when the law or our services change. The updated version will always be published on the Site with the date of the last change.