Privacy Policy

1. Data controller

The controller of your data is Bellaviere HC LTD., company No. 208806287, registered at 6 Poshtenska Str., 1225 Sofia, Bulgaria.

For any questions about your personal data, contact us at info@bellaviere.com or on +359 888 656 155.

2. What data we collect

We do not store card details — card payments are handled entirely by myPOS.

• Identification data — first and last name;
• Contact data — email address and phone number;
• Delivery address — city, postal code, address or courier office;
• Order data — items ordered, amounts, payment and delivery method;
• Account data — if you register (created via Firebase);
• Browsing and device data — only if you accept analytics and advertising cookies: pages and products viewed, items added to the cart or wishlist, checkouts started and purchases completed, IP address, browser and device information, and cookie identifiers.

3. Purposes and legal basis

• Performance of a contract (Art. 6(1)(b) GDPR) — processing and delivering your order;
• Legal obligation (Art. 6(1)(c) GDPR) — accounting and tax requirements;
• Legitimate interest (Art. 6(1)(f) GDPR) — security, fraud prevention, abandoned-cart reminders;
• Consent (Art. 6(1)(a) GDPR) — newsletter and marketing, visit statistics (Google Analytics), and measuring and personalising our ads on Facebook and Instagram (Meta Pixel and Conversions API); you may withdraw your consent at any time.

4. Recipients of the data

We share data only with the providers needed to run the store and fulfil your order and, if you have consented, with our analytics and advertising partners:

• Speedy — for delivering shipments;
• myPOS — for processing card payments;
• Amazon Web Services (AWS) — hosting and data storage in the EU;
• Google Firebase — user account authentication;
• Google Ireland Ltd. (Google Analytics) — visit statistics, only with your consent;
• Meta Platforms Ireland Ltd. (Facebook, Instagram) — measuring the effectiveness of our ads and showing relevant ads through the Meta Pixel and the Meta Conversions API, only with your consent. Through the Conversions API our server sends Meta: for product views, additions to the cart or wishlist and the start of checkout, the products concerned together with your IP address, browser user agent, the page address and the _fbp/_fbc identifiers; when you place an order, the purchase (order number, value, products) with the same technical data and with your email address, phone number, first and last name, and the city, postal code and country of delivery, hashed with SHA-256, plus, if you are signed in, your customer-account ID, also hashed. Details are in the Cookie Policy.

For the collection of data through the Meta Pixel and the Conversions API and its transmission to Meta, we and Meta Platforms Ireland Ltd. are joint controllers (Art. 26 GDPR) under Meta's Controller Addendum (facebook.com/legal/controller_addendum); Meta alone is responsible for any further processing, as described in its Privacy Policy (facebook.com/privacy/policy). Meta and Google may transfer data to Meta Platforms, Inc. and Google LLC in the USA; both companies are certified under the EU–US Data Privacy Framework, for which the European Commission has adopted an adequacy decision.

5. Retention periods

• Accounting and tax documents — 10 years as required by law;
• Account data — until you delete your account;
• Marketing consent — until you withdraw it;
• Technical data for the Meta Conversions API kept with an order (IP address, browser user agent, page address and the _fbp/_fbc identifiers) — at most 8 days;
• Analytics and advertising cookies — for the periods stated in the Cookie Policy (about 90 days for the Meta Pixel).

6. Your rights

As a data subject you have the right to:

• access your personal data;
• rectify inaccurate data;
• erasure (the “right to be forgotten”);
• restrict processing;
• data portability;
• object to processing based on legitimate interest;
• withdraw consent at any time.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. To withdraw your consent to analytics or advertising cookies, click “Cookie settings” at the bottom of any page and choose “Decline all”, or untick the category under “Settings” and save your choice.

7. Right to complain

You have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP) — Sofia, 2 Prof. Tsvetan Lazarov Blvd., or online at www.cpdp.bg.

8. Data security

We apply appropriate technical and organisational measures to protect your data. Card details are never stored with us — they are processed in a secure environment by myPOS.

9. Changes to this policy

We may update this policy from time to time. The current version is always available on this page with its last-updated date.