Privacy policy

In short

• We collect only what we need to answer you and to prepare, deliver and invoice your order.
• We do not sell your data, send marketing messages or use advertising or analytics trackers on this website.
• You can ask us at any time to see, correct or delete your data. Details are below.

Who we are

ПРАЯ 25 ООД (UIC 208300037) ("we", "Torti OMea") decides why and how the personal data described in this policy is used (the "controller"). You can reach us at +359 87 957 400, tortiomea@gmail.com or Production workshop, Lyulin 5 MR.

What this policy covers

This policy applies to this website and to enquiries and orders you send us by phone, email, the contact form or in person. It explains what data we collect, why, how long we keep it and what rights you have under the General Data Protection Regulation (GDPR) and Bulgarian law.

It does not cover other websites that we may link to or that link to us, such as social media pages. Please read their own policies.

How we receive your data

Mostly directly from you: when you call us, write to us, use the contact form or collect an order. Our web server also records some technical data automatically when you visit. If someone orders a cake for you as a gift, we receive your details from them (see "Data about other people").

What we collect, why and on what basis

• Contact form and emails: your name, email address, telephone number (optional) and your message. We use them to answer your enquiry. Basis: our legitimate interest in replying, or steps you ask for before an order (GDPR Art. 6(1)(f) and (b)).
• Orders by phone, email or in person: the details you give us, such as name, telephone number, delivery address, the cakes and date you want, and any wording you ask us to put on a cake. We use them to confirm, prepare, deliver or hand over your order. Basis: performing our contract with you (Art. 6(1)(b)).
• Payment: we arrange payment with you when we confirm the order. This website does not take card payments and does not see or store card details. Whatever payment record the law requires (for example an invoice or receipt) is kept for accounting. Basis: legal obligation (Art. 6(1)(c)).
• Accounting and tax records: documents about orders and payments that we must keep by law. Basis: legal obligation (Art. 6(1)(c)).
• Complaints and returns: what you tell us and how we resolved it. Basis: our contract and our legitimate interest in handling and documenting complaints (Art. 6(1)(b) and (f)).
• Defending legal claims: where needed, we keep records to establish, exercise or defend a legal claim. Basis: legitimate interest (Art. 6(1)(f)).
• Technical data: like any website, the server that delivers these pages may record your IP address, browser type and the pages requested. We use it for security and to keep the site running. Basis: legitimate interest (Art. 6(1)(f)).

Data about other people

If you give us someone else's details, for example a recipient's name, address or telephone number for a gift delivery, please make sure they know you are doing so. We use that data only to deliver the order. Please do not send us sensitive information (such as health details) unless it is needed for the order, for example an allergy you want us to take into account. In that case we use it only for your order.

What stays in your browser

The list of cakes you add on the order page, and your language choice, are stored only in your own browser. They are not sent to us. You can remove them by clearing this site's data in your browser settings.

This website does not use advertising or analytics cookies and does not load fonts, scripts or trackers from other companies. Your cookie choice is also stored only in your browser. You can change it at any time with "Cookie settings" in the footer. See our Cookie policy for details.

Who we share it with

We do not sell your data. We share it only with those who need it to run the service, and only for that purpose:

• Service providers that act on our instructions under a data processing agreement, namely Cloudflare, Inc. (website hosting), Zoho (business email) and FormSubmit (formsubmit.co), which forwards contact-form messages to our email.
• Couriers or drivers, where someone other than us delivers your order (name, address, telephone number).
• Our accountant and professional advisers, bound by confidentiality.
• Public authorities, courts or other bodies where the law requires or allows it, for example tax authorities.

Transfers outside the European Union

Some of our service providers may process data outside the European Economic Area. Where that happens we rely on a safeguard recognised by EU law, such as an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework for certified companies) or standard contractual clauses. You can ask us for details of the safeguard that applies.

How long we keep it

• Enquiry messages: for as long as needed to deal with them and any follow-up, normally no longer than one year after the last contact.
• Order details (name, contact and delivery details): while we fulfil the order and afterwards for up to five years, the general period in which claims arising from a contract may be brought.
• Accounting and tax documents: for the periods set by the Accountancy Act and tax law.
• Complaints: until the complaint is settled, plus the period in which it could be challenged.
• Server logs: only for a short period needed for security.
• After these periods we delete or anonymise the data. If a legal claim is pending we keep what is needed until it is resolved.

Marketing and automated decisions

We do not send newsletters or promotional messages. If we ever want to, we will ask for your separate consent first and you will be able to withdraw it at any time. We do not make decisions about you by purely automated means and we do not profile you.

Children

This website is not aimed at children. Under Bulgarian law a person must be at least 14 to give consent to the use of their data online. If you are younger, please ask a parent or guardian to contact us for you. If we learn that we hold data of a child without proper consent we will delete it.

How we protect your data

We use measures suited to the risk: the website is delivered over an encrypted (HTTPS) connection, access to personal data is limited to people who need it for their work, and we require our providers to protect data under a written agreement. If a breach is likely to put your rights at risk we will notify you and the supervisory authority as the law requires.

Your rights

You have the right to:

• ask whether we process your data and get a copy of it (access);
• have inaccurate data corrected or incomplete data completed;
• have your data erased where we no longer need it or have no lawful basis to keep it;
• restrict how we use your data in certain cases;
• object to processing based on our legitimate interest;
• receive data you gave us in a common, machine-readable format, where we process it by automated means on the basis of contract or consent (portability);
• withdraw consent at any time, where we rely on consent. This does not affect what we did before.

To use any of these rights, write to tortiomea@gmail.com or call +359 87 957 400. We will answer within one month. If your request is complex or we receive many, we may extend this by up to two further months and will tell you why. We may need to confirm your identity first. Exercising your rights is free unless a request is clearly unfounded or excessive.

Right to complain

If you believe we have handled your data unlawfully, please tell us first so we can put it right. You may also complain to the Commission for Personal Data Protection (КЗЛД), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg, or to the authority in your own EU country, or take the matter to court.

Changes

We may update this policy. The date at the top shows when it last changed. If we make a significant change, for example start using your data for a new purpose, we will tell you in good time before it applies.