Privacy policy

• Name and phone number — to confirm your order and call you if anything needs clarifying.
• Order details — occasion, date and time, theme and inscription, filling, number of servings, price and deposit.
• Delivery address — only if you ask for delivery.
• A photo — only if you choose to send one, for example as an idea for the decoration.
• Technical data — your IP address and browser type, which every website receives when you connect to it.

Your name and phone number are required — we cannot accept an order without them. Everything else depends on the order or is up to you. We do not store card details.

If you tell us about an allergy or intolerance, we use that information only to prepare your order safely.

• Handling your order — to accept, prepare and deliver it and to contact you about it. Legal basis: our contract with you, and steps taken at your request before entering into it (Art. 6(1)(b) GDPR).
• Accounting and tax — to issue and keep the records the law requires. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Website security — to protect the site from abuse and fix technical problems. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
• Allergies and intolerances — only to prepare your order safely. Legal basis: your explicit consent, given when you tell us (Art. 9(2)(a) GDPR).
• Reviews on this site — we show customer reviews only with the customer's consent (Art. 6(1)(a) GDPR). If you find your review and would like it removed, let us know.

We do not sell your data, use it for advertising or make automated decisions about you.

• Our team — each member of staff sees only what their job needs — the driver, for example, sees the delivery address.
• Supabase — our database and photo storage. The data is kept in data centres in Frankfurt, Germany.
• Hetzner Online — the server the website runs on, in Falkenstein, Germany.
• Our accountant — only the data in accounting records.
• Public authorities — only when the law requires it.

Technical service providers process data only on our instructions and under a contract with us. Your data stays in the European Union. Supabase is a US company; if its staff access the data from the US, the transfer is protected by the European Commission's standard contractual clauses.

A photo you send is stored under a long random name and opens only at its exact address, which only the staff working on your order can see.

• Orders — 3 years after the order is fulfilled — for questions, complaints or a repeat order.
• Requests that did not become an order — 12 months.
• Photos — as long as the order they were sent with.
• Accounting records — 10 years, as the Bulgarian Accountancy Act requires.
• Technical data — up to 30 days.

After that we delete the data or anonymise it so it can no longer be linked to you.

This site uses no cookies for tracking, statistics or advertising, and loads no outside services — even the fonts come from our own server. Your browser may keep a copy of the site's files (a cache) so it opens faster; it contains no personal data.

The links to Facebook, Instagram and Google Maps open those services only when you tap them. From then on, their own privacy policies apply.

• Access — to find out what data we hold about you and get a copy.
• Rectification — if anything is inaccurate or incomplete.
• Erasure — when we no longer need the data, unless the law requires us to keep it (accounting records, for example).
• Restriction — to pause processing while a question is resolved.
• Portability — to receive the data you gave us in a machine-readable format.
• Objection — to processing based on our legitimate interest.
• Withdrawing consent — at any time, without affecting what was done before.

To exercise your rights, call us on +359 884 584 422, visit the shop at 5 Dostoevski St., or write to our registered office. We may ask you to confirm your identity. We reply free of charge within one month.

If you believe we process your data unlawfully, you can complain to the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg. We would be glad if you spoke to us first — most questions are settled in one conversation.

The site works only over a secure connection (HTTPS). Staff sign in with personal accounts and see only what their role requires.

If we change this policy, we will publish the new version on this page with a new date.