Who Processes Your Personal Data
This Privacy Policy governs the processing of personal data in connection with the use of the website soSofia.com, including when registering, placing orders, submitting enquiries, subscribing to the newsletter, and using the functionalities of the online shop.
The data controller is Association GID – Urban Ideas and Design, UIC/BULSTAT BG176978226, with its registered office and address at: BULGARIA, Sofia 1000, Sredets district, 3 Han Krum Street, Floor 3. For any questions relating to personal data, you may contact us at zdravei@sosofia.com.

What Data We Process
Depending on how you use the website, we may process the following categories of data: names, telephone number, email address, delivery and billing address, information about orders placed, payment details, correspondence, IP address, device and browser data, cookies, and data relating to behaviour on the website.
As a rule, we do not require special categories of personal data. Please do not send us sensitive data unless this is necessary and required by law.

For What Purposes and on What Legal Basis We Process Data
We process personal data for the purposes of accepting and fulfilling orders, delivering goods, issuing accounting documents, processing payments, communicating with customers, handling complaints, exercising the right of withdrawal, improving the security and functioning of the website, and sending marketing communications where we have a valid legal basis to do so.
The legal bases may include: performance of a contract or taking steps prior to entering into a contract; compliance with a legal obligation; legitimate interests; and consent, where this is required.

Data Required for an Order
When placing an order through the online shop, certain data is mandatory in order for us to conclude and perform the contract – for example, name, telephone number, email address, delivery address, chosen delivery method, and payment method.
Failure to provide the required data may make it impossible to accept or fulfil the order.

Recipients of Personal Data
We may disclose data to courier companies, payment service providers, hosting providers, IT support providers, accounting and legal advisers, and marketing and analytics providers where this is necessary for the provision of the services or for compliance with legal obligations.
Where we use external processors of personal data, we require them to implement appropriate security measures and to process the data only in accordance with our instructions.

Payments
Payments by card or through external payment services are processed by the relevant payment provider. We do not store full bank card details unless this is expressly described in the payment process and carried out subject to the appropriate security measures.
For accounting and tax purposes, we process data from payment documents to the extent required by the applicable legislation.

Retention Periods
We retain personal data for the period necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.
Data relating to orders, accounting documents, and accompanying correspondence may be retained for the periods prescribed by tax, accounting, and consumer protection legislation. Data processed on the basis of consent is retained until such consent is withdrawn or the purpose no longer applies.

Your Rights
You have the right to access your personal data, the right to rectification, erasure, restriction of processing, objection to processing, the right to data portability, and the right to withdraw any consent given at any time where processing is based on consent.
You also have the right to lodge a complaint with the Commission for Personal Data Protection if you believe that your rights have been infringed.

Cookies and Similar Technologies
The website uses cookies and similar technologies for proper functioning, security, traffic measurement, remembering preferences, and, where applicable, for marketing purposes. Detailed information is provided in the separate Cookies Policy.
Non-essential cookies are activated only after the relevant consent has been obtained, where such consent is required.

Transfers of Data Outside the EEA
As a rule, we seek to process data within the European Union and the European Economic Area. If we use providers outside the EEA, we will apply an appropriate mechanism for lawful transfer, such as standard contractual clauses and supplementary measures where necessary.

Security
We implement reasonable technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised access, or disclosure.
Nevertheless, no system is completely secure, and we cannot guarantee absolute invulnerability.

Children
The website is not intended for persons under 18 years of age without the involvement of a parent or legal representative. If we become aware that we have received a child’s personal data in breach of the applicable rules, we will take steps to delete it.

Contact Details
You may exercise your rights or send any questions to zdravei@sosofia.com.

Changes to This Policy
We reserve the right to update this policy in the event of changes to the legislation, the website’s functionalities, or the way in which data is processed. The current version is published on the website with the effective date indicated.