Privacy Policy

PRIVACY POLICY

Last updated: 26/11/2025

  1. Who We Are

1.1. This Privacy Policy explains how we collect, use, and protect your personal data when you:

  • visit our website valtasasar.com (the “Website”);
  • shop through our online store (the “E-shop”);
  • book an appointment for a showroom visit or bespoke tailoring services;
  • use embedded content (Instagram, Google Maps, etc.);
  • use payment methods such as card, Apple Pay, and Google Pay;
  • use the Website’s multilingual and currency features.

1.2. Contact details:

“VALTASASAR APPAREL GARDEN” Ltd.
Registered office and address: 22 Banat Street, Lozenets District, Sofia 1407, Bulgaria
UIC: 206487474
Email: office@valtasasar.com
Phone: +359 999 99 26 99

1.3. We process personal data in accordance with:

  • Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR); and
  • the Bulgarian Personal Data Protection Act.
  1. Scope of the Policy

2.1. This Policy applies when you:

  • visit or use the Website;
  • place orders via the E-shop;
  • create and use a customer account;
  • book appointments through the integrated booking system (TheBooking);
  • send inquiries or messages via contact forms or email;
  • complete forms for product availability notifications or updates;
  • view our Instagram feed embedded on the Website;
  • are subject to security mechanisms such as Google reCAPTCHA;
  • participate in analytics via Google Analytics;
  • use multilingual functionality (WPML) and dual pricing in BGN and EUR;
  • view the showroom location via Google Maps;
  • log in or register using third-party accounts (Google or Facebook);
  • view embedded video players (including YouTube, Vimeo, or self-hosted videos).

2.2. This Policy does not apply to third-party websites or services accessible via links or embedded elements. These are governed by their own privacy policies.

  1. Categories of Personal Data We Process

Depending on your interaction with us, we may process the following categories of data:

3.1. Identification and contact data

  • name and surname;
  • email address;
  • phone number;
  • billing and delivery address;
  • country of residence.

3.2. Customer account data

  • username;
  • encrypted/hashed password;
  • preferences (e.g. language, default address).

3.3. Orders, transactions, and pricing

  • ordered products;
  • selected sizes;
  • submitted custom measurements in the product fields;
  • order number, order history, payment status;
  • billing details;
  • prices in BGN and EUR (based on the fixed exchange rate 1 EUR = 1.95583 BGN).

3.4. Measurement and bespoke data

  • body measurements;
  • custom lengths, fit preferences;
  • notes from consultations or fittings.

3.5. Booking and service data

  • appointment date/time/type;
  • requested services;
  • booking form details;
  • possible calendar synchronization (e.g. Google Calendar via TheBooking).

3.6. Payment and Invoicing Data

  • Payment method used (card, Apple Pay, Google Pay, etc.); (WooCommerce)
  • Transaction ID and payment status;
  • Partial payment method data (for example, masked card number), when provided by the payment provider;
  • We do not receive or store full card numbers or security codes – they are processed by WooPayments, Stripe, and the respective Apple Pay/Google Pay providers.

3.7. Technical and User Data

  • IP address;
  • Browser type and version;
  • Device type and operating system;
  • Visited pages, time spent, navigation;
  • Traffic source (referrer);
  • Error logs and other technical information;
  • Language settings and currency preferences (for example, via WPML and the BGN/EUR pricing plugin).

3.8. Cookies and Analytics Data

  • Cookies necessary for the functioning of the website and store (cart, session, reservations, security);
  • Analytics cookies (for example, Google Analytics); (Google Policies)
  • Security cookies (for example, Google reCAPTCHA).

3.9. Data from Embedded Content and Social Networks

  • When viewing our Instagram feed element – Instagram/Meta may receive your IP address and data about your browser and the page you are viewing;
  • When Google Maps loads on the “Contacts” page – Google may process your IP address, browser data, and location-related information.

3.10. Correspondence Data

  • Content of messages sent by you (via forms or email);
  • Submitted complaints, reports, inquiries;
  • Metadata (date and time of messages).

3.11. Data from Contact Forms and Notification Forms

  • Name and surname (if you choose to provide them);
  • Email address and/or phone number;
  • The product or topic for which you express interest;
  • Content of your message or request;
  • Date and time of sending.

We use this data to respond to your inquiry and, when you have explicitly requested, to notify you when the corresponding product becomes available or when we publish new information about it.

3.12. Data from social login (Google, Facebook)
If you choose to use social login, the corresponding provider (e.g., Google or Facebook) may provide us with certain information from your profile, such as:

  • name and surname;
  • email address;
  • Profile ID and/or unique identifier;
  • Profile picture (avatar), when this is permitted;
  • Technical data required for authentication (e.g., access token).

We do not receive or store your social media password. We use this information only to create and manage your customer profile and to facilitate the login process.

3.13. Data from video playback (YouTube, Vimeo, self-hosting)
When you view or play videos on our Website:

  • For self-hosted videos, our hosting provider may process your IP address and technical data as part of normal web traffic;
  • For videos from YouTube, Vimeo, and other similar platforms, the respective providers may process your IP address, approximate location, device and browser data, information about which videos you watch, and may place cookies or similar technologies for analytical and, under certain conditions, advertising purposes.

We do not intentionally process personal data of persons under 16 years of age without proper consent from a parent/guardian.

  1. Purposes and legal grounds for processing

We process personal data only when there is a valid legal ground under Article 6 GDPR. The main purposes and legal grounds are:

4.1. Functioning of the Website and E-shop

  • Providing access to the Website and its functionalities;
  • enabling navigation and basic interactions;
  • ensuring security, availability, and integrity of IT systems.

Legal ground: our legitimate interest in maintaining a secure and functional website (Article 6, §1, item “f” GDPR).

4.2. Processing of orders and delivery of goods

  • accepting, confirming, and fulfilling your orders;
  • manufacturing clothing based on the selected size and individual lengths;
  • organizing transportation and delivery;
  • issuing invoices and processing payments.

Legal ground:

  • performance of a contract or taking steps at your request prior to entering into a contract (Article 6, §1, item “b” GDPR);
  • compliance with legal obligations (tax, accounting, etc.) (Article 6, §1, item “c” GDPR).

4.3. Management of customer profiles

  • creating and maintaining your profile;
  • providing access to order history, invoices, and saved data.

Legal ground: performance of a contract (Article 6, §1, item “b” GDPR).

4.4. Appointment reservation and bespoke services

  • management of reservations through a plugin
  • scheduling and providing showroom visits and bespoke services;
  • recording measurements and preferences when necessary.

Legal ground: performance of a contract or pre-contractual relationship (Article 6, §1, item “b” GDPR).

4.5. Multilanguage and display of prices in BGN/EUR

  • displaying content in your selected language or according to browser settings (WPML);
  • displaying prices in lev and euro using the official exchange rate 1 EUR = 1.95583 BGN and applying the legal rules for conversion and rounding.

Legal ground:

  • our legitimate interest in providing a convenient multilingual and euro-compatible website (Article 6, §1, item “f” GDPR);
  • compliance with legal requirements related to the introduction of the euro and dual price labeling (Article 6, §1, item “c” GDPR).

4.6. Customer service and correspondence

  • responding to your inquiries, complaints, or requests;
  • providing pre-sale and post-sale service.

This also includes inquiries submitted through the contact forms on the Website.

Legal ground:

  • performance of a contract or pre-contractual relationship (Article 6, §1, item “b” GDPR);
  • our legitimate interest in ensuring quality service (Article 6, §1, item “f” GDPR).

4.7. Analysis and improvement of services

  • analyzing how visitors use the Website (Google Analytics and others);
  • optimizing the structure, content, user experience, and product portfolio. (Google Policies)

Legal ground:

  • Your consent for using non-strictly necessary analytical cookies (Article 6, §1, item “a” GDPR);
  • in a limited volume – our legitimate interest for basic statistics (Article 6, §1, item “f” GDPR).

4.8. Security and fraud prevention

  • Protection of the Website and store against attacks, bots, and abuse (Google reCAPTCHA, logs, fraud checks from payment providers); (Google Policies)
  • Detection and prevention of fraudulent transactions.

Legal ground:

  • our legitimate interest to protect our IT systems and business (Article 6, §1, item “f” GDPR);
  • fulfillment of legal obligations related to security and fraud prevention (Article 6, §1, item “c” GDPR).

4.9. Marketing messages

  • if you subscribe to our newsletter or marketing messages, we use your contact data to send you information about products, promotions, and events.

Legal basis: Your consent (Article 6, §1, item “a” GDPR). You can withdraw it at any time via the “unsubscribe” link if available or by contacting us.

4.10. Legal obligations and claims

  • compliance with accounting, tax, and consumer requirements;
  • processing of complaints, warranties, and legal claims;
  • protection and enforcement of our rights and legitimate interests.

Legal ground:

  • fulfillment of legal obligations (Article 6, §1, item “c” GDPR);
  • our legitimate interest to protect our rights (Article 6, §1, item “f” GDPR).

4.11. Product availability notifications

  • to send you one or more notifications about the specific products you requested to be informed about (for example, when a product is launched for sale or when substantial new information about it is published).

Legal basis: Your consent (Article 6, §1, item “a” GDPR), expressed through actively filling out and submitting the form. You can withdraw your consent at any time via the “unsubscribe” link in the respective message if available or by contacting us.

4.12. Social login (Google, Facebook)

  • to allow you to create and access a profile on the Website using your existing login data from Google or Facebook;
  • to facilitate authentication and reduce the need to remember additional usernames and passwords.

Legal basis: performance of a contract or pre-contractual relations (Article 6(1)(b) GDPR), since social login is an alternative way to access your profile, and our legitimate interest in providing a secure and convenient authentication mechanism (Article 6(1)(f) GDPR). Separately, your relationship with Google and Facebook is governed by their own privacy policies and terms of service.

4.13. Displaying video content (YouTube, Vimeo, self-hosting)
– to display multimedia content (for example, product videos, lookbook videos, behind-the-scenes footage) on the Website;
– to improve the presentation of our products and services.

Legal basis: our legitimate interest to present our products in an attractive and informative manner (Article 6, §1, item “f” GDPR) regarding self-hosted videos; and for embedded third-party players that place non-strictly necessary cookies or use the data for their own analytics/advertising purposes – your consent (Article 6, §1, item “a” GDPR), collected via the cookie banner or a similar mechanism, before loading the player, when required by law.

  1. Cookies and similar technologies

5.1. The Website uses cookies and similar technologies for:

  • core functionalities (cart, login, reservations, security);
  • remembering your preferences (language, currency);
  • collecting anonymous statistical data (analytics);
  • displaying embedded content (Instagram, Google Maps, etc.).

5.2. Types of cookies:

  • Strictly necessary cookies – needed for the proper functioning of the website and store;
  • Preference cookies – remember your choices (e.g., language preferences);
  • Analytical cookies – used by Google Analytics or similar tools;
  • Marketing/third-party cookies – placed by embedded elements like Instagram or Google Maps; Video content platforms such as YouTube and Vimeo may set cookies and process personal data when their players are embedded in our Website; these cookies are activated upon your consent, when required by law.

5.3. Upon your first visit (and periodically thereafter), we may show you a cookie banner through which you can choose whether to accept or decline the use of non-strictly necessary cookies. You can change your preferences at any time through your browser settings or, when available, through our cookie management tool.

  1. Sharing personal data with third parties

We share personal data with third parties only to the extent necessary and under conditions of confidentiality and security.

6.1. Hosting and IT providers

We use hosting providers, IT support, and security services that act as personal data processors on our behalf.

6.2. Plugins

We use various plugins for specific functionalities, including but not limited to:

  • a plugin for displaying prices in BGN and EUR;
  • a plugin for displaying and managing the online store (WooCommerce);
  • a plugin for managing reservations and integration with Google Calendar (Thebooking);
  • a plugin for multilingual support and storing language preferences via cookies (WPML).

6.3. Payment providers

For card payments, Apple Pay, and Google Pay, we use WooPayments and its associated providers (Stripe), as well as the respective services of Apple and Google. (WooCommerce)

They receive your payment data and may share it with banks, card organizations, and fraud prevention systems. We do not store full card numbers on our servers.

6.4. Courier and logistics companies

To fulfill delivery of your orders, we provide couriers (Econt, Speedy, FedEx/TNT, DPD, or other similar ones) with the minimum necessary data:

  • name and surname;
  • delivery address;
  • phone number and/or email;
  • shipment/order number and description of contents, when required (e.g., for customs or tracking).

The data is used solely for the purpose of transportation, delivery, and, when necessary, customs procedures.

6.5. Analytical and protective services

  • Google Analytics – may process the address and data on website usage for statistical purposes; (Google Policies)
  • Google reCAPTCHA – analyzes user behavior to distinguish humans from bots.

These services are provided by Google and are governed by its Privacy Policy. (Google Policies)

6.6. Social networks and embedded content

  • when viewing our Instagram feed – Instagram/Meta may process your personal data as an independent controller;
  • when viewing embedded video content from YouTube, Meta/Instagram, Vimeo, and other similar providers;
  • when loading Google Maps – Google may process your IP address, browser data, and location-related information as an independent controller.

We do not control how these providers process your data; please review their policies.

6.7. Professional consultants and authorities

When necessary, we may provide data to:

  • accountants, auditors, lawyers;
  • tax authorities, courts, law enforcement authorities, and supervisory authorities (including the CCBD).

6.8. Social login providers (Google, Facebook)
When you use social login, the respective provider verifies your identity and shares limited data from your profile with us, as described above. At the same time, this provider may receive information that you have logged into our Website or interacted with our content. Google and Facebook act as independent controllers regarding this processing; please review their privacy policies for more information.

6.9. We do not sell your personal data.

  1. Data transfer outside the EEA

7.1. Some providers (Google, Meta, Stripe, WPML, and others) may transfer personal data outside the European Economic Area, including to the USA.

7.2. In such cases, we strive to ensure appropriate safeguards, such as:

  • standard contractual clauses;
  • other GDPR mechanisms.

7.3. You can contact us for more information about the specific measures for the respective transfers.

  1. Retention periods for personal data

We retain personal data for as long as necessary for the purposes above or to comply with legal requirements.

Approximate periods:

8.1. Order and invoice data

  • at least 10 years after the end of the relevant financial year, to fulfill our obligations under Bulgarian accounting and tax legislation regarding the retention of invoices and financial documents.

8.2. Customer account data

  • for the period during which the profile is active;
  • upon request for deletion – the minimum data we are legally required to keep (e.g., invoices) is retained until the expiration of the respective periods.

8.3. Reservation and event data

  • for the duration of the service provision and the statutory warranty period (up to 2 years from delivery) and as long as legal claims can be enforced (up to 5 years), plus any potentially longer legal periods.ods.

8.4. Correspondence data

  • while it is necessary for processing the corresponding inquiry and for a reasonable additional period (up to 3 years), especially if they are relevant for potential legal claims.

8.5. Data from contact forms and notification forms

  • Data from contact forms is stored as long as necessary for processing the corresponding inquiry and for a reasonable additional period (up to 3 years), especially when relevant to potential legal claims.
  • Data used solely for sending product availability notifications is stored until you withdraw your consent or request deletion. Periodically, we may delete older requests related to products we no longer plan to offer.

8.6. Analytical data

  • stored in aggregated or pseudonymized form; the period is determined in the analytics tool settings and is as short as possible, consistent with our needs.

After the expiration of the relevant periods, the data is deleted or irreversibly anonymized, unless a longer retention is required by law or for the protection of our rights.

  1. Security of personal data

9.1. We apply appropriate technical and organizational measures to protect personal data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

9.2. Such measures include, where appropriate:

  • secure hosting and limited access to the servers;
  • role-based access models (access only to what is necessary);
  • use of HTTPS/SSL;
  • regular updates and patches for WordPress, WooCommerce, and plugins;
  • backup copies and monitoring of system logs.

9.3. However, no online service can guarantee absolute security. You are responsible for keeping your password confidential and for protecting your own devices.

  1. Your GDPR Rights

Under the GDPR and applicable national law, you have the following rights:

10.1. Right of Access – To obtain confirmation whether we are processing your personal data and to receive a copy of it.

10.2. Right to Rectification – To request the correction of inaccurate or incomplete data.

10.3. Right to Erasure (“Right to Be Forgotten”) – To request the erasure of your personal data under certain conditions (for example, when it is no longer necessary, when you withdraw your consent, or when the processing is unlawful).

10.4. Right to Restrict Processing – To request restriction of processing in certain cases (for example, while we verify the accuracy of the data or the basis for an objection).

10.5. Right to Data Portability – To receive the personal data you have provided in a structured, widely used, and machine-readable format, and to request its transfer to another controller, where technically feasible.

10.6. Right to Object – To object at any time to processing based on our legitimate interest (including profiling), as well as to processing for the purposes of direct marketing.

10.7. Right to Withdraw Consent – When processing is based on your consent (for example, for newsletters or analytics cookies), you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

To exercise these rights, contact us at office@valtasasar.com. We may request additional information to verify your identity.

  1. Right to Lodge a Complaint with a Supervisory Authority

11.1. If you consider that your rights regarding the protection of personal data have been violated, you have the right to file a complaint with the competent supervisory authority, particularly in the country of your usual place of residence, place of work, or place where the alleged violation occurred.

11.2. In Bulgaria, the competent supervisory authority is:

Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592, Bulgaria
Phone: +359 2 915 3580
Email: kzld@cpdp.bg
Website: www.cpdp.bg

We would be glad to have the opportunity to resolve the matter directly with you first, so we invite you to contact us before filing a complaint with the CPDP.

  1. External Websites and Services

12.1. The Website may contain links to other websites or services (for example, social media networks, payment pages, package tracking, maps). We are not responsible for their content or data processing practices.

12.2. We recommend that you review the privacy policies of the respective providers, including in particular:

  • Google (including YouTube, Google Analytics, reCAPTCHA, Google Maps); (Google Policies)
  • Meta/Instagram;
  • Vimeo and other similar providers of embedded content;
  • Stripe, WooPayments, and other payment providers; (WooCommerce)
  • the courier companies that deliver your packages.
  1. Changes to This Policy

13.1. We may periodically update this Policy, for example to reflect changes in legislation, our services, or the technologies we use.

13.2. The updated version will be published on the Website with a revised “Last updated” date. We recommend that you review the Policy periodically.

13.3. In the event of material changes that significantly affect your rights, we may also provide more detailed notice (for example, via email or a notice on the Website).

This notice is intended to inform you about the rules we apply when collecting and processing information about you. It sets out the conditions under which we may process any information that we collect from you or that you provide to us. This includes both information that can identify you (“personal data”) and information that does not allow identification. “Processing” means any operation or set of operations performed on such information, such as collection, recording, storage, organization, modification, disclosure to third parties, erasure, and others.

By accessing and using this Website, you confirm that you have read this Privacy Policy and agree to its terms. If you do not agree with any of its provisions, you should immediately discontinue use of the Website and leave it.