Privacy Policy
This Privacy Policy explains how ДУНДИН БРАДЪРС ЕООД ("we", "us") collects, uses and protects your personal data when you visit this website and use the services offered through it. It is prepared in line with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Bulgarian data-protection law.
1. Who processes your data
The data controller is:
- Legal entity: ДУНДИН БРАДЪРС ЕООД
- EIK (company reg. no.): 207919920
- Address: с. Присово
- Email: info@zealotsofnature.bg
- Phone: +359 88 428 00 95
For any question about your personal data, contact us at the email above.
2. What data we collect
Depending on how you use the site, we may process the following categories of data:
- Contact data — name, phone, email and the content of the message you send us through the contact form.
- Technical data — IP address, browser and device type, pages visited. Collected automatically to keep the site secure and working correctly.
- Order and delivery data — name, phone, email, delivery address (street, city, post code), the products you order and your chosen payment method.
- Company invoice data — if you request an invoice for a company with your order, we process the company name, EIK (company registration number) and, optionally, the VAT number, the accountable person (MOL) and the registered address, so we can issue the invoice as required by tax law.
- Courier delivery data — when you choose courier delivery, we pass your name, phone, address and (for cash on delivery) the amount due to the courier so a shipping label can be issued and the parcel tracked.
- Abandoned-cart data — if you have given marketing consent, we keep your email and the contents of your basket so we can send you up to three reminders if you do not complete your order. Every such email contains an unsubscribe link, and unsubscribing stops all future reminders.
- Product personalisation data — where a product offers personalisation, we process the image and/or text you upload in the editor so we can produce the item you order, plus a small preview of the finished design that stays with your order.
- Conversation data — the messages you send to our chat assistant and its replies.
- Account data — if you create an account, we process your name, email, phone and saved delivery addresses, plus an encrypted (hashed) password. We keep a record of your last sign-in and of the products you mark as favourites. If you sign in with Google or Facebook, we receive your email and basic profile data from them to create or find your account.
- Newsletter data — if you subscribe to our newsletter, we process your email and (optionally) your name to send you news and offers. You can unsubscribe at any time via the link in every email.
- Reviews — the name and text of a testimonial you have agreed for us to publish.
We do not knowingly collect special categories of data (sensitive data) and ask that you do not send them to us through free-text fields.
3. Why we use your data and on what basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Answering enquiries and providing the services you request | Performance of a contract or pre-contractual steps — (b) |
| Meeting accounting and tax obligations | Legal obligation — (c) |
| Keeping the site secure and preventing abuse | Legitimate interest — (f) |
| Maintaining your account, favourites and sign-in security | Legitimate interest — (f) |
| Reminder for an unfinished order (abandoned cart) | Consent (marketing) — (a) |
| Sending the newsletter and marketing messages | Consent — (a) |
| Analytics and marketing cookies | Consent — (a) |
4. Cookies and analytics
The site uses a small set of first-party cookies and similar technologies (localStorage), listed below. Strictly necessary ones require no consent - the site cannot function without them. Everything else is used only after you consent via the cookie banner; you can withdraw or change your choice at any time via the cookie settings.
| Name | Purpose | Category | Duration |
|---|---|---|---|
zh_cookie_consent_v1 |
stores your cookie-banner choices | strictly necessary | 12 months |
zh_account |
keeps you signed in to your customer account | strictly necessary | 30 days |
zh_oauth_nonce |
one-time security check when signing in with Google/Facebook | strictly necessary | 10 minutes |
| cart (localStorage) | remembers the contents of your cart on this device | strictly necessary | until you clear your browser |
| newsletter (localStorage) | remembers that you subscribed or dismissed the newsletter prompt | strictly necessary | until you clear your browser |
zh_attribution |
remembers the ad campaign that brought you here (utm/fbclid) so your order can be attributed to it | marketing (only after consent) | 30 days |
_fbp, _fbc (Meta Pixel) |
advertising-effectiveness measurement by Meta Platforms Ireland | marketing (only after consent) | up to 90 days |
Where you have given marketing consent, we use the Meta Pixel and Conversions API: we share hashed data (email, phone, name, city, post code), your IP address and the _fbp/_fbc cookie identifiers with Meta Platforms Ireland to measure advertising.
5. Who we share data with
We share data only with providers that help us run the site and deliver the services, and only to the extent needed:
- ZweiHost — the platform that hosts and operates this site, acting as a data processor under a data processing agreement (GDPR Art. 28).
- Amazon Web Services (Amazon SES) — email delivery (confirmations and notifications, the newsletter and marketing messages).
- Cloudflare — hosting, content-delivery network, and secure storage of files and images.
- Railway — hosting of the backend and of the database in which this site's data is stored (European Union, Amsterdam).
- Sentry (Functional Software, Inc.) — technical error tracking and diagnostics. It receives only technical data about the error that occurred; direct identifiers are stripped before sending.
- AI service provider — processes messages sent to the assistant in order to generate replies.
- Meta Platforms Ireland Ltd. — advertising measurement via the Meta Pixel and Conversions API (only with marketing consent). Shared data is transmitted hashed, except the IP address.
- Stripe — processes card payments. Card details are entered directly with the payment provider — we neither receive nor store them. We also accept cash on delivery and bank transfer.
- Couriers (e.g. Econt, Speedy) — handling delivery: issuing the shipping label, tracking and cash on delivery. Only the data needed for delivery is shared.
- Public authorities — where required by law.
6. Transfers outside the EU/EEA
Some of our providers may process data outside the European Economic Area. Where they do, the transfer is protected by an adequacy decision or by the European Commission's Standard Contractual Clauses.
7. How long we keep your data
| Category | Retention |
|---|---|
| Contact-form messages | up to 12 months |
| Orders and delivery details | for the period required by accounting law |
| Abandoned-cart data | up to 90 days |
| Personalisation uploads — order not completed | up to 7 days |
| Personalisation uploads — with an order | the original — 90 days after the order; a small design preview and its description — with the order |
| Assistant conversations | up to 90 days |
| Account data | until you delete your account or request erasure |
| Newsletter subscription data | until you unsubscribe |
| Accounting documents | 10 years (legal requirement) |
| Consent records and server logs | up to 12 months |
8. How we protect your data
We apply appropriate technical and organisational measures — encryption in transit (HTTPS), access controls and working only with reputable providers. No method of transmission or storage is completely secure, but we take reasonable steps to protect your data.
9. Your rights
In relation to your personal data you have the right to:
- access your data and obtain a copy;
- have inaccurate data corrected;
- have your data erased ("right to be forgotten");
- restrict the processing;
- data portability;
- object to processing based on legitimate interest;
- withdraw any consent at any time, without affecting prior processing.
To exercise your rights, write to us at info@zealotsofnature.bg. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), cpdp.bg. Even where you request erasure, we must retain invoices and accounting records for the period required by tax law, after which we delete them.
10. Children
The site is not directed at children under 14 and we do not knowingly collect their personal data. If you believe we have received a child's data, please contact us so we can delete it.
11. Automated decision-making
We do not carry out automated decision-making that produces legal effects concerning you. The chat assistant generates replies automatically but does not make decisions with legal effects — you can always reach a person at info@zealotsofnature.bg.
12. Changes to this Policy
We may update this Policy. The current version is always available on this page, and we will notify you through the site of any material changes.