Privacy Policy | CBD Shop

1. Who processes your data

The data controller is the company (registration in progress), which operates the online shop cbdshop.bg.

Company number: to follow. Correspondence address: to follow. Email: info@cbdshop.bg. Phone: +359 00 000 0000.

We have not appointed a data protection officer — the scale and nature of our processing does not require one. Write to the address above with any question.

The company is being registered. As soon as it is entered in the register, the company number and registered address will be published here and on the Contacts page.

2. What we collect and on what basis

We collect only what an order cannot be fulfilled without, plus anything you have given us consent for.

Data	Purpose	Legal basis	Retention
Name, phone, email, delivery address	Fulfilling the order, delivery, contacting you	Performance of a contract — Art. 6(1)(b) GDPR	5 years from the order (limitation period for claims)
Order and payment records	Accounting and tax reporting	Legal obligation — Art. 6(1)(c) GDPR	10 years under the Bulgarian Accountancy Act
Newsletter email	News and offers	Consent — Art. 6(1)(a) GDPR	Until consent is withdrawn
Account email and password	Access to your account and order history	Performance of a contract	Until the account is deleted
Product review	Publishing the review on the product page	Consent given when the review is submitted	Until withdrawn or deleted

3. Do you have to give us your data

Delivery and contact details are necessary to enter into and perform the contract. Without them we cannot accept an order.

The newsletter and an account are optional. Declining them does not affect your ability to buy.

4. Who we share it with

We do not sell or rent personal data. We pass it only to the providers the shop cannot run without, and only as far as needed:

courier companies (Econt, Speedy, BOX NOW) — name, phone and delivery address;
the hosting and infrastructure provider;
our accountants — invoice data;
public authorities, where the law obliges us.

5. Transfers outside the EU

We aim to keep data inside the European Economic Area. Where a provider processes data outside the EEA, it happens only under a European Commission adequacy decision or standard contractual clauses under Art. 46 GDPR.

6. Your rights

Under the GDPR you have the right:

of access to the data we hold about you (Art. 15);
to rectification of inaccurate data (Art. 16);
to erasure — the "right to be forgotten" (Art. 17);
to restriction of processing (Art. 18);
to portability — to receive your data in a machine-readable format (Art. 20);
to object to processing based on legitimate interest (Art. 21);
to withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.

Requests go to info@cbdshop.bg. We answer within one month of receipt.

7. Right to complain

If you believe we process your data unlawfully, you may lodge a complaint with the supervisory authority:

Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, tel. +359 2 915 3 518, kzld@cpdp.bg, www.cpdp.bg.

8. Automated decision-making

We do not carry out automated decision-making or profiling that produces legal effects for you or similarly significantly affects you.

9. Security

The connection to the site is encrypted (HTTPS). Access to data is limited to those who need it for their work. Passwords are stored only in irreversible form — we cannot see them and cannot recover them.

10. Changes to this policy

When something material changes we publish the new version here and update the date at the top. If the change affects processing based on your consent, we will ask for that consent again.