PRIVACY POLICY

This English text is a translation provided for information only. The legally binding version is the Bulgarian one; in the event of any discrepancy, the Bulgarian text prevails.

1. GENERAL PROVISIONS

This Privacy Policy sets out how "VELOK 03" EOOD collects, uses, stores and protects the personal data of users of the website lapora.bg, in accordance with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act (PDPA).

The policy applies to all users of lapora.bg, regardless of the product category or collection they browse or buy.

Data controller:

2. WHAT PERSONAL DATA WE COLLECT

We collect only the personal data necessary for the specific purposes of processing (the data minimisation principle under Art. 5 GDPR):

• Full name
• Email address
• Phone number
• Delivery address
• IP address
• Website usage data (cookies and behaviour) — only with consent

We do not store payment data — it is processed directly by Stripe (a licensed payment operator).

Providing personal data is voluntary but necessary to fulfil an order. If the mandatory data (names, address, email) is not provided, the contract cannot be concluded and performed. The phone number is provided voluntarily.

3. PURPOSES AND LEGAL BASIS FOR PROCESSING

Personal data is processed on the following legal bases under Art. 6 GDPR:

• Performance of a contract (Art. 6(1)(b)) — processing and fulfilling orders, communicating with customers, arranging delivery
• Legal obligation (Art. 6(1)(c)) — accounting and tax purposes (VAT Act, Accountancy Act)
• Legitimate interest (Art. 6(1)(f)) — traffic analysis and website security; applied only where the interest does not override the data subject's rights and has passed a balancing test
• Consent (Art. 6(1)(a)) — marketing, remarketing and behavioural profiling through cookies (Facebook Pixel, Google Analytics); may be withdrawn at any time without consequences

4. SHARING OF PERSONAL DATA

Personal data may be provided to the following categories of recipients:

• Courier companies — only the data needed to carry out delivery (names, address, phone)
• Stripe, Inc. — payment operator (payment processing); we do not store payment data
• Shopify International Ltd. — online store management platform (order data and customer accounts)
• Google LLC (Google Analytics) — website traffic analysis; only with consent to analytics cookies
• Meta Platforms Ireland Ltd. (Facebook Pixel) — behavioural remarketing profiling; only with consent to marketing cookies
• Accounting services — to meet legal obligations (minimum amount of data)
• Marketing and analytics platforms — only with express consent

We do not sell or provide personal data to third parties for their own commercial purposes.

5. TRANSFERS OUTSIDE THE EU/EEA

When the services of Shopify, Stripe, Google and Meta are used, data may be processed outside the European Economic Area (EEA). Transfers take place subject to appropriate safeguards under Art. 46 GDPR:

• Standard Contractual Clauses (SCCs) approved by the European Commission — applicable to Shopify, Google LLC and Meta Platforms
• European Commission adequacy decision (Art. 45 GDPR) — where applicable
• Stripe — certified under the EU-US Data Privacy Framework

Specific safeguards by provider:

📌 For information on the specific safeguards for transfers, contact us at lapora@abv.bg.

6. COOKIES

The website lapora.bg uses cookies. On the first visit, a consent banner is shown that meets the following requirements:

• No non-functional cookies are loaded before express consent (active opt-in)
• The "Accept all" and "Reject all" buttons are equally visible — the same size, colour and font
• The user can easily withdraw consent at any time through the site's cookie settings

7. RETENTION PERIODS

8. PROFILING AND AUTOMATED DECISION-MAKING

The company carries out limited profiling for marketing purposes (behavioural remarketing targeting through Facebook Pixel and Google Ads), exclusively on the basis of the user's express consent. The profiling does not produce legal effects and does not similarly significantly affect the user.

We do not carry out solely automated decision-making within the meaning of Art. 22 GDPR that produces legal effects or otherwise significantly affects the user.

Rights in relation to profiling:

• You can withdraw consent to marketing cookies at any time through the site settings or by email to lapora@abv.bg
• You have the right to object to profiling for direct marketing purposes at any time (Art. 21(2) GDPR) — without needing to give a reason

9. DATA SECURITY

We apply appropriate technical and organisational measures to protect personal data, including SSL/TLS encryption, access control and regular security reviews.

In the event of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, you will be notified without undue delay in accordance with Art. 34 GDPR.

10. RIGHTS OF DATA SUBJECTS

Under Art. 15–22 GDPR you have the following rights:

• Right of access (Art. 15) — to receive information about and a copy of the data processed
• Right to rectification (Art. 16) — correction of inaccurate data
• Right to erasure — the "right to be forgotten" (Art. 17) — under certain conditions
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object to processing (Art. 21(1)) — where processing is based on legitimate interest
• Absolute right to object to direct marketing and profiling for marketing purposes (Art. 21(2) GDPR) — without needing to give a reason and without balancing of interests
• Right to withdraw consent (Art. 7(3)) — at any time, without affecting the lawfulness of prior processing

Requests should be sent to: lapora@abv.bg

Response time: up to 30 days (which may be extended by up to 3 months in complex cases — Art. 12(3) GDPR).

11. RIGHT TO LODGE A COMPLAINT WITH THE CPDP

Mandatory information under Art. 13(2)(d) GDPR

You have the right to lodge a complaint with the personal data protection supervisory authority:

12. CHANGES TO THE PRIVACY POLICY

For non-material changes (technical or editorial), users will be notified by a notice on the website.

For material changes affecting the purposes of processing, the legal bases or the categories of recipients, users will be notified by email at least 7 days before the changes take effect.

For changes requiring new or additional consent (e.g. new marketing purposes), processing on the basis of that consent will begin only after its express confirmation has been received.

📌 Continuing to use the site is NOT deemed acceptance of material changes to the policy.

"VELOK 03" EOOD | UIC: 207603437 | VAT No.: BG207603437 | lapora.bg | Last updated: [DD.MM.2026]