Privacy Policy

Last updated:

1. Who Is Responsible for Your Personal Data?

The controller of personal data processed in connection with the Adventure-shop.bg online store is „Иновативен Къмпинг“ ЕООД (Inovativen Kamping EOOD) , Unified Identification Code (UIC): 204190240, with its registered office and business address at: 46 Neofit Rilski Street, Sredets District, Sofia, Bulgaria .

For questions about personal data or to exercise your rights, you can contact us at info@adventure-shop.bg or at the address above.

In this policy, “we”, “us”, and “the Company” refer to Inovativen Kamping EOOD.

2. What Does This Policy Cover?

This policy explains what personal data we process when you use the store, create an account, order products, or communicate with us. It describes why we need the data, who may receive it, and what rights you have.

We process personal data in accordance with the General Data Protection Regulation — Regulation (EU) 2016/679 (GDPR), the Bulgarian Personal Data Protection Act, and applicable Bulgarian and European legislation.

This policy is provided for information. Reading it or using the store does not constitute blanket consent to all types of personal data processing.

3. What Data Do We Process?

3.1. Order and Delivery Data

  • The customer's and recipient's first and last names.
  • Contact telephone number and email address.
  • Delivery address or selected courier collection point.
  • Products ordered, selected sizes and variants, quantities, prices, and applied discounts.
  • Order number, date, and status, delivery method, and information about receipt of the order.

3.2. Payment and Invoicing Data

  • Selected payment method, amount paid, payment status, and transaction identifier where provided by the payment service provider.
  • Information needed to issue an invoice, where applicable: company name or individual name, address, and relevant identification details.
  • Bank account details and account holder's name where necessary for an agreed refund by bank transfer.

Information about a legal entity is not, in itself, personal data. However, information about its representative, contact person, or a sole trader may constitute personal data.

Do not send full payment card numbers, card security codes, passwords, or one-time verification codes by email or through contact forms.

[Before publication: identify the actual card payment provider, explain how payments are processed and what payment data the store receives, and add a link to the provider's privacy policy.]

3.3. Customer Account Data

When you create an account, we process the registration information you provide and the information necessary to sign in and manage the account. Depending on the available features, this may include saved addresses, order history, and a wishlist.

3.4. Correspondence, Returns, and Product Complaints

When you contact us, we process your contact details, the content of your message, and any attachments you provide. For returns or product complaints, this may include purchase information, a description of the issue, product photographs, and proof of payment.

Please provide only the information necessary to handle your request. You do not need to send health information or copies of identity documents unless a specific need and legal basis have been explained in advance.

3.5. Technical Data and Cookies

When you use the website, technical data may be processed, such as your IP address, the date and time of a request, the requested URL, browser type, device information, and error or security event logs. The precise scope depends on the website and hosting service configuration.

Details of the cookies observed, their purposes, and their observed lifetimes are provided in the separate Cookie Policy. A cookie's lifetime does not automatically determine how long related data is retained in other systems.

3.6. Newsletter and Marketing Preferences

If a newsletter subscription is available and you choose to subscribe, we process your email address, the preferences you provide, and the information necessary to record your consent and any subsequent unsubscribe request.

Making a purchase or creating an account does not automatically subscribe you to a newsletter.

4. Where Do We Obtain the Data?

We usually obtain data directly from you through an order, account registration, enquiry, or other communication with the store. Technical data may be generated when you use the website.

We may also receive information from couriers or payment service providers about delivery, payment, or a refund.

If someone else places an order naming you as the recipient, we may receive your name, telephone number, and address from that person to arrange delivery. The person providing this information should have a valid basis for doing so. Where applicable, we provide the information required by Article 14 GDPR within the prescribed time limits.

5. Why Do We Process Data and on What Legal Basis?

Purpose Legal Basis
Processing orders, payments, and deliveries Taking steps at your request before entering into a contract and performing the contract — Article 6(1)(b) GDPR.
Creating and maintaining a requested account Providing the service you requested — Article 6(1)(b) GDPR, to the extent that processing is necessary for that service.
Invoicing, accounting, and tax obligations Compliance with legal obligations — Article 6(1)(c) GDPR.
Contract withdrawals, product complaints, and refunds Performance of a contract and compliance with applicable legal obligations — Articles 6(1)(b) and 6(1)(c) GDPR, depending on the particular activity.
Responding to enquiries Taking pre-contractual steps or performing a contract where the enquiry concerns a purchase. For other enquiries, our legitimate interest in responding and managing correspondence — Article 6(1)(f) GDPR.
Security and prevention of misuse Our legitimate interest in protecting the website, customers, and information systems — Article 6(1)(f) GDPR, following an assessment of necessity and the balance with your rights.
Establishing, exercising, and defending legal claims Our legitimate interest in protecting our legal rights — Article 6(1)(f) GDPR, or an applicable legal obligation.
Newsletter and consent-based marketing Your separate consent — Article 6(1)(a) GDPR.
Delivery to someone other than the buyer and communication with business customer representatives Our legitimate interest in fulfilling the order and communicating with the designated individuals — Article 6(1)(f) GDPR, while respecting their rights.

If we plan to process data for another purpose, we provide the necessary additional information before that processing begins and ensure that an applicable legal basis exists.

6. Do You Have to Provide the Data?

Information required for an order, delivery, payment, and mandatory documentation is necessary to perform the contract or comply with a legal obligation. Without it, we may be unable to process your order or the relevant request.

Optional fields and marketing preferences are provided voluntarily. Declining a newsletter subscription does not prevent you from making a purchase.

7. Who May Receive Your Data?

Depending on the services selected and the particular need, data may be shared with:

  • Couriers and logistics partners for delivery, returns, and related communication.
  • Banks and payment service providers for payments, transaction verification, and refunds.
  • Hosting providers and parties maintaining the store and its information systems.
  • Email service providers and, where used, a newsletter platform.
  • Accounting and legal advisers where necessary for the relevant activity.
  • Repair service providers, suppliers, or manufacturers where data is necessary to handle a particular product complaint.
  • Competent public authorities where disclosure is required by law or by a lawful request.

We share only the data necessary for the relevant purpose. Where a provider processes data on our behalf, the relationship is governed in accordance with Article 28 GDPR.

Some recipients, such as certain banks or couriers, may process data as independent controllers for their own legally defined purposes. Their role depends on the particular service.

[Before publication: confirm the categories and providers actually used. Specify the couriers, payment provider, hosting provider, email service, and newsletter platform, if applicable.]

8. Transfers Outside the EEA

Using external services may involve data being stored in or accessed from countries outside the European Economic Area. This depends on the provider, its subprocessors, and the service configuration.

Where such a transfer takes place, it must comply with Chapter V GDPR — for example, through an applicable adequacy decision or appropriate safeguards, including standard contractual clauses and supplementary measures where necessary.

You can request information about the applicable safeguards and how to obtain a copy of them by contacting info@adventure-shop.bg.

[Before publication: specify any identified international transfers, including the provider, destination country, and applicable transfer mechanism. If no such transfers occur, state this after checking the providers and their subprocessors.]

9. How Long Do We Keep the Data?

Retention periods are determined by the purpose, applicable legal obligations, and the need to defend legal claims. We do not apply one common retention period to all data.

  • Orders and contractual relationships: for fulfilling the order and subsequent obligations, and thereafter only the data necessary for applicable statutory retention periods and the defence of legal claims.
  • Accounting and tax documents: for the periods required by applicable accounting and tax legislation, depending on the document type.
  • Customer accounts: for as long as necessary to provide the requested service, subject to the adopted retention period for inactive accounts. Closing an account does not automatically erase documents we must retain separately.
  • Enquiries: until the correspondence is concluded and for a justified subsequent period where necessary for customer service or the defence of legal claims.
  • Product complaints and disputes: until their final resolution and the expiry of applicable retention and legal claim periods.
  • Newsletter subscriptions: until you unsubscribe or the service is discontinued. Minimal information about an unsubscribe request may be retained to respect your choice and prevent unwanted messages.
  • Consent records: to the extent necessary to demonstrate compliance and defend related claims.
  • Technical logs and backups: for a limited period determined by their purpose, the risks, and the actual system configuration.
  • Cookies: according to the lifetimes described in the Cookie Policy.

When there is no longer a basis for retention, data is deleted or anonymised. Where a dispute or legal obligation exists, the necessary data may be retained with restricted access until that need ends.

[Before publication: adopt specific retention periods or sufficiently precise criteria for inactive accounts, general enquiries, technical logs, consent records, and backups. These must reflect the Company's actual configuration and internal procedures.]

10. Marketing Communications

Where newsletter messages are sent on the basis of consent, that consent is requested separately and can be withdrawn at any time.

You can unsubscribe using the option provided in the message or by writing to info@adventure-shop.bg.

Unsubscribing does not stop communications necessary to fulfil an order, arrange delivery, handle a product complaint, or comply with a legal obligation. These communications do not depend on a newsletter subscription.

You have the right to object at any time to processing for direct marketing, including related profiling. Following such an objection, your data will no longer be processed for those purposes.

11. Automated Decisions and Profiling

Saving favourite or recently viewed products does not, in itself, demonstrate the existence of an automated decision that produces legal or similarly significant effects on you.

[Before publication: confirm whether profiling, personalised pricing, or solely automated decisions with significant effects are used, including through external services. If they are not used, state this. If they are used, describe the purpose, data, legal basis and, where applicable, the logic involved, significance, consequences, and the option to obtain human intervention.]

12. How Do We Protect the Data?

We implement appropriate technical and organisational measures, taking into account the nature of the data and the risks to the individuals concerned.

Access is granted according to work-related needs. Our measures and relationships with providers are subject to review in light of the systems and services used.

No system can provide an absolute guarantee of security. In the event of a personal data breach, we take action in accordance with the law, including notifying the supervisory authority and affected individuals where the relevant requirements are met.

13. What Rights Do You Have?

  • Access: to obtain information about whether we process your personal data and receive a copy of it.
  • Rectification: to request correction of inaccurate data or completion of incomplete data.
  • Erasure: to request deletion where the legal conditions are met. This right is not unconditional, for example where retention is necessary for a legal obligation or legal claims.
  • Restriction: to request restricted processing in the circumstances provided by law.
  • Data portability: to receive the data you have provided in a structured, commonly used, machine-readable format where processing is automated and based on consent or a contract.
  • Objection: to object, on grounds relating to your particular situation, to processing based on legitimate interests.
  • Withdrawal of consent: at any time where processing is based on consent, without affecting the lawfulness of processing carried out beforehand.
  • Protection regarding automated decisions: the rights under Article 22 GDPR, where applicable.
  • Complaint and judicial remedy: to contact a supervisory authority or the competent court.

14. How Can You Exercise Your Rights?

Send your request to info@adventure-shop.bg or to Inovativen Kamping EOOD, 46 Neofit Rilski Street, Sredets District, Sofia, Bulgaria.

Please explain what you are requesting and provide enough information for us to identify the data concerned. Where we have reasonable doubts about your identity, we may request additional information necessary to verify it. We do not automatically require a copy of an identity document.

We respond without undue delay and normally within one month of receiving the request. Where necessary, due to the complexity or number of requests, this period may be extended by a further two months. We will inform you of the extension and the reasons within the first month.

Exercising your rights is generally free of charge. For manifestly unfounded or excessive requests, the law permits a reasonable fee or refusal where the relevant conditions are met. If we refuse a request, we explain the reasons and the available means of redress.

15. Complaints to a Supervisory Authority

If you believe that the processing of your personal data infringes applicable requirements, you can lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP):

Current methods and requirements for submitting a complaint are published on the Commission's website. The telephone number is provided for contact; complaints must be submitted according to the procedure published by the CPDP. You do not have to contact us first to exercise your right to lodge a complaint.

16. Changes to This Policy

We update this policy when our activities, the services we use, or applicable legislation change. The date of the latest revision is shown at the beginning.

We provide appropriate information about material changes according to their nature. Where new consent is required, we request it separately. Publishing a new version does not constitute your consent.