Privacy Policy
How we collect, use and protect your personal data, in line with the GDPR and the Bulgarian Personal Data Protection Act.
1. Who is responsible for your data
The controller is IT Blacksmiths, Street Arda, 4000 Plovdiv, Bulgaria. Our data protection enquiries are handled by the same team: itblacksmiths@gmail.com.
2. What we collect
Data you give us
When you place an order you provide your name, delivery address, billing address, e-mail address and phone number, together with the products you ordered and the amount paid. If you create an account we additionally store your password in encrypted form and your order history. If you write to us through a contact form, subscribe to the newsletter or leave a comment, we store the message, your e-mail address and any other information you choose to include.
Data we collect automatically
When you visit the shop, our servers log technical information such as your IP address, the pages you visited, the referring page, the browser and device you use, and the date and time of your visit. This data is used to keep the site running, to detect abuse and to understand how the shop is used. The details are described further in our Cookie Policy.
3. Why we use it and on which legal basis
| Purpose | Legal basis |
|---|---|
| Processing your order, payment, delivery and handling returns | Performance of a contract (Art. 6(1)(b) GDPR) |
| Answering your questions and customer support | Performance of a contract and legitimate interest (Art. 6(1)(b) and (f) GDPR) |
| Keeping the site secure, preventing fraud and abuse | Legitimate interest (Art. 6(1)(f) GDPR) |
| Storing your account and order history | Performance of a contract (Art. 6(1)(b) GDPR) |
| Analytics of how the shop is used | Legitimate interest, or consent where required (Art. 6(1)(f) / (a) GDPR) |
| Advertising and remarketing measurement | Consent (Art. 6(1)(a) GDPR) |
| Newsletter and promotional e-mails | Consent (Art. 6(1)(a) GDPR) |
| Meeting tax, accounting and consumer protection obligations | Legal obligation (Art. 6(1)(c) GDPR) |
4. Who we share it with
We share your data only with service providers that help us run the shop, and only to the extent needed:
- Fulfilment partners — the warehouses that pick, pack and dispatch your order. They receive the delivery address and contact details required for the shipment.
- Payment provider — the provider that processes card payments. It receives the payment data and the minimal order details needed to confirm the transaction.
- Hosting, e-mail and technical providers — they host the website, send transactional e-mails and keep the site secure.
- Advertising and social platforms — Google Ads, Reddit, Snapchat, TikTok and Pinterest receive advertising identifiers in order to measure campaigns. Where the law requires it, this happens only with your consent.
- Authorities — where we are legally obliged to disclose information.
We do not sell your personal data and we do not share it for third-party advertising purposes.
5. International transfers
Some of our service providers are established outside the European Economic Area, including the warehouses that fulfil orders and the platforms that run our advertising campaigns. Where your data is transferred outside the EEA, we use appropriate safeguards such as the European Commission's standard contractual clauses, and we limit the transferred data to what is strictly necessary.
6. How long we keep it
Order data is kept for as long as needed to fulfil your order and to meet tax and accounting obligations, and afterwards for the period required to handle any warranty or return claim. Data from a newsletter subscription is kept until you unsubscribe. Data collected only for analytics is kept in aggregated form and deleted once it no longer serves its purpose. When data is no longer needed, we delete or anonymise it.
7. Your rights
You have the right to:
- obtain confirmation of whether we process your data and access a copy of it;
- have inaccurate or incomplete data corrected;
- have your data erased, where the legal grounds allow it;
- restrict the processing of your data in the cases provided by law;
- receive your data in a portable, machine-readable format;
- object to processing based on legitimate interest, and to direct marketing at any time;
- withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of the processing carried out before withdrawal.
How to exercise your rights
Write to itblacksmiths@gmail.com. We will answer within one month. If you are not satisfied with our response, you have the right to lodge a complaint with the Bulgarian Personal Data Protection Commission (КЗЛД) or with the data protection authority in your country of residence.
8. Security
The website is served over HTTPS, passwords are stored in encrypted form, and access to customer data within the company is limited to the people who need it to do their job. No method of transmission or storage is completely risk-free, but we continuously apply technical and organisational measures appropriate to the risk.
9. Automated decisions
We do not use automated decision-making, including profiling, that produces legal effects for you or significantly affects you. Advertising platforms may build their own audience profiles for campaign measurement, which they control independently of us.
10. Children
Our shop is not directed at children, and we do not knowingly collect data from persons under 16. If you believe a child has provided us with personal data, contact us and we will delete it without delay.
11. Changes to this policy
We update this policy when our processes or the legal requirements change. The version published on this page applies from the moment it is published.
12. Contact
Any questions about your personal data: itblacksmiths@gmail.com or the contact form.
Questions about your data?
Write to us and we will answer within one month — usually much sooner.