Legal
Privacy Policy
What personal data we handle, why, how long we keep it, and the rights you have over it.
Last updated:
1. Who is responsible for your data
The data controller is VireonLabs EOOD, reg. no. 208907603. Our contact details are below. We are not required to appoint a data protection officer and have not appointed one: we are not a public authority, our business does not involve large-scale systematic monitoring of people, and we do not process special categories of data on a large scale (Article 37 GDPR). Write to the email address below with any question about your data and we will answer it ourselves.
2. No accounts, no tracking
This site has no user accounts — you do not register or create a password in order to buy. We load no analytics, advertising or tracking services, and we do not profile visitors. Exactly what we record when you order or write to us is set out in the next section.
3. What we collect
When you place an order we record the recipient’s name, phone number, email address, the delivery address or the courier office or parcel locker you chose, the note you left with the order if you left one, the items ordered with quantities and prices, the weight of the parcel, any promotional code used, the amount to pay, the status of the order and the history of changes to it, the waybill number, and whether the courier has collected and remitted the cash-on-delivery amount. When you write to us through the contact form we process your name, email address and the content of your message. If we ever record a consent from you for a separate purpose, we keep the email address, the purpose, the date, the version of this policy and the IP address it was given from, so that we can show when and for what it was given. We do not accept card payments, so no card details are collected anywhere.
4. Why we process it, and on what legal basis
To perform a contract with you (Art. 6(1)(b) GDPR) for orders and delivery; to comply with legal obligations (Art. 6(1)(c)) for accounting and tax records; with your consent (Art. 6(1)(a)) for marketing messages, which you may withdraw at any time; and for our legitimate interests (Art. 6(1)(f)) in securing the site and preventing fraud.
5. Who we share it with
We use the following processors: Vercel Inc. (USA) for hosting the site, with requests served from its Frankfurt, Germany region; Neon Inc. (USA) for the order database, stored in region eu-central-1, Frankfurt, Germany; Resend (USA) for sending order confirmations and contact-form enquiries, through region eu-west-1, Ireland; ImprovMX Incorporated (USA) for forwarding mail sent to contact@55candles.com to our mailboxes, and Google (USA) as the provider of those mailboxes; and Econt Express OOD (Bulgaria) for delivery. The courier receives the name, the address or chosen office, the phone number and the amount to collect — as much as it needs to hand the parcel over to you. We do not sell your data and we do not make it available for anyone else’s advertising.
6. Transfers outside the EEA
Your orders and this site are stored and served inside the European Union, in Frankfurt, Germany. The companies that provide our hosting, database, email sending and email forwarding are, however, incorporated in the United States, and their staff may access the data while supporting those services. To the extent that this is a transfer outside the EEA, it rests on the European Commission’s standard contractual clauses and, for providers certified under the EU–US Data Privacy Framework, on the Commission’s adequacy decision. You can request a copy of the clauses at the email address below.
7. How long we keep it
Orders and the documents belonging to them are kept for 5 years from the end of the year in which the order was completed — the period for which Bulgarian tax law may ask for them. Accounting records and financial statements are kept for 10 years, as the Accountancy Act requires. Contact-form messages are kept for up to 12 months after the conversation ends. Consent records are kept while the consent stands and for 3 years after it is withdrawn, so that we can show when and for what it was given. Once those periods expire the data is deleted.
8. Your rights
You may ask us for a copy of your data, correct it, have it deleted, restrict or object to how we use it, receive it in a portable form, and withdraw any consent you gave. Write to us using the details below and we will respond within one month. You may also complain to the Commission for Personal Data Protection (Комисия за защита на личните данни, cpdp.bg).
9. Security
The site is served over HTTPS with a content security policy and other protective headers. The database is encrypted at rest, the connection to it is required to be encrypted, and its provider takes backups that allow restoring to a point in time. Orders are visible only through a password-protected admin panel: the session is a signed cookie that scripts cannot read, is sent only over HTTPS, and expires by itself. Only the shop’s two owners have access to that panel and to the mailboxes. No card details exist anywhere in the system, because we do not accept card payments.
10. Automated decisions
We do not carry out automated decision-making or profiling that has a legal effect on you.
Trader identification
- Trader
- VireonLabs EOOD (ВиреонЛабс ЕООД)
- Reg. No.
- 208907603
- VAT No.
- Not VAT-registered
- Registered address
- р-н Студентски, ж.к. Малинова долина, ул. „Еньо Вълчев“ 1А, 1734 София, Bulgaria
- contact@55candles.com
- @55candles.bg
- Supervisory authority
- Commission for Consumer Protection kzp.bg