bg en
Elesiart — Handmade craft and art

Privacy policy

Draft for review by a lawyer. Last updated: 15.10.2026.

This policy explains what personal data we collect when you browse and order from elesiart.com, why we collect it and what rights you have. We process your data in line with the General Data Protection Regulation (GDPR) and the Bulgarian Personal Data Protection Act.

Data controller

„Елеса“ ЕООД, company number (EIK) 205416727, гр. Казанлък, ул. „23-ти Пехотен Шипченски полк“ № 82. For questions about personal data: [email protected], 0988 23 2001.

What we collect and why

  • Orders: your name, email, phone number, delivery address or chosen Econt office/locker, order note and IP address — to fulfil your order, call you to confirm it and send you emails about it (Art. 6(1)(b) GDPR).
  • Consent for digital content: the date on which you gave consent under Art. 57(13) of the Consumer Protection Act and the number of times the file was downloaded — to show how the contract was performed (Art. 6(1)(b) and (c) GDPR).
  • Accounting and tax: order and payment details — to meet our legal obligations (Art. 6(1)(c) GDPR).
  • Preventing misuse: your IP address and, in cases of uncollected parcels or other misuse, your phone number, email and name in a list used to decline new orders automatically — based on our legitimate interest (Art. 6(1)(f) GDPR).
  • Regular customers: we keep your order history and mark regular customers so that we do not need to call them about every order — legitimate interest (Art. 6(1)(f) GDPR).
  • Analytics: Google Analytics 4 — only if you click “Accept” in the cookie banner (Art. 6(1)(a) GDPR). See the Cookie Policy for details.

There are no customer accounts, and we do not send newsletters or marketing emails. We never receive or store payment card details.

Who we share it with

  • Econt Express — your name, phone number and address or office, to deliver the parcel;
  • Brevo — your email address and order details, to send the order emails;
  • First Investment Bank (Fibank) — for card payments, to process the payment;
  • Google — visit data, only if you have consented to analytics. Google may process this data outside the European Union, subject to the safeguards required by the GDPR;
  • the hosting provider whose servers run the shop, and our accountant — only as far as their work requires;
  • public authorities — only where the law requires it.

We do not sell personal data or share it for advertising.

How long we keep it

  • order and payment data — for as long as accounting and tax law requires;
  • entries in the misuse-prevention list — for as long as there are grounds for them; you can ask us to review an entry;
  • Google Analytics data — up to 14 months;
  • your choice in the cookie banner — 6 months, in your browser.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, and to object to processing based on legitimate interest. You can withdraw your consent to analytics at any time via “Cookie settings” in the website footer; this does not affect the lawfulness of processing before the withdrawal.

To exercise your rights, email us at [email protected]. We will reply within one month.

If you believe your rights have been infringed, you can lodge a complaint with the Bulgarian Commission for Personal Data Protection (cpdp.bg).