Privacy notice

This notice explains what personal data we collect through kittydream.eu, why, on what legal basis, who we share it with, how long we keep it, and what rights you have.

1. Who is responsible for your data

The data controller is:

Data Protection Officer (DPO): we have not appointed one. Our activity does not fall within Art. 37 GDPR — we carry out neither large-scale systematic monitoring nor large-scale processing of special categories of data.

2. What data we collect, and from where

We collect only what we need. We do not buy data from third parties.

When you place an order (required so we can deliver): first and last name · e-mail address · telephone · city · delivery address · country · order notes, if you fill the field in · the contents and value of the order · the payment method chosen (cash on delivery).

The “Notes” field is free text. Use it for delivery instructions — for example which Speedy office the parcel should go to. Please do not put data in it that the delivery does not need (for example health information or a national ID number).

When you write to us through the contact form: name · e-mail · telephone (optional) · your message.

When you subscribe to the newsletter: e-mail address and the date you subscribed.

When you post a review: the name you entered · subtitle (optional) · rating · review text · any images you upload. If you are signed in, the review is also linked to your account.

If you create an account: first and last name · e-mail address · password (stored only as an irreversible hash) · profile picture, if you upload one · two-factor authentication settings, if you enable them.

Automatically, when you use the site: technical data needed for the site to work — a session identifier, your language preference, your IP address and the standard web-server records (date and time of the request, the address requested, the response code, the browser type). Details are in the Cookie policy.

We do not collect or store payment card data, because payment is cash on delivery to the courier.

3. Why we process your data, and on what basis

Purpose	Data	Legal basis (GDPR)
To accept, fulfil and deliver your order, and to write to you about it	order and delivery data	Art. 6(1)(b) — performance of a contract
To handle a withdrawal, return, complaint or exchange	order data, correspondence	Art. 6(1)(b) and (c)
To issue and keep accounting and tax documents	order and payment data	Art. 6(1)(c) — Accountancy Act, VAT Act
To keep the register of complaints	complaint data	Art. 6(1)(c) — чл. 47 ЗПЦСЦУПС
To reply to a contact-form message	name, e-mail, telephone, message	Art. 6(1)(f) — legitimate interest; where it concerns an order, (b)
To send you the newsletter	e-mail address	Art. 6(1)(a) — your consent
To display your review on the product page	name, rating, text, images	Art. 6(1)(a) — your consent
To maintain your account and sign-in	account data	Art. 6(1)(b)
To keep the site working and protected from abuse	technical data, server records	Art. 6(1)(f) — security and availability

Providing the delivery data is necessary for us to conclude and perform the contract. If you do not provide it we cannot accept the order. Everything else is voluntary.

We do not take automated decisions producing legal effects for you, and we do not carry out profiling. We do not individualise prices on the basis of automated decision-making.

4. Who we share data with

We share data only with those who need it, and only as much as they need. We do not sell or rent data to third parties for marketing.

Recipient	What they receive	Role
Speedy AD, UIC 131371780, 22 Abagar St., Sofia 1138 — courier	name, telephone, delivery address/office, cash-on-delivery amount, parcel notes	independent controller for the postal service
Titan Solution Ltd SEZC (Cayman Islands) — provider of the Titan e-mail service for the kittydream.eu domain; order confirmation e-mails pass through it	e-mail address, delivery name, address and telephone, and the order contents, to the extent they appear in the e-mail	processor · also processes outside the EU/EEA — see section 5
Contabo GmbH (Germany) — server hosting	all data stored in the site	processor · the server is located in France (EU)
Accountant / accounting firm	accounting and tax documents	processor
Public authorities (revenue agency, КЗП, КЗЛД, courts, law enforcement)	only where legally required or lawfully requested	independent controllers

We have an Art. 28 GDPR agreement with each processor.

5. Transfers outside the EU/EEA

The server the shop runs on is located in France, and the hosting provider is a German company. The courier is established in Bulgaria. For these services no data is transferred outside the EU/EEA.

One exception — the e-mail service. Order confirmation e-mails are sent through Titan, provided by Titan Solution Ltd SEZC, registered in the Cayman Islands (registered office: c/o CO Services Cayman Limited, P.O. Box 10008, Willow House, Cricket Square, Grand Cayman, KY1-1001). These e-mails contain your name, delivery address, telephone and the contents of your order, so sending them involves processing outside the European Union.

There is no European Commission adequacy decision for the Cayman Islands under Art. 45 GDPR. The transfer is therefore made on the basis of Art. 46 GDPR — appropriate safeguards in the form of standard contractual clauses adopted by the European Commission, under the provider’s Data Processing Addendum.

If we introduce analytics or advertising tools in future, we will update this section before they go live.

6. How long we keep data

Data	Period
Orders, delivery addresses, order correspondence	5 years from fulfilment — the general limitation period under чл. 110 ЗЗД
Accounting records and financial statements, including tax-control documents	10 years from 1 January of the reporting period following the one they relate to — чл. 12 of the Accountancy Act
Register of complaints	5 years
Contact-form messages	12 months from the last correspondence, if they do not lead to an order
Newsletter e-mail address	until you withdraw consent; after that we keep only the fact of unsubscription
Published review	while the product is offered, or until you ask for it to be removed
Account	while you keep it; on deletion we erase the account data but retain order data for the periods above
Web-server records	30 days

After the period expires the data is deleted or anonymised.

7. Your rights

You have the right:

• of access — to know whether we process your data and to receive a copy (Art. 15);
• to rectification of inaccurate or incomplete data (Art. 16);
• to erasure (“to be forgotten”) (Art. 17) — this does not extend to data we are required by law to keep, such as the accounting documents for your order;
• to restriction of processing (Art. 18);
• to data portability — to receive your data in a machine-readable format (Art. 20);
• to object to processing based on legitimate interests (Art. 21);
• to withdraw consent at any time where processing is based on consent. Withdrawal is as easy as giving consent and does not affect the lawfulness of processing before it (Art. 7(3));
• not to be subject to a decision based solely on automated processing (Art. 22) — we take no such decisions.

How to exercise them: write to hello@kittydream.eu. We reply within one month of receiving the request. For complex or numerous requests the period may be extended by two further months, and we will tell you. The service is free; for manifestly unfounded or excessive requests we may charge a reasonable fee or refuse.

We may ask you to confirm your identity if we have reasonable doubt about who is making the request.

For the newsletter: every message contains an unsubscribe link. You can also simply write to us.

8. Right to complain

If you believe we are breaching data protection rules, you have the right to lodge a complaint with the supervisory authority:

Commission for Personal Data Protection (КЗЛД)
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
E-mail: kzld@cpdp.bg · Website: www.cpdp.bg

You also have the right to a judicial remedy. We would be glad if you wrote to us first — we usually resolve things faster.

9. Security

The site runs over HTTPS. Access to the admin area is restricted and password-protected, and passwords are stored only as an irreversible hash. Only the people who need it in order to fulfil an order or keep the accounts have access to order data. We take encrypted backups of the database.

No measure gives absolute security. If a security breach is likely to result in a high risk to you, we will notify you in accordance with Art. 34 GDPR.

10. Cookies

What we store on your device and how to manage your choice — see the Cookie policy.

11. Changes

If we change this notice we will publish the new version at this address and change the date at the top. For a material change we will notify you by appropriate means.