Privacy Policy

Last updated: 05/12/2025

1. Introduction
This Privacy Policy explains how we collects, uses, stores, and protects your personal data when you visit our website, make purchases, or interact with us.
We process personal data in compliance with the EU General Data Protection Regulation (GDPR) and the Bulgarian Personal Data Protection Act (Закон за защита на личните данни – ЗЗЛД).
By using our website, you agree to the practices described in this Privacy Policy.

2. Data Controller
Name: Dream In Color Studio

3. What Personal Data We Collect

3.1. Data You Provide
– Name and surname
– Shipping and billing address
– Email address
– Phone number
– Payment details (processed securely by third-party processors; we do not store full card information)
– Account login credentials (if registration is available)
3.2. Automatically Collected Data
– IP address
– Device and browser information
– Cookies and tracking technologies (see Section 9)
– Website usage data (pages viewed, actions taken)
3.3. Optional Data
– Newsletter subscription preferences
– Artwork reviews, comments, or messages sent to us

4. Legal Grounds for Processing (GDPR Art. 6)
We process personal data based on:
– Contractual necessity – to complete orders, deliveries, and payments
– Legal obligation – accounting, tax compliance, consumer protection laws
– Legitimate interest – fraud prevention, website security, improving services
– Consent – newsletter, marketing communications, non-essential cookies

5. How We Use Your Personal Data
We use your data to:
– Process and deliver orders
– Manage your customer account
– Provide customer support
– Send order updates and transactional emails
– Improve and personalize the website
– Send marketing communications (only with your consent)
– Comply with Bulgarian and EU laws (e.g., accounting obligations)

6. Data Sharing and Transfers
We may share your personal data with:
– Courier and delivery companies (e.g., Speedy, Econt)
– Payment processors
– IT service providers (hosting, email systems)
– Accounting firms
– Public authorities when required by law
We do not sell or rent personal data.
If data is transferred outside the EU, we ensure adequate protections according to GDPR (e.g., Standard Contractual Clauses).

7. Data Retention
We keep your personal data only as long as necessary for each purpose:
Order-related data: 5 years (Bulgarian accounting laws)
Customer account data: until account deletion
Newsletter data: until consent withdrawal
Cookies: per cookie expiration period (see Section 9)

8. Your Rights Under GDPR
You have the right to:
– Access your personal data
– Correct inaccurate data
– Request deletion (right to be forgotten)
– Restrict processing
– Object to processing based on legitimate interest
– Data portability
– Withdraw consent at any time
– Lodge a complaint with a supervisory authority
Bulgarian Supervisory Authority:
Commission for Personal Data Protection (КЗЛД)
Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
Website: www.cpdp.bg

9. Cookies and Tracking Technologies
Our website uses cookies to:
– Ensure website functionality
– Analyze site traffic
– Personalize content
– Support marketing activities (only with consent)
You can manage cookie preferences in your browser or through our cookie banner.

10. Security Measures
We apply appropriate technical and organizational measures, including:
– Encryption (HTTPS)
– Access control and authentication
– Secure hosting infrastructure
– Regular security monitoring
Despite these measures, no system is fully secure, and we cannot guarantee absolute protection.

11. Children’s Privacy
Our services are not intended for individuals under 16 years old, and we do not knowingly collect data from minors.

12. Changes to This Privacy Policy
We may update this policy periodically. Any changes will be posted on this page with an updated “Last updated” date.