Privacy Policy (GDPR)

1. Data controller

The data controller is the trader identified on our Seller Information page (/legal). Until official details are published, contact contact@funbustersbg.com for data protection enquiries.

Official company name, registration number (EIK) and address must be filled in by the site owner on the Seller Information page.

2. What data we collect

• Contact form: name, email address, optional topic and message content.
• Online shop (Stripe): name, email, shipping and billing address, payment status and order details. Card data is processed directly by Stripe and is not stored on our servers.
• Technical data: browser type, IP address (server logs), and locale preference via cookie.
• Order emails: we send confirmations via Resend or Web3Forms depending on configuration.

3. Purposes and legal basis

• Processing orders and delivering products — performance of a contract (Art. 6(1)(b) GDPR).
• Responding to contact enquiries — legitimate interest / pre-contractual steps (Art. 6(1)(b) and (f) GDPR).
• Order and admin notifications — legitimate interest (Art. 6(1)(f) GDPR).
• Storing locale preference — legitimate interest in providing the site in your language (Art. 6(1)(f) GDPR).

4. Payment processing (Stripe)

Payments are processed by Stripe. Stripe may process personal data as an independent controller. See Stripe's privacy policy at https://stripe.com/privacy

We receive only the information necessary to fulfil your order (e.g. name, email, address, payment confirmation).

5. Contact form (Web3Forms)

Messages submitted via the contact form are forwarded through Web3Forms to our email inbox. Web3Forms acts as a processor for message delivery.

Do not submit sensitive personal data unless necessary for your enquiry.

6. Data retention

• Contact form messages: up to 24 months unless a longer period is required for correspondence.
• Order and invoice data: as required by Bulgarian accounting and tax law (typically 5–10 years).
• Server logs: up to 90 days unless needed for security investigations.

7. Your rights

Under GDPR you have the right to access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw consent where processing is consent-based.

You may lodge a complaint with the Commission for Personal Data Protection (CPDP) in Bulgaria: https://www.cpdp.bg

• To exercise your rights, email contact@funbustersbg.com with sufficient information to identify your request.
• We respond within one month, extendable by two further months for complex requests.

8. Data sharing and transfers

We share data only with service providers necessary to operate the site: Stripe (payments), Web3Forms and/or Resend (email), and hosting/infrastructure providers.

Where processors are outside the EEA, appropriate safeguards (e.g. Standard Contractual Clauses) apply as offered by those providers.

Cookies

For details on cookies used on this site, see our Cookie Policy.