Privacy Policy

⚠️ DRAFT — must be reviewed and finalised by your lawyer / DPO before launch. This is a structured starting point, not legal advice.

Data controller: [Vekovia legal entity name], [registered address], [country]. Contact: [privacy@vekovia.xx].

What we collect

Newsletter subscribers: your email address, chosen language, and the date/source of your consent.
Customers: order and delivery details processed by our commerce provider.
Analytics: privacy-friendly, cookieless usage statistics (no personal identifiers).

Why, and our legal basis

To send the marketing emails you opted into — consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the unsubscribe link in every email.
To fulfil and support orders — performance of a contract (Art. 6(1)(b)).
To run aggregate analytics — legitimate interest (Art. 6(1)(f)).

Processors we use

Shopify — commerce, checkout, order/transactional email.
Supabase — subscriber and order records (hosted in the EU).
Resend — sending marketing/lifecycle email.
Plausible — cookieless analytics.
Vercel — hosting (EU region).

[Confirm each processor, its role, location, and that a Data Processing Agreement is in place.]

Your rights

Access, rectification, erasure, restriction, portability, and objection. To exercise them, contact [privacy@vekovia.xx]. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (КЗЛД) or your local authority.

Retention

We keep subscriber data until you unsubscribe and request deletion; order data for the period required by tax/accounting law.

Last updated: [date].