Privacy policy

PRIVACY POLICY (GDPR)

This policy explains how we collect, use and protect your personal data when you visit the Zehira online store, place an order or contact us. Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act.

1. Who processes your data (controller)

Data controller: „Zehira Cosmetics“ Ltd.
Company ID (ЕИК): 206006325
Address: 1 Demokratsia Blvd., Burgas, Bulgaria
Phone: +359 878 313 403
Email for data protection enquiries: info@zehira.com

2. What data we collect

A) Order and delivery data – first and last name, phone number, email address, delivery address or chosen courier office, contents and value of the order, order history, correspondence relating to the order.

B) Account data (if you create an account) – email address, saved delivery addresses, preferences. Signing in is done with a one-time code sent by email – we do not store passwords.

C) Payment data – we do not store bank card details. When paying by card, the data is processed directly by the payment provider in a secure environment. For refunds by bank transfer we may ask for a bank account (IBAN) only where this is necessary.

D) Technical data and cookies – IP address, device and browser information, data about visits and actions on the site (pages viewed, adding to cart, etc.), identifiers from cookies and similar technologies.

E) Marketing data – email address and consent status, if you have subscribed to our newsletter.

3. Why we process the data and on what legal basis

(1) Performance of a contract (Art. 6(1)(b) GDPR) – receiving and processing orders, delivery, customer service, returns and complaints, maintaining your account.

(2) Legal obligation (Art. 6(1)(c) GDPR) – accounting and tax reporting, obligations under consumer protection law.

(3) Legitimate interest (Art. 6(1)(f) GDPR) – protection against abuse and fraud, information security, maintaining and improving the functionality of the site, defending legal claims.

(4) Consent (Art. 6(1)(a) GDPR) – newsletter and marketing messages; analytics and marketing cookies. You may withdraw your consent at any time – via the unsubscribe link in our emails, via the cookie settings, or by writing to us at info@zehira.com. Withdrawal does not affect the lawfulness of processing carried out before it.

4. Who we share data with (recipients)

We share data only to the extent necessary to provide the service:

Shopify – the platform our online store runs on, including site hosting and payment processing. Shopify processes data as our processor and may transfer data outside the EU/EEA subject to appropriate safeguards. Further information: Shopify's privacy policy for users and the Shopify privacy portal.
Courier partners – Econt and Speedy, to carry out delivery (name, phone, address or office).
Payment providers – to process card payments and prevent fraud. Card payments are processed by Shopify Payments; the provider acts as an independent controller in respect of the payment data.
IT support providers – for the operation and security of the site.
Analytics and marketing providers – only where you have given the relevant consent through the cookie settings.
Public authorities – where we are required to do so by law (for example the National Revenue Agency and other competent authorities).

We do not sell personal data.

5. Transfers outside the EU/EEA

Some of our providers (for example the platform, payment providers, analytics and marketing) may process data outside the EU/EEA. In such cases the transfer takes place on the basis of an adequacy decision or subject to appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

6. How long we keep the data

Order data and accounting documents – for the periods required by tax and accounting legislation.
Customer enquiries and complaints – until the case is closed and for a reasonable period thereafter to defend legal claims.
Marketing data (newsletter) – until you unsubscribe or withdraw your consent.
Account data – for as long as the account is active or until a deletion request, unless there is a legal basis for retention.
Cookies – for the lifetime of the relevant cookie, as described in section 8.

7. Your rights

You have the right to:

be informed about and access your data;
request rectification of inaccurate data;
request erasure (the "right to be forgotten"), where applicable;
request restriction of processing;
object to processing based on legitimate interest;
data portability in certain cases;
withdraw any consent given, at any time;
lodge a complaint with a supervisory authority.

To exercise your rights, write to us at info@zehira.com. To protect your data we may ask for reasonable verification of your identity. We will respond within one month, which may be extended in complex cases in accordance with the GDPR.

8. Cookies

The site uses cookies and similar technologies for:

Necessary – core functionality (cart, sign-in, security, storing your cookie choice). These cookies do not require consent.
Analytics and statistics – to understand how the site is used and to improve it. Used only with your consent.
Marketing – to display relevant advertising. Used only with your consent.

You can manage your preferences at any time via the "Cookie preferences" link at the bottom of the site, as well as through your browser settings.

9. Security

We apply appropriate technical and organisational measures to protect personal data, including an encrypted connection (HTTPS) and access to data restricted on a need-to-know basis. No security measure is absolute; we recommend that you do not send us sensitive information over unsecured channels.

10. Children's data

The services are not intended for children. We do not knowingly collect personal data of persons under the age of 14. If you are a parent or guardian and believe that a child has provided us with their data, please contact us so that it can be deleted.