Privacy Policy

Who processes your data

The data controller is Iva Lazarova — an author acting as a private individual, based in Bulgaria.

For any data-protection matter you can reach us at iva.lazarova.draws@gmail.com.

What data we collect

Order data: full name, email, phone, the Econt delivery address or office, and (optionally) a personal note for the autograph.

Contact-form data: name, email, subject and message.

Newsletter data: your email address — only if you explicitly subscribe.

Technical data: IP address, device and browser type, needed for security and site operation.

Payment data is processed entirely by Stripe. We never see or store your card numbers.

Legal basis

Performance of a contract (Art. 6(1)(b) GDPR) — to process and deliver your orders.

Consent (point a) — for the newsletter and non-essential cookies.

Legitimate interest (point f) — for site security, bot protection and anonymous analytics.

Legal obligation (point c) — for accounting and tax purposes.

How we use your data

Processing, confirming and delivering your orders; communicating with you about an order or enquiry; sending the newsletter (only with consent); maintaining security and improving the site.

How long we keep data

Order and accounting records — up to 5 years, as required by applicable law.

Contact-form messages — up to 12 months.

Newsletter data — for as long as you stay subscribed; deleted on unsubscribe.

Technical logs — a short period needed for security.

Sharing and transfers outside the EU

We do not sell your data. We share it only with the trusted processors below, to the extent necessary. Some of them (e.g. Stripe, Vercel, Resend) may process data outside the EU under appropriate safeguards (Standard Contractual Clauses or an adequacy decision).

Your rights

You have the right to access, rectify, erase, restrict processing of, port and object to the processing of your data, and to withdraw consent at any time.

To exercise your rights, write to iva.lazarova.draws@gmail.com.

You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) — kzld.bg.

Cookies

The site uses a minimal number of cookies. Details and consent management are in our Cookie Policy.

Security

We use an encrypted connection (SSL), restricted access to data, and only trusted processors to protect your information.

Changes to this policy

We may update this policy from time to time. Changes are published on this page with a revised date.

Third-party service providers

To operate this site we rely on the following trusted services. Each processes your data only to the extent necessary to provide their service:

• ✦Stripe — Payment processing. Card details never reach our servers. Policy: stripe.com/privacy
• ✦Supabase — Database — stores orders, contact-form messages and subscribers. EU-hosted servers. Policy: supabase.com/privacy
• ✦Vercel — Site hosting and CDN. Collects anonymous performance metrics. Policy: vercel.com/legal/privacy-policy
• ✦Resend — Transactional emails (order confirmation, contact-form forwarding). Policy: resend.com/legal/privacy-policy
• ✦Kit (ConvertKit) — Newsletter platform. Your email is added only with explicit opt-in. Unsubscribe any time. Policy: kit.com/privacy-notice
• ✦Cloudflare Turnstile — Bot protection on forms. Uses no tracking cookies. Policy: cloudflare.com/privacypolicy
• ✦Econt — Courier delivery. Receives name, phone and address/office upon a confirmed order. Policy: econt.com/privacy