Privacy Policy

Version of 1 October 2026. Effective from: 1 October 2026.

Who processes the data

The controller is “Idea Horizont” EOOD, UIC 208778820, Sofia 1505, Poduyane district, 13 Yoakin Gruev St., apt. 3, represented by Tsvetelina Petrova Petrova. Contact for personal data matters: info@floresca.bg; +359 876 168 977. This policy covers visitors, customers, delivery recipients, persons who submit inquiries, and subscribers, when the relevant function is active.

What data we use and why

Orders and delivery. We process name, email, phone, address or courier office, selected products, quantities, specification for a custom item, and correspondence related to the order. For the buyer, the legal basis is concluding and performing a contract, including requested pre-contractual steps — Art. 6(1)(b) of Regulation (EU) 2016/679. If we do not receive the necessary data, we cannot accept or deliver the order. Optional fields are marked as non-mandatory.

Payments and accounting. We process payment amount, status and identifier, bank transfer details, and the details required for invoicing. The legal bases are performance of the contract and legal accounting and tax obligations — Art. 6(1)(b) and (c). For card payments via the DSK Bank virtual POS, card data is entered and processed in the bank’s secure payment environment. “Idea Horizont” EOOD does not store bank card data; we process the order data, amount, status, and transaction identifier. No general consent for personal data is required for the selected payment to be processed.

Withdrawals, complaints, and claims. We use the order data, the statement, the description of the issue, and supporting evidence to fulfil our legal obligations and to establish, exercise, or defend rights — Art. 6(1)(c) and (f). Our legitimate interest is the proper resolution and proof of the contractual relationship. We do not require a copy of an ID card for an ordinary withdrawal or complaint.

Inquiries. Data from the contact form and email is used to reply. The legal basis is Art. 6(1)(b) when the inquiry relates to a future or current order, or (f) for ordinary business communication. A phone number is required only if it is needed for the reply method you choose.

Account, if active. We process email, protected authentication data, provided addresses, and order history to operate the requested account — Art. 6(1)(b). Purchase is also possible without an account. Passwords should not be visible in clear text to our staff.

Newsletter, if active. We use your email and proof of signup for news, offers, and promotions only after separate consent — Art. 6(1)(a). Unsubscribe is available in every message and via info@floresca.bg. We do not tie purchase to consent for advertising and do not automatically add buyers to the list. Messages about order fulfilment are not a newsletter.

Visit analytics, if active. After you choose analytical cookies, online identifiers, device data, visited pages, and events may be processed. The legal basis is consent — Art. 6(1)(a), in connection with the rules on access to terminal equipment. Detailed providers, technologies, and retention periods are in the cookie policy. Refusal does not prevent purchase.

Security. We process limited technical logs, IP addresses, access time, and security-related actions to prevent abuse and maintain the site — Art. 6(1)(f). The interest is the security of the service and the data. We limit access and retention; we do not use these logs for advertising. The necessity of a security cookie is assessed separately from the legal basis for data processing.

Reviews, if active. Publishing a submitted review and a chosen public name is done at your request on the basis of Art. 6(1)(b). Moderation and checking whether the review is linked to a purchase are based on (f) — credibility and protection against abuse. The email and order number are not published. Separate advertising use of a photo or personal story is done only with an appropriate separate legal basis.

When the recipient is different from the buyer

For a gift, we receive the recipient’s name, phone, and address from the person placing the order. We use them to organise and prove delivery based on the parties’ legitimate interest in performing the order — Art. 6(1)(f). We do not include the recipient in marketing lists. We provide information about the source, purposes, and rights at first contact or at the latest within the period under Art. 14 of the Regulation. You may request additional information and object to the processing.

Please do not include in personal messages health data, religious beliefs, or other sensitive information that is not necessary for fulfilment. If we receive unnecessary data, we restrict access and remove it, unless the law requires otherwise.

Who may receive the data

Access is limited to authorised persons in the company. We use categories of providers such as hosting, technical support, email, accounting services and, when activated, a newsletter provider. When they act on our behalf, we bind them with a contract under Art. 28 of the Regulation and documented instructions.

To the selected courier we provide the necessary name, phone, address or office, and delivery data. To a bank or payment provider we provide the information needed for payment and refund. For their own legal functions, couriers, banks, and payment institutions may act as independent controllers. The role is determined by the specific service, not only by the provider’s name.

For payment via the virtual POS, the recipient of the necessary payment data is “DSK Bank” AD. The issuing bank, the relevant card schemes, and payment providers also take part in the processing. The bank also processes data as an independent controller for performing payment services, legal obligations, and fraud protection; it is not presented as a mere processor acting only on the shop’s instructions. We provide the necessary order and transaction data, and card data is entered via the secure payment page. Information on processing by the bank: https://dskbank.bg/PrivacyPolicy. When Google Pay is active, processing in the wallet is also governed by the terms of its provider and the issuing bank: official page on payments.google.com.

When required by law or to protect rights, data may be provided to the National Revenue Agency, a court, competent supervisory authorities, lawyers, and other authorised recipients. We do not sell customer lists and do not provide data for third-party marketing without a valid legal basis.

International transfers

Core operations are organised through providers selected and reviewed before activation. When international cloud or payment services are used, access or transfer outside the European Economic Area, including the USA, may occur. Transfer is allowed only with an applicable adequacy decision or appropriate safeguards under Chapter V of the Regulation, for example standard contractual clauses with a transfer assessment and any necessary additional measures.

The EU–US Data Privacy Framework is used only if there is a valid adequacy decision and the specific recipient is validly certified for the relevant data and activities. We do not assume that a European contractual entity automatically excludes international access. You may request information about specific recipients, countries, and a copy or description of the safeguards via info@floresca.bg, subject to protection of third-party confidential information.

For implementation: before publishing, state the actual international flows: provider __________; country __________; mechanism __________; address of the safeguards __________. If there are none, replace the conditional description with accurate information. Do not activate a service with an unclear mechanism.

How long we keep the data

Order data and related contractual correspondence: up to five years after the contract ends, when needed to protect rights. Invoices, accounting records, and documents for tax control: for the applicable legal periods, usually ten years from 1 January of the following reporting period for the categories under Art. 12(1)(2) of the Accountancy Act. We do not keep all technical order data solely because an invoice is retained.

Standalone inquiries with no subsequent order: up to one year after the correspondence ends. Gift recipient data that is not needed for contractual proof or a legal obligation is removed within one year of delivery.

Account: until closure or up to two years of inactivity, after 30 days’ prior notice; order documents are stored separately under the applicable periods. Review: while it remains published, with review when the related product is removed and upon a removal request.

Newsletter: until consent is withdrawn or up to 24 months without confirmed interest. Those who do not respond to a renewal check are removed. Limited proof of consent and withdrawal is kept for up to three years after termination for accountability and defence. A minimal suppression list is kept while we maintain the relevant marketing channel and there is a risk of re-inclusion, with annual review.

Personal data requests and limited evidence of the response: up to three years after completion. In a pending dispute, legal requirement, or audit, the relevant data is kept for the necessary longer period with restricted access. Backups are rotated on a protected cycle of up to 35 days; upon restore, previously performed deletions are reapplied.

Your rights

You may request access to and a copy of your data, rectification, erasure, or restriction under the conditions of the Regulation. When processing is automated and based on consent or a contract, you may receive the data you provided in a structured, commonly used, machine-readable format and request transfer to another controller where technically feasible.

You may object, on grounds relating to your particular situation, to processing based on legitimate interest. For direct marketing, the objection is honoured without assessing whether our interest prevails. You may withdraw consent at any time as easily as it was given; this does not affect the lawfulness of prior processing.

Send the request to info@floresca.bg or to our address. You are not required to use a template. If there is reasonable doubt about identity, we ask only for proportionate additional information. We respond without undue delay and within one month of receipt, with a possible extension of up to a further two months in case of complexity or volume, of which we notify you within the first month with the reasons.

The first copy and handling of the request are free of charge. A fee or refusal is allowed only under the legal conditions, including manifestly unfounded or excessive requests, which we must justify. Erasure does not cover data we are required to keep by law or that is needed to protect rights.

You have the right to lodge a complaint with the Commission for Personal Data Protection, Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., https://cpdp.bg, kzld@cpdp.bg, or with another competent supervisory authority, as well as to seek judicial protection. You are not required to contact us first.

Automated decisions and changes

Floresca does not take decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects for you. If a payment is declined by a provider, you may contact us for a human review of the order and a possible alternative payment method. The provider is separately responsible for its own processes.

The shop is not aimed at collecting children’s data for marketing. If we find inappropriately collected data, we take action as appropriate. If there is a material change to purpose, legal basis, or recipients, we publish an update and provide any necessary additional information; where required, we seek new consent before the new activity.