Privacy Policy
Last updated: 6 October 2026.
1. Who handles your data
The controller is YASHA-P EOOD, Bulgarian company number 128505543, registered at 15 Oborishte Street, Yambol, Bulgaria. Correspondence address: 183 Graf Ignatiev Boulevard, Yambol, Bulgaria. For questions and requests: sales@yasha.bg, +359 899 887 095.
This policy covers YASHA.bg, orders, accounts, enquiries and the analytics and advertising services we use.
2. Data and purposes
- Orders, delivery and service: name, telephone, email, address or courier office, products, payment and order history — to enter into and perform a contract, Article 6(1)(b) GDPR.
- Invoices, records and legal obligations: necessary identification, payment and accounting details — Article 6(1)(c) GDPR.
- Accounts and enquiries: registration details and correspondence — to provide the requested service, take pre-contractual steps or fulfil an applicable legal obligation. Establishing or defending legal claims may rely on legitimate interests under Article 6(1)(f) GDPR.
- Website operation and security: technical logs, IP address, browser, device and access time — our legitimate interest in providing a functioning, secure website.
- Analytics and advertising tracking: online identifiers, pages viewed, interactions and product and purchase information — based on the relevant consent, Article 6(1)(a) GDPR.
- Advertising newsletters: email address and communication preferences — based on consent. An order, account registration or acceptance of the terms does not itself subscribe you to advertising.
Required fields are marked during checkout. Without this information we may be unable to fulfil the order. You can shop without analytics or advertising cookies.
3. Providers and recipients
Authorised staff and providers of platform, hosting, technical support, accounting and communication services have access as needed. The store uses Seliton; Speedy receives information needed for shipping and payment. Competent authorities may receive data where there is a legal basis.
CookieYes manages cookie choices and consent records. Google Tag Manager manages tags; Google Analytics 4 measures visits and purchases after analytics consent. Analytics events include products, quantities, values and order numbers; our custom GA4 tags do not send names, telephone numbers, email addresses or delivery addresses. Online identifiers are not necessarily anonymous.
We use HubSpot for advertising newsletters and, after analytics consent, website analytics. Existing contact records may contain email addresses, telephone numbers, form submission history and associated visits. To stop advertising emails, use the unsubscribe link in the email or contact sales@yasha.bg.
Meta tools — Pixel and the server integration through Seliton — are used for advertising measurement and audiences. They process activity and purchase information and online identifiers; depending on the configuration, matching may use hashed contact details. Hashing does not make these anonymous. Meta may link information to a Facebook or Instagram account. Applicable collection and transmission operations are governed by Meta Business Tools terms, including the relevant joint controller arrangement.
If you choose Facebook Login, we receive the authentication information you authorise. Reviews submitted for publication and their displayed author names may be public.
Provider information: https://policies.google.com/privacy, https://legal.hubspot.com/privacy-policy, https://www.facebook.com/privacy/policy/, https://www.cookieyes.com/privacy-policy/.
4. Retention and international processing
Order and accounting data are retained to fulfil the purchase and for applicable statutory periods. Complaints and correspondence are retained until the matter is resolved and for the period needed for associated legal obligations or claims. Accounts are maintained while active or until an erasure request, separating information that must remain by law.
Newsletter data are retained until you unsubscribe or the purpose ends. A minimal suppression record and evidence of consent may remain as needed to respect your choice and demonstrate lawful processing. Technical logs are kept for the period needed for security and diagnostics, including investigation of identified incidents.
In the GA4 property used, event data are retained for 2 months and user data for 14 months, with renewal on new activity. This does not affect most aggregated standard reports. Cookie lifetimes are separate and described in the Cookie Policy.
Providers such as Google, Meta, HubSpot and CookieYes may process data outside the EEA. The relevant transfer relies on a valid adequacy decision or appropriate safeguards, including standard contractual clauses and necessary supplementary measures. Request information and a copy of applicable safeguards at sales@yasha.bg.
5. Your rights and choices
Subject to legal conditions, you may request access, correction, erasure, restriction and portability; object to processing based on legitimate interests; and object to direct marketing at any time. You may withdraw consent without affecting earlier lawful processing.
Change cookie choices through Cookie settings on the website. For requests covering data across the systems we use, contact sales@yasha.bg. Deleting a store account does not automatically delete a HubSpot contact. Where needed, we verify identity proportionately. We normally respond within one month, with an extension where legally permitted.
You may complain to Bulgaria’s Commission for Personal Data Protection: https://cpdp.bg/, 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592, kzld@cpdp.bg, or another competent supervisory authority.
We update this policy when processing changes. Publishing a new version does not replace consent where consent is required.
