Privacy policy and GDPR | STOK Dolce Vita

1. Data controller

The controller of personal data is STOK DOLCE VITA EOOD, UIC 201755464. For questions or requests about your data, use the contact details at the end of this policy.

2. Data we process

first and last name and contact details — telephone number and email address;
company, position or trade channel, if you provide them;
interest in a brand, product or product category;
the content of your messages and subsequent correspondence;
for a product review: the exact item, rating, text, chosen public name and any company, role or location details you choose to provide;
separate confirmations that the experience is genuine, that the data may be processed and that specified information may be displayed publicly;
limited technical data and log records needed to keep the website secure and operational;
your choices about cookies and external content;
after consent: a pseudonymous identifier, pages visited, approximate location at town level, device and browser information, and general interactions measured through Google Analytics 4.

When you submit a contact, partnership or product form, or a product review, the data is sent over a secure connection to the website’s server endpoint, saved with a unique reference and followed by a service notification to stokdolcevita@gmail.com. Product reviews are saved with “pending review” status and are never published automatically. The verification email is not displayed publicly. To prevent abuse, we use a hidden honeypot field, rate limiting and, when enabled, Cloudflare Turnstile. We do not send form contents, ratings or contact details to Google Analytics. Only after consent do we measure that a B2B enquiry was successfully accepted, together with non-identifying context such as form type, selected brand, trade channel and samples selection. The current Mystery Box checkout is an inactive preview and does not collect a name, address or payment details or accept an order. This policy will be updated before sales and courier services are activated. We do not ask for special categories of personal data. Please do not send them through the forms.

3. Purposes and legal bases

Responding to an enquiry and preparing an offerSteps taken at your request before a possible contract, and our legitimate interest in responding to enquiries.

Checking and publishing a product reviewYour separate consent to review and publicly display the rating, text and specific public details you selected. A review may be declined or returned for clarification; it is never published automatically.

Communicating with current partnersPerformance of a contract and our legitimate interest in managing the relationship.

Security and preventing abuseOur legitimate interest in protecting the website, systems and correspondence.

Optional cookies and external contentYour consent, which you may withdraw at any time.

Legal obligationsWhere processing is required by applicable accounting, tax or other legislation.

4. Retention periods

Form submissions and related correspondence for enquiries that do not lead to a contract are kept for up to 90 days after the last communication, unless earlier deletion is requested and there is no reason to retain them. Submitted product reviews and records of the confirmations given are kept for up to 12 months. Once a review is approved and published, its public details and the evidence needed to verify permission are kept while it remains published and for up to 12 months after removal, unless the law requires otherwise. You may withdraw permission to publish using the contacts in this policy. Data relating to contracts and accounting documents is kept for the periods required by law. Technical anti-spam and log records are kept for up to 30 days, unless an incident needs to be investigated. Cookie choices are kept for up to 180 days. Analytics cookies are limited to 13 months, and user and event data in Google Analytics is kept for up to 14 months.

5. Recipients

Data may be processed by the website hosting and platform providers, Resend as the service-notification provider, Google as the receiving email provider and — only after consent — Google Ireland Limited for Google Analytics and Google Maps, where needed for the relevant service. When anti-spam checks are enabled, Cloudflare processes the technical signals needed for Turnstile. Data may be disclosed to competent authorities when required by law. We do not sell personal data.

6. Transfers outside the EEA

Some technology providers may process data outside the European Economic Area. Where this happens, we use an applicable safeguard, such as an adequacy decision or standard contractual clauses, where required.

7. Your rights

You have the right to be informed, access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent where processing is based on consent. To exercise a right, send a clear request to the email address provided. We may ask for reasonable information to confirm your identity. We respond without undue delay and, as a rule, within one month.

8. Complaints

If you believe your rights have been infringed, you may lodge a complaint with the Commission for Personal Data Protection (CPDP): 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria. Visit the CPDP’s complaints page. You may also refer the matter to a competent court.

9. Security and changes

We apply appropriate technical and organisational measures in proportion to the risk. This policy may be updated when the website, providers or law changes; the current date is always shown at the beginning.

Contact

STOK DOLCE VITA EOOD · UIC 201755464 · VAT No. BG201755464
39 Petar Parchevich St, Sofia 1000, Bulgaria
stokdolcevita@gmail.com · +359 877 007 558

Privacy policy