The controller of your data is ARFA ES LTD, 3 eng. Stoimen Sarafov Str., 1000 Sofia, Bulgaria, [email protected].
What we collect and why
- To deliver your order: name, address, phone and email. These go to our warehouse system in Bulgaria and to the carrier that delivers the parcel (Royal Mail, through our shipping partner). Legal basis: the contract (UK GDPR / GDPR art. 6(1)(b)).
- For accounting: order and payment details, kept as long as tax law requires. Legal basis: legal obligation (art. 6(1)(c)).
- When you pay: your email, the amount and the order number go to Stripe Payments Europe Ltd. (Dublin, Ireland), which processes the payment on its own page; your card details go to Stripe only, never to us. Legal basis: the contract (art. 6(1)(b)). Stripe's privacy policy: stripe.com/privacy.
- To answer your messages: what you write to us (by email, phone or the contact form) and how to reach you. Legal basis: our legitimate interest in answering you (UK GDPR / GDPR art. 6(1)(f)).
Your data is processed in the EU (Bulgaria), which the UK recognises as giving adequate protection. If you buy on Amazon.co.uk instead, Amazon processes that order under its own privacy notice.
We do not sell your data and we do not use advertising cookies.
Cookies
The site stores in your browser only what it needs to work — and, if you allow it, the analytics cookies of Google Analytics. Nothing optional loads before you choose in the cookie banner, and you can change your choice at any time with "Cookie settings" at the bottom of every page.
| Name | Type | Purpose | Lifetime | Category | Whose |
|---|---|---|---|---|---|
pb_consent | cookie | Remembers your cookie choice (version, allowed categories, date). | 12 months | strictly necessary | our own |
pb_edition | cookie | Remembers the country / region you picked in the footer. Only created when you pick one. | 12 months | strictly necessary | our own |
pb-cart-v1 | local storage | What is in your basket. Only created when you add something. | until you delete it | strictly necessary | our own |
_ga, _ga_* | cookie | Google Analytics 4: tells separate visitors and visits apart for aggregate statistics. | up to 2 years | analytics — only with your consent | third party: Google Ireland Ltd. |
- Analytics (Google Analytics 4): aggregate statistics on how the site is used — which pages are visited and how visitors arrive. Provider: Google Ireland Ltd.; Google may also process the data in the USA (Google LLC is certified under the EU–US Data Privacy Framework and its UK Extension). The page address reaches Google without any parameters other than the campaign you came from. Legal basis: your consent (PECR and UK GDPR / GDPR art. 6(1)(a)), which you can withdraw at any time as easily as you gave it.
You can also delete or block cookies in your browser's settings; your basket will then be emptied.
How long we keep it
Order data for the period required by Bulgarian accounting law; messages for as long as needed to answer them.
Your rights
You can ask for a copy of your data, its correction or deletion, restriction or objection, and data portability. Write to [email protected]. You may also complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or to the UK Information Commissioner's Office (ico.org.uk).