Privacy Policy

1. Data controller

The controller is Studio Punkt Ltd., company ID 160072701, registered at 29A Philip Makedonski Str., 4000 Plovdiv, Bulgaria.

Privacy contact: office@punkt.studio.

2. Data we process

We may process your name, email, telephone number, delivery address or selected office/locker, order contents and value, invoice details, correspondence, session data and standard server logs. We do not receive or store card details: card payments are processed entirely by myPOS, and with payment on delivery you pay the courier. With your consent we also process the data described in section 8 (cookies, visit analytics and advertising).

3. Purposes and legal bases

• accepting, fulfilling and delivering orders — performance of a contract and pre-contractual steps;
• issuing and retaining accounting documents — compliance with legal obligations;
• handling returns, complaints and enquiries — contract, legal obligations and legitimate interests;
• site security, fraud prevention and legal claims — legitimate interests;
• visit analytics and advertising measurement through cookies — only with your consent (section 8);
• marketing — only with separate, freely given consent if such a service is introduced.

4. Recipients

We disclose only necessary data to Speedy for delivery pricing, fulfilment and waybill creation; myPOS to process card payments; hosting and email providers; accountants and professional advisers; competent authorities when required by law; and, with your consent, Google and Meta, with our advertising agency Punkt Digital seeing aggregated reports (section 8). Each recipient receives only what is necessary for its role.

5. Retention

Order and accounting data are retained for applicable statutory periods, which may reach 10 years in some cases. Complaint and correspondence records are kept until the matter and applicable limitation periods expire. Cart data is held in the browser session and normally expires after 14 days of inactivity. Server logs are retained for a limited period according to the hosting configuration and security needs.

6. Transfers outside the EEA

With your consent, Google and Meta may transfer data to their affiliates in the United States under the EU-U.S. Data Privacy Framework and standard contractual clauses (section 8). Otherwise we do not transfer personal data outside the European Economic Area; if a provider requires such a transfer, it will take place only under an applicable GDPR transfer mechanism and appropriate safeguards.

7. Your rights

You may request access, rectification, erasure, restriction, portability, object to legitimate-interest processing, and withdraw consent without affecting earlier lawful processing. Statutory retention duties may limit some requests.

Contact office@punkt.studio. You may also complain to the Bulgarian Commission for Personal Data Protection.

8. Cookies, visit analytics and marketing tracking

9. Security and updates

We use reasonable technical and organisational safeguards, including HTTPS in production, restricted administrative access and data minimisation. We may update this policy when our services or the law change; the current version and effective date will remain available here.