Privacy Policy

1. Data controller

The controller is Studio Punkt Ltd., company ID [enter company ID], registered at [enter registered address].

Privacy contact: office@punkt.studio.

2. Data we process

We may process your name, email, telephone number, delivery address or selected office/locker, order contents and value, invoice details, correspondence, session data and standard server logs. We do not receive or process card details. Payment is collected by the courier upon delivery using the methods available at the selected address, office or locker.

3. Purposes and legal bases

• accepting, fulfilling and delivering orders — performance of a contract and pre-contractual steps;
• issuing and retaining accounting documents — compliance with legal obligations;
• handling returns, complaints and enquiries — contract, legal obligations and legitimate interests;
• site security, fraud prevention and legal claims — legitimate interests;
• marketing — only with separate, freely given consent if such a service is introduced.

4. Recipients

We disclose only necessary data to Speedy for delivery pricing, fulfilment and waybill creation; hosting and email providers; accountants and professional advisers; and competent authorities when required by law. Each recipient receives only what is necessary for its role.

5. Retention

Order and accounting data are retained for applicable statutory periods, which may reach 10 years in some cases. Complaint and correspondence records are kept until the matter and applicable limitation periods expire. Cart data is held in the browser session and normally expires after 14 days of inactivity. Server logs are retained for a limited period according to the hosting configuration and security needs.

6. Transfers outside the EEA

We do not intend to transfer personal data outside the European Economic Area. If a provider requires such a transfer, it will take place only under an applicable GDPR transfer mechanism and appropriate safeguards.

7. Your rights

You may request access, rectification, erasure, restriction, portability, object to legitimate-interest processing, and withdraw consent without affecting earlier lawful processing. Statutory retention duties may limit some requests.

Contact office@punkt.studio. You may also complain to the Bulgarian Commission for Personal Data Protection.

8. Cookies and local storage

The shop uses only technically necessary cookies for sessions and the cart, CSRF security, language selection and Admin login. They enable core functionality and are not used for advertising tracking. If analytics or marketing technologies are introduced, this notice will be updated and prior consent obtained where required.

9. Security and updates

We use reasonable technical and organisational safeguards, including HTTPS in production, restricted administrative access and data minimisation. We may update this policy when our services or the law change; the current version and effective date will remain available here.