This policy explains how we process personal data when you use banny.design and order from our shop.
1. Controller
- Dabani OOD
- 7 Nikola Petkov St, 2100 Elin Pelin, Bulgaria
- Company ID (EIK): 205476845
- VAT number: BG205476845
- Email: [email protected]
We process personal data in line with the EU General Data Protection Regulation (GDPR) and Bulgarian data protection law.
2. What we collect
- Order data: name, delivery and billing address, email, phone, the products you order and payment references.
- Messages you send us: emails, complaints, return requests.
- Newsletter: your email address, if you subscribe.
- Technical data: IP address, device and browser data, cookies and security logs.
3. Why and on what legal basis
- To process and deliver your order and handle returns – performance of a contract (Art. 6(1)(b) GDPR).
- Accounting, tax and consumer law obligations – legal obligation (Art. 6(1)(c)).
- Site security, fraud prevention and basic statistics – legitimate interest (Art. 6(1)(f)).
- Newsletter and marketing cookies – your consent (Art. 6(1)(a)), which you can withdraw at any time.
4. Who receives your data
- Gelato (Gelato AS, Norway) and its local print and courier partners – your name, delivery address, email, phone and the items ordered, so the order can be printed and delivered. The partner is chosen close to your address, which can be outside the European Economic Area (for example in the US, the UK, Canada or Australia).
- Stripe – card payments and fraud checks.
- Couriers delivering your parcel.
- Hosting, security and email providers who run the site for us.
- Analytics and advertising tools (Meta Pixel, Google, Pinterest, PostHog, Jetpack statistics) – data about how the site is used.
- Our accountant and public authorities where the law requires it.
5. Transfers outside the EEA
Some of these providers process data outside the EEA. When they do, the transfer relies on an adequacy decision (for example the EU–US Data Privacy Framework or the UK adequacy decision) or on the European Commission’s standard contractual clauses.
6. How long we keep data
- Orders and invoices – as long as accounting and tax law require (up to 10 years).
- Complaints and claims – until the relevant limitation periods expire.
- Newsletter – until you unsubscribe.
7. Your rights
You can ask for access to your data, correction, deletion, restriction, data portability, and object to processing; you can withdraw consent at any time. Write to [email protected].
8. Cookies
The site uses cookies that are needed for the shop to work (cart, checkout, language), and analytics and advertising cookies. You can block or delete cookies in your browser settings.
9. Complaints
You can complain to the Bulgarian Commission for Personal Data Protection (КЗЛД), 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, www.cpdp.bg, or to the data protection authority in the country where you live.
10. Changes
We update this policy when our services or the law change. Last updated: 06.10.2026.