Privacy Policy

This policy explains how TOP SCHETOVODSTVO EOOD, which sells MagiaStoria products, uses personal data when you visit our website https://magiastoria.com, buy from us through our checkout, subscribe to our newsletter, contact us or follow us on social media.

1. Who is responsible for your data

The data controller is TOP SCHETOVODSTVO EOOD, 1 Pleven Str., Sofia, Bulgaria, UIC 201665695, VAT BG201665695.

For any privacy question or request, email support@magiastoria.com. We have not appointed a data protection officer because the law does not require one for our business.

2. What we collect

When you buy:

• your name (if the checkout asks for it), email address and country, and your postcode where it is needed to calculate tax;
• your order details: product, price, VAT, discount code, order number, date and time;
• your business tax ID, if you choose to enter one;
• your confirmations at checkout, with the date and time. This includes your acceptance of the Terms of Sale and your express request for immediate supply;
• limited payment information from our payment providers, such as card type, the last four digits, the card's country and fraud-check results. We never receive your full card number.

For personalized products: the child's first name or nickname and the hiding places you choose. Please do not give us any other information about a child.

When you subscribe to our newsletter: your email address and a record of your consent (when and how you gave it).

When you contact us: your name, email address, your message and any withdrawal notice, together with any details you include.

When you leave a review or tag us: the review, your name as displayed, and the content you share.

When you visit our website: our hosting provider automatically records technical data in server logs, such as your IP address, the date and time, the pages requested, and your browser and device type. Our website itself does not use advertising or analytics cookies, pixels or trackers. See section 8 for the checkout.

3. Why we use it and our legal basis

• Performance of a contract (Art. 6(1)(b) GDPR): taking and processing your order, preparing and delivering your product, sending order and delivery emails, and answering your questions.
• Legal obligation (Art. 6(1)(c) GDPR): keeping accounting and tax records, handling withdrawal notices and meeting our consumer-law obligations.
• Our legitimate interests (Art. 6(1)(f) GDPR): keeping our website secure and working (server logs); keeping records of your checkout confirmations; preventing fraud and misuse; defending chargebacks and payment disputes; establishing, exercising and defending legal claims; protecting our intellectual property, including tracing unauthorized copies of our files; and improving our products using aggregated information.
• Your consent (Art. 6(1)(a) GDPR): our newsletter; any non-essential cookies; and publishing an image in which a child can be identified. You can withdraw your consent at any time, for the newsletter by using the unsubscribe link in every email.

Buying a product does not subscribe you to our newsletter. Where the law allows, we may email existing customers about similar MagiaStoria products. You can opt out at any time, free of charge, using the link in every email or by writing to us.

You must give us the details needed for your order. Without them, we cannot make or deliver your product.

4. Children

Our products are bought by adults for children. You must be 18 or older to buy, subscribe or contact us. We do not knowingly collect personal data directly from children, and children must not contact us or place orders.

The child's first name is given to us by the adult who places the order, only to personalize that order. We do not use it for marketing or profiling and do not combine it with other data. If you believe a child has sent us personal data directly, contact us and we will delete it.

5. Who we share it with

We do not sell your personal data. We share it only as needed with:

• Payhip (Payhip Ltd, United Kingdom), which runs our checkout, stores order records and sends purchase confirmations. For EU and UK sales it also handles VAT. Payhip also processes some data as an independent controller under its own privacy policy.
• Our payment providers, Stripe and, where offered at checkout, PayPal, which process payments and carry out fraud checks. For some purposes, such as fraud prevention and regulatory compliance, they act as independent controllers.
• Superhosting.bg (Bulgaria), which hosts our website.
• Our email and newsletter providers, which we use to deliver your files, reply to you, receive withdrawal notices and, if you subscribed, send our newsletter (currently Brevo, France).
• Our accountants, auditors and legal advisers, who are bound by confidentiality.
• Banks, card networks and payment processors, when we respond to a chargeback or payment dispute.
• Courts, authorities and law enforcement, where the law requires it or where it is needed to establish, exercise or defend legal claims.
• A buyer or successor of our business, if the business is sold or reorganized.

6. International transfers

Some of these providers process data outside the European Economic Area. Transfers to the United Kingdom rely on the European Commission's adequacy decision. Transfers to the United States rely on the EU-US Data Privacy Framework or on the Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards.

7. How long we keep it

• Personalization details and personalized files: deleted from our working files within 180 days after delivery. We keep them for this period so that we can resend files and respond to payment disputes. The checkout answers also remain part of the Payhip order record (see the next point).
• Order, invoice and payment records, including checkout answers and confirmations: for as long as Bulgarian accounting and tax law requires, which can be up to 10 years.
• Emails, contact-form messages and withdrawal notices: up to 5 years after our last contact, which is the general limitation period under Bulgarian law. We may keep them longer if a dispute is ongoing.
• Newsletter: until you unsubscribe. After that, we keep your email address on a suppression list so that we do not contact you again.
• Server logs: for the short period set by our hosting provider.
• Reviews: for as long as they are published.

8. Cookies and the checkout

Our website does not set advertising or analytics cookies and does not use tracking pixels. If we add such tools, we will use them only with your consent and will update this policy first.

Our fonts and images are served from our own website, so loading our pages does not send your data to font or image providers.

The checkout is provided by Payhip on its own website. Payhip uses strictly necessary cookies to run the checkout and, with your consent, analytics cookies. You can accept or reject non-essential cookies in Payhip's cookie banner. Payhip's privacy and cookie policy explains the cookies it sets.

9. Social media

When you visit or interact with our pages on Instagram, Facebook, TikTok or Pinterest, those platforms process your data under their own privacy policies. We receive only aggregated statistics and the content you choose to share with us. For Facebook and Instagram page statistics, we are joint controllers with Meta Platforms Ireland Ltd under Meta's Page Insights Controller Addendum.

10. Your rights

Depending on your location, you have the right to:

• access your personal data and receive a copy;
• correct inaccurate data;
• have your data deleted;
• restrict how we use your data;
• receive your data in a portable format;
• object to processing based on our legitimate interests, and object at any time to direct marketing;
• withdraw your consent at any time, without affecting earlier processing.

To make a request, email support@magiastoria.com from the address you used with us. We may ask you to confirm your identity. We will reply within one month. For complex requests, we may extend this by up to two further months and will tell you if we do. We may refuse, or charge a reasonable fee for, requests that are manifestly unfounded or excessive. We cannot delete data that we must keep by law or that we need to establish, exercise or defend legal claims.

You also have the right to complain to a data protection authority. In Bulgaria, this is the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592 (www.cpdp.bg). You may also complain to the authority in the country where you live or work.

Residents of the United States: we do not sell your personal information and do not share it for cross-context behavioural advertising.

We do not make decisions about you based solely on automated processing.

11. Security

We use reasonable technical and organizational measures to protect your data. These include using established providers, using the security features they offer, encrypting traffic to our website and checkout (HTTPS) and limiting access to what is needed. No system is completely secure, so we cannot guarantee absolute security. If a breach affects your data, we will notify you and the authorities where the law requires it.

12. Changes

We may update this policy. The current version is always available on our website, with the date of the last update.