Privacy policy
What we record about you, why we need it and how to ask us to erase it. Written to be understood on the first read.
01Who processes your data
The controller of the personal data collected through asiansecret.bg is the company below. It decides why and how your data is processed and answers to you for it.
- Company
- „ЛОТУС 9“ ЕООД
- Company number (UIC)
- 208461318
- Registered seat and address
- Burgas 8001, Bulgaria, Lazur district, bl. 5, ent. 1, fl. 5, ap. 8
- Manager
- Chavdar Stoyanov Neykov
- VAT registration
- The company is not VAT registered. Listed prices are final and no VAT is added to them.
- Phone
- 0878 141 487
- zax12@abv.bg
- Website
- asiansecret.bg
We have no appointed data protection officer — questions about this policy go straight to the phone number and email listed above.
02What data we collect
We collect only what an order cannot reach you without. We do not ask for a national ID number, we do not ask for a date of birth and we do not create user accounts — the shop works without registration.
When you order
- First and last name
- Phone and email — to confirm the order and for the courier to reach you
- Delivery address or Speedy office
- Order contents, amount, chosen payment method and any note you added to the order
When you write to us
- Name, email, phone (optional) and the text of your message from the contact form
When you pay by card
Your card details are entered on the page of Viva Payment Services S.A. and never pass through our site. All we see is whether the payment went through and which order number it belongs to.
Technical data
The hosting keeps standard access logs — IP address, time of request, requested address and browser type. They serve security and fault-finding, not visitor tracking.
03Why we process it
| Purpose | Legal basis |
|---|---|
| Taking, fulfilling and delivering the order | Performance of a contract — Art. 6(1)(b) GDPR |
| Issuing and keeping accounting documents | Legal obligation — Art. 6(1)(c) GDPR |
| Handling a withdrawal, return, exchange or complaint | Performance of a contract and legal obligation |
| Replying to a message sent through the contact form | Legitimate interest — Art. 6(1)(f) GDPR |
| Site security and protection against abuse | Legitimate interest |
| Cookies beyond the strictly necessary | Your consent — Art. 6(1)(a) GDPR |
We do not use your personal data for automated decision-making and we do not build profiles.
04Who we share it with
We do not sell or rent your data to anyone. We share it only with the providers without whom the order cannot be fulfilled, and only the part each of them needs.
| Recipient | What it receives and why |
|---|---|
| Спиди АД | Name, phone, address or office and the cash-on-delivery amount — so the parcel can be delivered. |
| Viva Payment Services S.A. | The amount and the order number for card payments. Card details go directly to them, not to us. |
| Resend, Inc. | Email address and the content of the confirmation — so the order email can be sent. |
| Hostinger International Ltd. | Hosting of the site and the access logs. |
| Accountant | The data on the sales documents, to the extent the law requires them to be kept. |
| State authorities | Only where a law obliges us, and within the scope of the specific request. |
All of the above process data within the European Union or in a country covered by a European Commission adequacy decision. Should that change, we will state the applicable safeguards here.
05How long we keep it
- Accounting documents for orders — 5 years from the start of the year following the one in which the document was issued, as the Accountancy Act requires. For some documents the term is 10 years.
- Data on returns, exchanges or complaints — until the limitation period in which either side may raise a claim has expired.
- Messages from the contact form — up to 12 months from the last correspondence.
- Server logs — up to 12 months.
Once the period runs out the data is deleted, or anonymised so that it can no longer be linked to a particular person.
06Cookies and local storage
On your first visit the site shows a bar where you choose what you allow. Your choice is remembered and you can change it at any time from at the bottom of every page.
Technically the site uses no classic cookies of its own, but your browser's local storage — it stays on your device and is not sent with every request to the server. We list it here alongside cookies because what matters in law is what gets written to your device, not what it is called.
| Name | What it does | Type | Retention |
|---|---|---|---|
| as_cart_v1 | Holds what you put in the cart while you move around the site. | Necessary | Until the cart is emptied |
| as_consent_v1 | Remembers your choice from this bar, so it does not ask again on every visit. | Necessary | 12 months |
| as_pay_lang | Remembers which language you ordered in, so the page after payment comes back in the same one. | Necessary | Until the payment is finished |
| as_pay_no | Holds the order number so the thank-you page can show it to you. | Necessary | Until the payment is finished |
As of today the site loads no analytics or advertising tools at all — no Google Analytics, no Meta pixel, no third-party counters. The “Analytics” and “Marketing” categories in the bar are off and do nothing. They are there because if we ever add such a tool, it will load only after your explicit consent, not silently.
You can also clear local storage and cookies from your browser settings. If you do, your cart will empty and the bar will ask you again.
07Your rights
Under the General Data Protection Regulation you have the right to request:
- access — what data of yours we process and why;
- rectification of inaccurate or incomplete data;
- erasure, where there is no longer a ground to keep it;
- restriction of processing while a disputed point is being settled;
- portability — to receive your data in a machine-readable form;
- objection to processing that rests on legitimate interest;
- withdrawal of consent at any time — withdrawal does not affect the lawfulness of processing before it.
Write to zax12@abv.bg or call 0878 141 487. We answer within one month. If the request is complex, the term may be extended by two more months — in that case we will tell you why.
Some data we cannot erase while the statutory retention period for accounting documents is still running. In that case we will explain what and until when.
Complaint to the supervisory authority
If you believe we have breached your rights, you may lodge a complaint with the Commission for Personal Data Protection: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., tel. +359 2 915 3518, www.cpdp.bg. You would do us a kindness by coming to us first — most things are settled with a single phone call.
08Security
The connection to the site runs over HTTPS. Access to order data is limited to the people who need it in order to fulfil the order. We do not store bank card data — it never enters our site at all.
No system is invulnerable. If a security breach nevertheless occurs that puts your rights at risk, we will notify the Commission for Personal Data Protection within 72 hours and will notify you too, where the law requires it.
09Changes to this policy
This policy changes when the way we work changes — a new provider, a new payment method, a new tool. The current version always sits at this address, and the date of the last revision is marked below.
Where a material change affects you, we will tell you visibly on the site.
Last revised: 28 August 2026