Privacy Policy

🔐 Privacy Policy
 Last updated: 16.07.2025

This Privacy Policy outlines how personal data is collected, processed, stored, and protected when you access and use our website, https://gentletea.eu. It also describes your rights under Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR).

1. Data Controller

Company Name: VR27 Ltd.
 Company ID (UIC): 208139114
 Registered Office: 67 Aleksandar Stamboliyski Street, Krasen Village, Bulgaria
 Correspondence Address: 67 Aleksandar Stamboliyski Street, Krasen Village, Bulgaria
 Telephone: +359 876 822 991
 Email: info@gentletea.eu
 Website: www.gentletea.eu

Supervisory Authority for Data Protection:
 Name: Commission for Personal Data Protection
 Head Office Address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
 Correspondence Address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
 Telephone: +359 2 915 3 518
 Website: www.cpdp.bg

VR27 Ltd. (hereinafter referred to as the “Controller” or the “Company”) processes personal data in accordance with the Personal Data Protection Act of the Republic of Bulgaria and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. The present policy aims to provide transparent information regarding the manner in which the Company processes personal data and to inform data subjects of their legal rights.

2. Categories of Personal Data Collected

When you access and interact with our website, we may collect the following categories of personal data:

🔸 When placing an order:
 – Full name
 – Email address
 – Telephone number
 – Shipping and/or billing address
 – Payment information (processed securely via third-party providers such as Stripe or Shopify Payments)

🔸 When subscribing to our newsletter:
 – Email address
 – Name (if voluntarily submitted)

🔸 Automatically, through cookies and analytics tools:
 – IP address
 – Device and browser information
 – Browsing history and user behavior on the website

3. Purpose and Legal Basis for Processing Your Personal Data

Legal grounds for the collection, processing, and storage of your personal data

Article 1. The Controller collects and processes your personal data in connection with your use of the online store at www.gentletea.eu and the conclusion of contracts with the Company, based on Article 6(1) of Regulation (EU) 2016/679 (GDPR), and in particular on the following grounds:

– Your explicit consent as a customer
 – The performance of contractual obligations undertaken by the Controller
 – Compliance with a legal obligation to which the Controller is subject
 – The legitimate interests pursued by the Controller or a third party

Your personal data may be processed for the following purposes:
 – Order processing and delivery
 – Order confirmation and related notifications
 – Customer service and responding to inquiries
 – Enhancing the overall user experience
 – Sending marketing communications (with your prior consent)
– Complying with legal obligations (e.g., tax and accounting requirements)

Purposes and principles of data collection, processing, and storage

Article 2.
 (1) The personal data you provide when using our online store or entering into a remote sales agreement may be processed for the following purposes:

– Establishing and performing a distance contract
 – Verifying the identity of the contracting party
 – Accounting and statistical analysis
 – Ensuring data and system security
 – Providing the relevant service or product
 – Sending newsletters (if explicitly requested by you)

(2) When processing personal data, the Controller adheres to the following principles:

– Lawfulness, fairness, and transparency
 – Purpose limitation
 – Data minimization
 – Accuracy and up-to-date data maintenance
 – Storage limitation to what is necessary for the purposes
 – Ensuring integrity, confidentiality, and appropriate security

(3) In processing and storing personal data, the Controller may act to protect the following legitimate interests:

– Fulfilling obligations to public authorities such as the National Revenue Agency, the Ministry of Interior, or other government and municipal institutions

4. Types of Personal Data Collected, Processed, and Stored by the Company

Article 3.
 (1) The Company carries out the following operations with the personal data you provide, for the purposes listed below:

  • Performance of a distance sales contract – the purpose of this operation is to create a user profile for the use of the online store in order to purchase goods, and to provide contact details for the delivery of purchased goods.
  • Conclusion and performance of a commercial transaction with a client or partner – the purpose of this operation is to conclude and execute a contract with a business partner or client and to administer it.
  • Sending of a newsletter – the purpose of this operation is to administer the process of sending newsletters to customers who have indicated they wish to receive them.
  • Exercising the right of withdrawal or submitting a complaint – the purpose of this operation is to manage the process of exercising the right of withdrawal or lodging a complaint by the customer.

(2) The Controller processes the following categories of personal data and information for the following purposes and on the following legal bases:

  • Your identifying data (email address, name, etc.)
     Purpose for data collection:
    1. To enable communication with the user and to send information;
    2. For the purposes of registering a user in the online store;
    3. For the distribution of a newsletter.
  • Legal basis for processing your personal data:
     By accepting the General Terms and Conditions and registering in the online store, or by placing an order without registration, or upon the conclusion of a written contract, a contractual relationship is established between the Controller and you, which forms the legal basis for processing your personal data – Article 6(1)(b) of the GDPR.
     Your data for receiving the newsletter is processed based on your explicit consent – Article 6(1)(a) of the GDPR.
  • Data for order delivery (name, phone number, address, etc.)
     Purpose for data collection: To fulfil the Controller’s obligations under the distance sales contract and ensure delivery of the purchased goods.
     Legal basis for processing your personal data:
     By accepting the General Terms and Conditions and registering in the online store, or by placing an order without registration, or upon the conclusion of a written contract, a contractual relationship is established between the Controller and you, which forms the legal basis for processing your personal data – Article 6(1)(b) of the GDPR.
  • Additional data provided by you – If you wish to supplement your profile, you may include your name, surname, and telephone number.

     Purpose for data collection: To supplement the information related to the user in their personal account.
     Legal basis for data processing:
     You have given explicit consent for your personal data to be processed for one or more specific purposes – Article 6(1)(a) of the GDPR, at the time of registration in the online store.
    The provision of such data is not mandatory for registration in the online store.

(3) The Controller does not collect or process personal data that reveals:

  • racial or ethnic origin;
  • political opinions, religious or philosophical beliefs, or trade union membership;
  • genetic and biometric data, data concerning health, or data about a person’s sex life or sexual orientation.

(4) The personal data is collected by the Controller from the individuals to whom it relates.

(5) The Company does not engage in automated decision-making using data.

Article 4.
 (1) The personal data is collected by the Controller from the individuals to whom it pertains and from the Commercial Register maintained by the Registry Agency.

(2) The Company does not engage in automated decision-making using data.

Article 5.
 The Controller may use so-called "cookies" for the purposes of ensuring the full functionality of the website, improving the user experience, statistical analysis, facilitating access, and other related goals. By using our website, you agree to the use of cookies.
You may control and/or delete cookies at any time via your browser settings. Cookies do not constitute personal data and are not used to identify visitors or users of the online store.

5. Data Retention Period

Article 6.

(1) The Controller retains your personal data for no longer than the duration of your profile’s existence in the online store. Upon deletion of your profile, the Controller shall take the necessary steps to erase and destroy all of your personal data without undue delay, or to anonymize it (i.e. to convert it into a form that does not reveal your identity).

(2) The Controller processes personal data you have provided when placing an order without registration in the online store only until the order is fulfilled, unless you have given your explicit consent for the data to be processed for the purposes of improving the service, offering personalized content, individual terms, promotions, and for statistical analysis.

(3) The Controller retains your personal data provided in relation to completed online orders for a period of 5 years for the purpose of protecting the Controller’s legal interests in the event of judicial or administrative disputes with users of the online store.

(4) The Controller shall notify you if the data retention period must be extended due to a legal obligation, legitimate interest of the Controller, or any other valid reason.

(5) The Controller retains personal data that must be stored under applicable legislation for the relevant statutory period, which may exceed the duration of your profile’s existence in the online store or the completion of the order.

Article 7.
The Controller retains the personal data of the legal representatives of its business partners for the duration of the contract, in order to comply with its legitimate interests and legal obligations. This retention period may exceed the term of the contract itself.

6. Your Rights

Your rights regarding the collection, processing, and storage of your personal data

Withdrawal of consent for processing your personal data

Article 9.

(1) If you do not wish the personal data you have provided to be processed for marketing purposes and for receiving newsletters, you may withdraw your consent for such processing at any time by submitting a free-text request via email.

(2) Upon receiving your request, we will send an email to the address you have provided for receiving newsletters and marketing messages, containing detailed instructions for verifying your identity as the newsletter recipient and the data subject for whom the withdrawal of consent has been requested.

(3) The withdrawal of consent does not affect the lawfulness of the processing carried out by the Controller prior to the withdrawal.

Right of access

Article 10.

(1) You have the right to request and receive confirmation from the Controller as to whether personal data relating to you is being processed, by submitting a free-text request via email.

(2) You have the right to access the data relating to you, as well as information regarding the collection, processing, and storage of your personal data.

(3) Upon receiving your request, we will send an email to the address you used to register or place orders in the online store, containing detailed instructions for verifying your identity as the data subject requesting access.

(4) After the verification process referred to in paragraph 3 is completed, the Controller will provide, upon request, a copy of the personal data being processed, in electronic or other appropriate format.

(5) Access to the data is provided free of charge; however, the Controller reserves the right to impose an administrative fee in cases of repeated or excessive requests.

Right to rectification or completion

Article 11.

(1) You may at any time rectify or complete inaccurate or incomplete personal data related to you via the “Edit Profile” option.

(2) You may rectify or complete inaccurate or incomplete personal data related to you directly through your profile on the website or by submitting a free-text request to the Controller via email.

Right to erasure (“right to be forgotten”)

Article 12.

(1) You have the right to request the Controller to delete some or all personal data relating to you, and the Controller has the obligation to do so without undue delay when one of the following grounds applies:

  • the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
  • you withdraw your consent on which the processing is based, and there is no other legal ground for the processing;
  • you object to the processing of personal data concerning you, including for direct marketing purposes, and there are no overriding legitimate grounds for the processing;
  • the personal data has been unlawfully processed;
  • the personal data must be erased in order to comply with a legal obligation under EU law or the law of a Member State applicable to the Controller;
  • the personal data has been collected in relation to the offer of information society services.

(2) The Controller is not obliged to erase personal data if it processes and stores the data:

  • for the exercise of the right of freedom of expression and information;
  • for compliance with a legal obligation that requires processing under EU law or the law of a Member State applicable to the Controller or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
  • for reasons of public interest in the area of public health;
  • for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes;
  • for the establishment, exercise, or defense of legal claims.

(3) To exercise your right to be forgotten, you must submit a free-text request for the deletion of your personal data processed by the Controller via email. The Controller will then send an email to the address you used to register or place orders in the online store, with detailed instructions for verifying your identity as a customer of the store and as the data subject whose data deletion is requested.

(4) After verifying the identity of the requester and confirming that the request pertains to the same person in accordance with the instructions provided, we will delete all personal data we process about you in accordance with paragraph 3.

(5) If you have placed an order that is currently being processed, the earliest time at which you may request to be “forgotten” is upon the successful completion of that order.

Right to restriction of processing

Article 13.

(1) You have the right to request the Controller to restrict the processing of personal data concerning you by sending a free-text request via email when:

  • you contest the accuracy of the personal data, for a period enabling the Controller to verify the accuracy of the personal data;
  • the processing is unlawful, but you oppose the erasure of the personal data and request the restriction of its use instead;
  • the Controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise, or defense of legal claims;
  • you have objected to processing pending the verification of whether the Controller’s legitimate grounds override yours.

(2) Upon receiving your request, we will send an email to the address you used to register or place orders in the online store, containing detailed instructions for verifying your identity as a customer of the store and data subject requesting the restriction of processing.

(3) After the verification referred to in paragraph 2 is completed, the Company will suspend the processing of your data but will not remove any content you have posted in the online store, if applicable.

Right to data portability

Article 14.

(1) If you have given your consent for the processing of your personal data, or if the processing is necessary for the performance of a contract with the Controller, or if your data is processed by automated means, you may:

  • request that the Controller provide your personal data in a readable format and transfer it to another controller;
  • request that the Controller transfer your personal data directly to a controller specified by you, where technically feasible.

(2) You may exercise the right to data portability by sending a free-text request via email. The Controller will then send an email to the address you used to register or place orders in the online store, with detailed instructions for verifying your identity as a customer of the store and as the data subject whose data portability is requested.

(3) After the verification referred to in paragraph 2 is completed, the Company will send your data in XML format to the email address you specified.

Right to receive information

Article 15.

You may request that the Controller inform you about all recipients to whom personal data concerning you, for which rectification, erasure, or restriction of processing has been requested, has been disclosed. The Controller may refuse to provide this information if it would be impossible or would require disproportionate effort.

Right to object

Article 16.

You may object at any time to the processing of your personal data by the Controller, including when processed for profiling or direct marketing purposes.

You may exercise your rights by contacting us at: info@gentletea.eu

Your rights in case of a personal data breach

Article 17.

(1) If the Controller becomes aware of a personal data breach that may result in a high risk to your rights and freedoms, you will be informed without undue delay of the breach and the measures that have been taken or are planned to be taken.

(2) The Controller is not obliged to inform you if:

  • appropriate technical and organizational protection measures have been implemented with regard to the data affected by the breach;
  • subsequent measures have been taken that ensure the breach does not pose a high risk to your rights;
  • notification would require disproportionate effort.

7. Who has access to your data?

 Your data is shared only with third parties that are necessary for the performance of the service:

  • Courier companies (through EU Shipments and their partners)
  • Accounting company
  • Hosting and IT support (Shopify)
  • Payment systems
  • Marketing and analytics tools (Meta Pixel, Google Analytics)

All third parties are bound by a contract and comply with the requirements of the GDPR.

Parties to whom your personal data may be disclosed

Article 18.
 (1) For the purpose of processing your personal data and providing the service in its full functionality and in view of your interests, the Controller may disclose the data to the following parties acting as data processors:

Data Processor

Purpose of personal data processing

INAUT TRADE EOOD

Fulfillment of contractual obligations for delivery of purchased goods

(2) The data processors comply with all legal and security requirements for the processing and storage of your personal data.

Article 19.
 In case your rights as described above or under applicable data protection legislation are violated, you have the right to file a complaint with the Commission for Personal Data Protection, as follows:

Name: Commission for Personal Data Protection
 Registered office and business address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
 Correspondence address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
 Phone: +359 2 915 3 518
 Website: www.cpdp.bg

This Privacy Policy does not apply to applications, products, services, websites, or social media features of third parties that are accessed through links provided on our website for your convenience. We encourage you to review the privacy policy of each individual website you visit before allowing the collection of your personal data.

If we make changes to this Privacy Policy, we will publish the updated text here and indicate the date of the last revision.

COOKIE POLICY
 As an integral part of this Privacy and Data Protection Policy, VR27 Ltd. has adopted a Cookie Policy, which is published and available on the Website.