Privacy policy

Last updated: 12 October 2026

1. Who Processes Your Personal Data

The data controller is Sladko Ltd, company registration number 207467065, with its registered office and correspondence address at: Bulgaria, Sofia, Iskar District, Tsarigradski Complex, Building 281, Entrance V.

For questions or to exercise your rights, contact us at contact@sladkopastry.com or +359 888 666 432.

2. What Data We Process and Why

When you use sladkopastry.com, we process:

  • Order data: name, phone number, email address, address, billing details, and order and payment information - to enter into and fulfil your contract and comply with accounting and tax obligations. Payment card details are processed by the relevant payment provider.
  • Enquiries and complaints: contact details, messages and attachments you provide - to respond, provide customer service and fulfil contractual or legal obligations.
  • Marketing subscriptions: email address and consent records - to send marketing messages through Shopify with your consent.
  • Technical data: IP address, device, browser and website interactions - for security and, with your consent to the relevant technologies, analytics through Google Analytics and marketing through Meta Pixel.

For general enquiries, security and the defence of legal claims, we may process data based on our legitimate interests in serving customers and protecting our business, taking your rights into account.

Providing the data necessary for your order is required for us to fulfil it. Consent to marketing and non-essential cookies is not a condition of purchase.

3. Recipients of Your Data

We do not sell your personal data. We share necessary information with Shopify, payment and delivery providers, accounting and technical service providers, and competent authorities where required by law.

With the relevant consent, data is also processed by Google through Google Analytics and Meta through Meta Pixel for analytics, advertising measurement and remarketing.

These services may involve processing outside the European Economic Area, subject to applicable GDPR safeguards, including adequacy decisions and standard contractual clauses. 

4. Retention Periods

  • Orders and accounting documents: for the applicable statutory periods and as necessary to establish, exercise or defend legal claims.
  • Enquiries that do not lead to an order: up to six months after the last communication, unless a dispute or legal obligation requires longer retention.
  • Marketing subscriptions: until consent is withdrawn or the relevant activity ends. Limited records may be retained to demonstrate and respect your preferences.
  • Cookies and analytics data: according to the lifetimes of the relevant technologies and the applicable retention settings.

Once the applicable retention period ends, data is deleted or anonymised.

5. Cookies

We use strictly necessary technologies for website functionality and security, as well as non-essential technologies for preferences, analytics and marketing.

Non-essential technologies, including Google Analytics and Meta Pixel, are activated after you provide consent. You can accept, reject or change your choices at any time through the website’s cookie settings.

Information about the specific technologies, providers and their lifetimes is available through these settings. Rejecting non-essential technologies does not prevent you from placing an order.

6. Your Rights

Subject to the conditions set out in the GDPR, you have rights of access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, email contact@sladkopastry.com. Where necessary, we may request confirmation of your identity. We normally respond within one month. If necessary, this period may be extended by a further two months, and we will inform you of the extension and its reasons within the first month.

You can unsubscribe from marketing emails using the link in the message or by contacting us. This does not stop necessary communications about your orders.

7. Security and Updates

We apply appropriate technical and organisational measures to protect personal data and restrict access on a need-to-know basis.

When changes occur, we update this policy and the date shown at the beginning. Where new consent is required, we request it separately.