Privacy and cookies
Version 1.0 · effective [date of publication]
This notice explains how Etoile Diamonds OOD handles personal data when you visit etoilediamonds.com, create an account, place an order, write to us or subscribe to our newsletter. It is provided under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Bulgarian Personal Data Protection Act.
1. Controller
Etoile Diamonds OOD, UIC 206030970, [registered street address], Sofia, Bulgaria. Email: hello@etoilediamonds.com.
[If a data protection officer is appointed: name and contact details.]
2. What we collect, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Name, email, delivery address, phone number, order contents, prices paid, order history | To take, make, deliver and support your order; to send order and delivery emails | Performance of a contract, Art. 6(1)(b) | 10 years from the end of the year of the order, as required for accounting records under the Bulgarian Accountancy Act (Art. 6(1)(c)); order data not needed for accounting is deleted after 5 years |
| Payment status and payment reference (we never receive card details) | To confirm payment, issue refunds and prevent fraud | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) | As above |
| Account data: name, email, password (stored only as a cryptographic hash), wishlist, saved bag | To provide your account | Contract, Art. 6(1)(b) | Until you delete your account; the bag of a signed-out visitor is deleted after 90 days of inactivity |
| Messages, appointment and custom design requests (name, email, phone, message, preferences) | To answer you and prepare quotes | Steps prior to a contract, Art. 6(1)(b); legitimate interest in answering enquiries, Art. 6(1)(f) | 3 years from the last contact |
| Newsletter: email address, language, confirmation time | To send our newsletter | Consent, Art. 6(1)(a), confirmed by double opt-in | Until you unsubscribe; proof of consent for 3 years after |
| Reviews you submit: name, location, rating, text | To publish reviews | Consent, Art. 6(1)(a) | Until you ask us to remove them |
| Technical data: IP address, browser, time of request | To run and secure the Shop and limit abuse (for example repeated sign-in attempts) | Legitimate interest in a secure service, Art. 6(1)(f) | Server logs 30 days; rate-limit counters 1 day |
You are not obliged to give us personal data, but we cannot take or deliver an order without the data marked as needed at checkout.
3. Who receives your data
We use the following processors, each bound by a data processing agreement under Art. 28 GDPR:
- Google Cloud EMEA Ltd. (Ireland): hosting of the Shop, database and images, in the EU (Belgium region).
- Stripe Payments Europe, Ltd. (Ireland): payment processing. Stripe is an independent controller for the card data it collects on its checkout page.
- Resend (Plus Five Five, Inc., United States): sending of transactional emails and the newsletter.
We also share delivery data with the courier that delivers your order, and accounting data with our accountant and, where required, tax authorities. We never sell personal data.
Transfers outside the EEA. Resend is located in the United States. Transfers rely on [the EU–US Data Privacy Framework certification of the recipient / the European Commission's Standard Contractual Clauses] (to be confirmed by legal review). You can request a copy of the safeguards from us.
4. Cookies and similar technologies
We use only cookies that are strictly necessary for the Shop to work, so no consent banner is shown (Article 5(3) of Directive 2002/58/EC as transposed in Art. 4a of the Bulgarian Electronic Communications Act):
| Cookie | Purpose | Duration |
|---|---|---|
cart |
Remembers your bag | 60 days |
locale |
Remembers your language for emails and checkout | 1 year |
better-auth.session_token (and related better-auth.* cookies) |
Keeps you signed in | Session / up to 7 days |
verify_email |
Shows which address a confirmation was sent to after registration | 1 hour |
We do not use advertising, tracking or social media cookies. Your browser also stores a list of recently viewed products on your device (local storage); it never leaves your device and you can clear it in your browser settings. Stripe sets its own cookies on its checkout page for fraud prevention; see Stripe's privacy policy.
5. Your rights
You have the right to:
- access your data and receive a copy (Art. 15);
- rectify inaccurate data (Art. 16);
- erase your data (Art. 17), unless we must keep it, for example for accounting;
- restrict processing (Art. 18);
- data portability (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent at any time, for example by unsubscribing from the newsletter, without affecting earlier processing.
To exercise any right, write to hello@etoilediamonds.com. We reply within one month.
You also have the right to lodge a complaint with a supervisory authority, in particular in your member state of residence. In Bulgaria this is the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg.
6. Security
Data is transmitted over encrypted connections, stored in the EU, and accessible only to staff who need it. Passwords are stored only as salted hashes. Card details are handled solely by Stripe.
7. Automated decisions
We do not make decisions based solely on automated processing that produce legal or similarly significant effects.
8. Changes
We will publish any change to this notice here and, for significant changes, tell account holders by email.