PRIVACY POLICY

of the GetMacun online store

This Privacy Policy explains how GetMacun (hereinafter “we”, “the Controller”) collects, uses, stores and protects the personal data of users of the online store available at www.getmacun.com (hereinafter “the Site”).

We process your personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR) and applicable Bulgarian law.

By using the Site and providing your personal data, you acknowledge this Policy.

1. Contact details

For questions related to the processing of your personal data, you can contact us:

2. What personal data we collect

Depending on how you use the Site, we may collect:

  • Order and delivery data: first and last name, phone, email address, delivery address;
  • Account data (on registration): name, email, password (in encrypted form);
  • Communication data: the content of messages, enquiries and complaints you send us;
  • Payment data: we do not store full bank card details — card payments are processed by a licensed payment provider;
  • Technical data: IP address, device and browser type, data from cookies and similar technologies, and the pages you visit.

3. Purposes and legal grounds for processing

We process your personal data for the following purposes and on the following legal grounds:

  • Fulfilment of an order and contract (processing, delivery, communication about the order) — basis: performance of a contract (Art. 6(1)(b) GDPR);
  • Handling complaints and returns — basis: performance of a contract and compliance with a legal obligation;
  • Creating and managing a user account — basis: performance of a contract / consent;
  • Sending newsletters and marketing messages — basis: your explicit consent (Art. 6(1)(a) GDPR), which you can withdraw at any time;
  • Improving the Site and analysing traffic — basis: legitimate interest / cookie consent;
  • Compliance with legal obligations (accounting, etc., where applicable) — basis: legal obligation.

4. Retention periods

We store your personal data only for as long as necessary:

  • order data — for the period necessary to fulfil the order and until the statutory periods for complaints and limitation expire;
  • account data — until you delete your account;
  • marketing data — until you withdraw your consent;
  • technical data / cookies — in accordance with the periods set out in the Cookie Policy.

Once the relevant period expires, the data is deleted or anonymised.

5. Who we disclose data to

In order to provide the service, we may share your data with:

  • Courier companies — to deliver orders;
  • Payment service providers — to process payments;
  • Hosting and technical service providers — to maintain the Site;
  • Email/marketing platform providers — when sending newsletters;
  • Competent state authorities — when required by law.

All our partners process the data under a contract and in accordance with the GDPR.

6. Transfer of data outside the EU

Where you ask us to deliver an order outside the European Economic Area (EEA), we share the delivery details you provide (such as recipient name and address) with the courier, postal and, where applicable, customs authorities in the destination country, as necessary to fulfil your order.

Some of the service providers we use (for example, payment, analytics or marketing tools) may also process data outside the EEA. In such cases, the transfer takes place only where the destination country ensures an adequate level of protection, or on the basis of appropriate safeguards under the GDPR (such as the European Commission’s Standard Contractual Clauses).

7. Cookies

The Site uses cookies and similar technologies. Detailed information about the types of cookies and how to manage them is available in our Cookie Policy.

8. Your rights

Under the GDPR, you have the following rights:

  • the right to access your personal data;
  • the right to rectify inaccurate or incomplete data;
  • the right to erasure (the “right to be forgotten”);
  • the right to restrict processing;
  • the right to data portability;
  • the right to object to processing based on legitimate interest or for direct marketing purposes;
  • the right to withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal;
  • the right to lodge a complaint with the supervisory authority — the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia, www.cpdp.bg.

To exercise your rights, you can contact us at support@getmacun.com. We will respond within one month of receiving the request.

9. Data security

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure. However, the transmission of data over the internet cannot be guaranteed to be completely secure.

10. Protection of children’s personal data

The Site is not directed at persons under 18, and we do not knowingly collect personal data from minors. If we discover that we have received such data without the consent of a parent/guardian, we will delete it.

11. Changes to this Policy

We reserve the right to update this Privacy Policy. The current version is always available on the Site, with the date of last update indicated.

Last updated: 8 October 2026

© 2026 GetMacun. All rights reserved.