Privacy policy
Who Are We?
"BG KITS GROUP" Ltd. (the "Merchant") is a company registered under the Commercial Act of the Republic of Bulgaria, UIC: 208155652, with a registered address in Sofia, Mladost district, Block 364, Entrance 2, Floor 9. It acts as a personal data controller under the applicable personal data protection laws.
Contact Information
• Email: store@kitsbg.com
• Phone: +359 888 825 485
What Does This Privacy Policy Include?
This policy explains in clear and accessible language:
• Who we collect and process personal data from;
• What personal data we collect;
• Why we collect it;
• How long we store it;
• With whom we share it;
• How we inform you of policy updates;
• Your rights concerning your data.
The Merchant confirms it applies all technical and organizational security measures required by national and EU law.
What Is Personal Data?
Personal data is any information that can directly or indirectly identify a natural person. Indirect identifiers may include phone numbers; direct identifiers include unique personal identifiers like a national identification number.
What Personal Data Is Collected?
"BG KITS GROUP" Ltd. and "BG KITS" Ltd., being part of the same corporate group, share a customer database.
Collected data includes:
• Name, gender, email, phone number, delivery address – when placing an order;
• Email – when subscribing to newsletters;
• Size – when ordering a Mystery Box;
• Personal ID number or foreign equivalent (if applicable) – when issuing invoices or processing returns;
• IBAN and name – for refunds;
• Company UIC/BULSTAT and representative – for corporate invoices.
No sensitive personal data (racial, ethnic, political, religious, genetic, biometric, health, or sexual orientation) is collected or processed.
Video Surveillance
The Merchant uses surveillance in its physical store. Images and timestamps are recorded, allowing individual identification. Surveillance operates 24/7.
Legal basis: Art. 6(1)(f) of the GDPR – the Merchant’s legitimate interest to protect its property and that of its landlord, and ensure health and safety on the premises.
Legal Grounds for Processing
Personal data is processed:
• On a contractual basis – for fulfilling orders and services;
• With explicit consent – for marketing, surveys, newsletters, etc.;
• To comply with legal obligations;
• Based on legitimate interest, unless overridden by the rights of the data subject.
Consent can be withdrawn at any time by emailing store@kitsbg.com.
Data Storage Period
Data is stored for 5 years from the end of the contractual relationship, unless legal obligations require longer retention (e.g., accounting records).
After this period, data is securely destroyed or permanently deleted from all systems.
Data Sharing
Personal data is not shared with third parties without consent, except where necessary to:
• Fulfill contractual obligations (e.g., courier services);
• Allow subcontractors (e.g., accountants, legal advisors) to perform their services.
Data may also be disclosed upon request by competent authorities under Bulgarian and EU law.
All recipients ensure adequate data protection, including entities outside the EU/EEA that comply with applicable standards.
User Rights Under GDPR
Users have the right to:
• Access their personal data and obtain a copy;
• Request corrections or updates;
• Block or restrict data processing;
• Request data deletion (“right to be forgotten”);
• Object to processing for direct marketing;
• Withdraw consent at any time;
• Request data portability;
• File a complaint with the Commission for Personal Data Protection.
Rights may be exercised at any time during the data processing period.
Definitions of Rights
• Right of access – to learn what data is held and for what purpose.
• Right to rectification – to correct inaccuracies or outdated data.
• Right to erasure/blocking – to remove unlawful or unnecessary data.
• Right to object – to data use for direct marketing or if no legal basis exists.
• Right to data portability – to receive structured data and transfer it to another controller.
Exercising these rights must not conflict with other legal obligations or infringe on third-party rights.
Filing a Complaint
Users may file complaints with the Commission for Personal Data Protection within one year of becoming aware of a violation and no later than five years from the date of the violation. Legal action is also possible through the courts.
Google Analytics and Google Ads
If you allow analytics and/or advertising cookies in the cookie bar, the Site uses Google Analytics 4 and Google Ads (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC) for visit and purchase statistics, for measuring purchases made after clicking our ads and for showing more relevant ads. Legal basis: your consent (Art. 6(1)(a) of Regulation (EU) 2016/679), which you can withdraw at any time on the Cookie Policy page.
Enhanced conversions (Google Ads): after an order, the email, phone number, name and delivery address of the order are irreversibly encoded (SHA-256) in your browser and sent to Google only if you have allowed advertising cookies. Google uses them only to measure whether the order followed a click on our ad.
Product data (no personal data) is provided to Google Merchant Center to show our products on Google.
More about how Google processes data: policies.google.com/privacy
Policy Updates
The current Privacy Policy is available on the Site. Users will be notified of changes via announcements on the Site and in-store.
These Terms and Conditions, Cookie Policy, and Privacy Policy were last updated on: 08.10.2026.
This text is part of the kitsbg.com Terms and Conditions.