Privacy policy
1. Who we are and who this policy applies to
This Policy applies to visitors, registered users, customers, people submitting inquiries, and recipients of gift vouchers of the online shop shop.flagfactory.bg. It is informational in nature and not a contract — you do not need to agree to it in order to shop with us. Where processing is based on consent, that consent is requested separately, for a specific purpose.
Controller: Flag Factory Ltd, company reg. no. (EIK) 206056488
Address: 99 Borisova St., Ruse, Bulgaria
Email: info@flagfactory.bg · Phone: +359 886 652 265
2. What data we process, and where we get it from
We process: your name and contact details; delivery address; customer account data (account, address book, order history); order details; print files you upload; payment and invoicing information; correspondence and complaint records; marketing preferences; technical data (IP address, browser); and, once you consent to cookies, analytics and advertising data.
We obtain most data directly from you — during registration, when placing an order, submitting an inquiry, filing a complaint, or uploading a file. Some technical data is collected automatically when you visit the site. In limited cases we receive data about a third party from you — for example, the name and email of a gift voucher recipient, or of another parcel recipient. In these cases, we inform that person no later than the first message we send them.
3. What we use it for, and on what basis
- Customer account and address book — performance of a contract
- Accepting and fulfilling orders, including production of print files — performance of a contract
- Invoicing and accounting — legal obligation
- Processing and confirming payment (via DSK Virtual POS) — performance of a contract; accounting for the payment — legal obligation; fraud prevention — legitimate interest
- Delivery via Econt and other courier partners — performance of a contract
- Responding to inquiries — pre-contractual steps at your request, or legitimate interest for general questions
- Complaints and returns — performance of a contract and legal obligation; retaining evidence in case of a dispute — legitimate interest
- Site security and abuse prevention — legitimate interest
- Newsletter — only with separate, freely given consent, which you can withdraw at any time via the unsubscribe link or at info@flagfactory.bg
- Analytics and advertising services (Google Analytics, Google Ads, Meta) — after your consent via the cookie banner
Your name, contact details and delivery address are required to fulfil your order. Invoicing details are only needed if you request an invoice. Newsletter consent is entirely voluntary and does not affect your ability to shop with us.
4. Print files and third-party data
We use the files you provide solely to prepare, produce, verify and, where needed, re-produce your order. Where your files contain images or personal data of other individuals, you must hold the necessary rights and legal basis to provide them and, where required, must have informed those individuals.
Please do not include national ID numbers, copies of identity documents, health data, or other special categories of personal data in your files, unless strictly necessary and agreed with us in advance. We do not use customer files for advertising, our portfolio, or publication without separate permission.
5. Who we share data with, and international transfers
We share data only where necessary with: courier partners (e.g. Econt); DSK Virtual POS — for payment processing; our accountant; our hosting and email providers; IT support; Google and Meta — for analytics and advertising services; and, where legally required, competent public authorities. Where a provider processes data on our behalf, our relationship is governed by an Art. 28 GDPR agreement. Banks, payment institutions and couriers may also process the data provided to them as independent controllers, under their own policies.
Some of these providers (e.g. Google, Meta) may process data outside the European Economic Area, based on a European Commission adequacy decision or standard contractual clauses. You can request more information at info@flagfactory.bg.
6. How long we keep your data
- Accounting registers, financial statements and tax-audit documents — 10 years from 1 January of the following reporting year; other accounting records — 3 years (Bulgarian Accounting Act)
- Inactive customer account — 36 months from last activity
- Abandoned or incomplete order — 90 days
- Inquiry or unaccepted quote — 24 months after the correspondence is closed
- Print production files — 24 months after order completion
- Technical logs — per our hosting configuration
- Backups — per our backup cycle
- Complaints — until applicable statutory limitation periods expire
7. Cookies, analytics services and profiling
We use cookies via Cookiebot — strictly necessary cookies (which operate without requiring consent), analytics cookies (Google Analytics) and advertising cookies (Google Ads, Meta). Analytics and advertising technologies only load after you explicitly select "Allow all" in the cookie banner; if you select "Deny", they remain blocked. The embedded map on the Contact page (Google Maps) follows the same principle and loads only after the corresponding consent. You can change or withdraw your choice at any time from the banner settings.
Detailed information about the specific cookies we use — including their name, purpose, provider and duration — is available in our Cookie Policy.
The company does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
8. Your rights, security, complaints and changes
You have the right to access, rectify, erase, restrict the processing of, and port the data you provided (where processing is automated and based on consent or a contract). You can object to processing based on legitimate interest, on grounds relating to your situation, and unconditionally object to direct marketing. Where processing is based on consent, you can withdraw it at any time. Some data cannot be deleted before statutory retention periods expire — for example, data in accounting documents.
To exercise your rights, write to us at info@flagfactory.bg. We respond within one month, which may be extended by a further two months for complex cases, after notifying you. Exercising your rights is generally free of charge.
We apply appropriate technical and organizational measures to protect your data, including an encrypted HTTPS connection, access control, and password hashing.
You have the right to lodge a complaint with the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, email: kzld@cpdp.bg.
This Policy may be updated from time to time. The current version and its effective date are always published on this page.