Privacy policy

Last updated: 23 October 2026

Who we are

The data controller is the Sofia Bears Sports Club association (Сдружение „Спортен клуб Софийските мечки“), UIC 176239687, registered at bl. 2, entr. B, fl. 2, apt. 11, Boyanska Reka St., Boyana, Vitosha district, 1616 Sofia, Bulgaria ("Sofia Bears", "we"). For any question about your personal data, write to info@sofiabears.bg.

What data we collect and why

Shop orders

When you order, you give us your name, phone number, email, delivery address, city, postcode and, if you wish, a note. We use them to confirm the order, deliver it, collect the cash payment on delivery and handle any return or complaint. Legal basis: performing our contract with you (GDPR Art. 6(1)(b)) and our legal accounting obligations (Art. 6(1)(c)).

When you contact us

If you write to us by email, call us or message us on social media, we use your details only to answer you. Legal basis: our legitimate interest in answering questions (Art. 6(1)(f)).

Technical data

To protect the site from abuse, such as repeated fake orders or attempts to guess an admin password, the server briefly uses your IP address to limit how many orders or sign-in attempts can be made. It is kept in memory for at most one hour and is not stored with your order. Legal basis: our legitimate interest in keeping the site secure.

Visit statistics

We count visits to the site to know which pages are read: the page, the site you came from, the language of the site and of your browser, your country (worked out from your IP address at the time of the visit) and the type of device (phone, tablet or computer). No cookie is used and nothing is stored on your device. To count each visitor once a day, the server derives a code from your IP address and browser with a random key that is deleted the next day; after that, the code can no longer be linked to you. Your IP address itself is not stored. Legal basis: our legitimate interest in improving the site.

We do not use your data for advertising, we do not sell it and we do not profile you.

Who receives the data

Club members who handle and deliver orders, or a courier: only the name, phone number and address needed for the delivery.
Our hosting provider (website, database and backups), with servers in the United Kingdom (London), a country recognised by the European Commission as protecting personal data adequately.
Our email delivery provider for confirmation emails, based in the United States; transfers rely on the European Commission's standard contractual clauses.
Public authorities, when the law requires it.

How long we keep data

Orders: your name, phone number, email, address and notes are erased automatically three years after delivery, or six months after an order is cancelled. We keep only the order number, items, amounts and dates, which no longer identify you, for our accounts.
Backups: erased data can remain in our database backups for about 60 more days, which are used only to restore the site after an incident.
Correspondence: until the question is settled, and no longer than 2 years.
Technical data: one hour at most.

Cookies and browser storage

The public website uses no advertising or analytics cookies. Your cart is kept only in your browser (local storage) and is not sent to us until you order. The admin area uses only the cookies needed to sign in.

YouTube videos are embedded in privacy-enhanced mode (youtube-nocookie.com), and the practice location map comes from Google Maps. When you play a video or use the map, YouTube and Google may set their own cookies under their own policies.

Your rights

You can ask to access your data, correct or erase it, restrict its use, receive it in a portable format, and object to processing based on legitimate interest. Write to info@sofiabears.bg; we will answer within one month.

You can also complain to the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, www.cpdp.bg.