Privacy policy
PRIVACY POLICY
Last updated: 22 July 2026
This Privacy Policy describes how AURABABY EOOD collects, uses, stores, and shares personal data when you visit or use the AuraBaby online store, make a purchase, create a customer account, subscribe to marketing communications, or contact us.
The online store is available at https://aurababy.bg and uses the Shopify platform.
DATA CONTROLLER
The controller responsible for processing your personal data is:
AURABABY EOOD
Unified Identification Code (UIC): 208460488
Address: 18A Starozagorsko Vastanie St., 6000 Stara Zagora, Bulgaria
Email: info@aurababy.bg
Phone: +359 877 342 846
Website: https://aurababy.bg
Hereinafter referred to as “AuraBaby”, “we”, “us”, or “the Controller”.
PERSONAL DATA WE PROCESS
Depending on how you use the online store, we may process the following categories of personal data:
Identification and contact information:
• first and last name;
• shipping and billing address;
• email address;
• telephone number;
• company details and UIC/VAT number when an invoice is requested.
Order and transaction information:
• products ordered, viewed, returned, or exchanged;
• selected sizes, colours, and variants;
• text provided for personalisation or embroidery;
• order number, date, value, and status;
• selected delivery and payment method;
• history of orders, returns, and complaints.
Payment information:
• type of payment method used;
• payment status and confirmation;
• payment transaction identifier;
• limited information provided by the payment service provider.
Full payment card details are processed by the relevant payment service provider. AuraBaby does not store the full card number, security code, or other complete card details.
Customer account information:
• username or email address;
• settings and preferences;
• information relating to the security and management of the account.
Communication information:
• the content of enquiries, emails, and messages;
• information provided during customer service, a return, complaint, or dispute;
• photographs and other documents that you voluntarily send to us.
Technical information:
• IP address;
• device type, operating system, and browser;
• device and session identifiers;
• network connection information;
• information about the use of and navigation through the website;
• interactions with advertisements, emails, and store features;
• information collected through cookies and similar technologies.
SOURCES OF PERSONAL DATA
We may obtain personal data:
• directly from you when you place an order, register, subscribe, or communicate with us;
• automatically from your device when you use the website;
• from Shopify and applications connected to the online store;
• from payment service providers;
• from courier and logistics partners;
• from providers of analytics, advertising, technical, and customer services;
• from social networks or other platforms when you interact with our profiles or advertisements.
PURPOSES AND LEGAL BASES FOR PROCESSING YOUR DATA
Performance of a contract or steps taken before entering into a contract
We process personal data to:
• accept, confirm, and fulfil your order;
• process your payment;
• produce a personalised product;
• arrange delivery;
• send information about the status of your order;
• process returns, exchanges, refunds, and complaints;
• create and manage a customer account;
• provide customer support.
Compliance with a legal obligation
We process and retain certain information when necessary to:
• comply with accounting and tax obligations;
• issue and retain invoices and other accounting documents;
• protect consumer rights;
• handle complaints and statutory guarantees;
• comply with a lawful request from a court, supervisory authority, or public authority.
Legitimate interests
We may process personal data on the basis of our legitimate interests in order to:
• protect the online store, our customers, and our information systems;
• prevent and detect fraud and misuse;
• establish, exercise, or defend legal claims;
• improve the website, products, and customer service;
• conduct aggregated analyses of the online store’s performance;
• maintain necessary business correspondence.
When relying on a legitimate interest, we assess whether that interest is overridden by your rights and interests.
Consent
Where consent is required by law, we process personal data for:
• sending marketing emails or messages;
• using optional analytics and advertising cookies;
• personalised advertising;
• other purposes for which we have expressly requested your permission.
You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
MARKETING AND ADVERTISING
If you have provided the necessary consent, we may send you news, offers, and product information by email or through another channel selected by you.
You may unsubscribe from marketing emails at any time by using the unsubscribe link in the relevant message or by contacting us at info@aurababy.bg.
Unsubscribing from marketing communications does not affect service messages relating to orders, payments, deliveries, customer accounts, security, or compliance with legal obligations.
Personalised advertising and cross-site tracking are used only where permitted by applicable law and in accordance with your cookie choices.
COOKIES AND SIMILAR TECHNOLOGIES
The website uses cookies and similar technologies that are necessary for:
• the operation and security of the online store;
• saving the shopping cart and selected settings;
• signing in to and managing a customer account;
• processing orders and payments.
With your consent, additional cookies may be used for:
• analysing visits to and use of the online store;
• measuring the effectiveness of advertisements;
• personalising content and advertising messages.
You can manage your choices through the cookie banner or cookie settings on the website. You may also restrict cookies through your browser, but doing so may prevent certain features from functioning correctly.
Detailed information about the categories of cookies used and your preferences is provided through the consent management tool available in the online store.
WHO WE SHARE PERSONAL DATA WITH
We share personal data only when necessary for the operation of the online store, fulfilment of an order, compliance with a legal obligation, or another lawful purpose.
Recipients may include:
• Shopify, which provides the online store platform and hosting;
• payment processors, banks, and payment service providers, including Shopify Payments and PayPal, when the relevant payment method is used;
• courier and logistics companies, including Speedy and BOX NOW, when selected for delivery;
• providers of IT, cloud, analytics, marketing, and customer services;
• accountants, auditors, lawyers, and other professional advisers;
• public authorities, courts, and supervisory authorities where required by law;
• a new owner or successor in the event of a reorganisation, sale, or transfer of the business, subject to the applicable requirements.
We do not sell our customers’ personal data.
Our service providers process personal data in accordance with applicable law and their contractual confidentiality and security obligations.
OUR RELATIONSHIP WITH SHOPIFY
The online store is hosted and operated through Shopify. Shopify processes information relating to access to the store, use of the services, orders, and the technical operation of the platform.
To provide and improve its services, information may be shared with Shopify and its subcontractors.
When certain advanced features are used, Shopify may independently determine the purposes and means of specific processing activities. Further information is available in Shopify’s Consumer Privacy Policy:
https://www.shopify.com/legal/privacy/app-users
Requests concerning data processed by Shopify in this capacity may also be submitted through:
INTERNATIONAL DATA TRANSFERS
Shopify and some service providers may process or store personal data outside Bulgaria or the European Economic Area.
Where data is transferred to a country for which the European Commission has not adopted an adequacy decision, appropriate safeguards are used. These may include the European Commission’s Standard Contractual Clauses, supplementary security measures, or another legally recognised transfer mechanism.
DATA RETENTION
We retain personal data only for as long as necessary for the purposes for which it was collected and to comply with our legal obligations.
When determining the retention period, we take into account:
• the duration of the contractual relationship;
• the periods applicable to returns, complaints, and statutory guarantees;
• accounting and tax requirements;
• applicable limitation periods;
• the need to prevent fraud and defend legal claims;
• your marketing preferences.
When personal data is no longer required, it is deleted, anonymised, or restricted to the extent required by law.
SECURITY
We implement appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration, disclosure, or destruction.
However, no system or method of transmitting information over the internet can guarantee absolute security. Please do not send sensitive or complete payment information by ordinary email or through other unsecured channels.
When using a customer account, you are responsible for keeping your login details confidential.
CHILDREN’S DATA
The online store is intended for purchases by adults and is not directed at children.
We do not knowingly collect personal data directly from children. If you believe that a child has provided us with personal data without the necessary consent, please contact us at info@aurababy.bg so that we can take the appropriate action.
A name or other text provided by an adult customer to personalise a gift or product is used solely to fulfil the relevant order.
LINKS TO EXTERNAL WEBSITES
The website may contain links to platforms and websites operated by third parties.
We do not control their privacy practices and are not responsible for their content or security. We recommend reviewing the privacy policy of the relevant third party.
YOUR RIGHTS
Under applicable law, you have the right:
• to obtain confirmation as to whether we process your personal data;
• to access and obtain a copy of your personal data;
• to request the correction of inaccurate or incomplete data;
• to request the deletion of your data where the legal requirements are met;
• to request restriction of processing;
• to object to processing based on legitimate interests;
• to object to direct marketing at any time;
• to receive the data you have provided in a structured, commonly used, and machine-readable format and, where applicable, to request its transfer;
• to withdraw your consent at any time;
• not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you, where this right applies;
• to lodge a complaint with the competent supervisory authority.
These rights are not absolute and may be restricted in circumstances provided by law, for example when we are legally required to retain the data or when it is needed to defend legal claims.
HOW TO EXERCISE YOUR RIGHTS
You can submit a request to:
Email: info@aurababy.bg
Address: AURABABY EOOD, 18A Starozagorsko Vastanie St., 6000 Stara Zagora, Bulgaria
Please describe your request clearly enough and provide information that enables us to determine which data it concerns.
To protect your personal data, we may request additional information to confirm your identity. We will not request more information than is necessary for this purpose.
We will respond within the period prescribed by applicable law. Exercising your rights is generally free of charge, except where otherwise expressly provided by law.
COMPLAINTS
If you have a complaint about how we process your personal data, you may first contact us at info@aurababy.bg.
You have the right to lodge a complaint with:
Commission for Personal Data Protection (CPDP/KZLD)
Bulgarian name: Комисия за защита на личните данни
Address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
Email: kzld@cpdp.bg
Website: https://cpdp.bg
You may also lodge a complaint with the supervisory authority in another country of the European Economic Area where you usually reside, work, or where the alleged infringement took place.
CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy periodically to reflect changes to our services, the service providers we use, or applicable legal requirements.
The current version will be published on this page together with the date of the latest revision. Where required by law, we will provide additional notice.
CONTACT
For questions about privacy or to exercise your rights:
AURABABY EOOD
Unified Identification Code (UIC): 208460488
Address: 18A Starozagorsko Vastanie St., 6000 Stara Zagora, Bulgaria
Email: info@aurababy.bg
Phone: +359 877 342 846