PRIVACY POLICY AND PERSONAL DATA PROTECTION

Last updated: 22 September 2026

GourmetBox is committed to protecting the personal data of its customers, partners, gift recipients and visitors to gourmetbox.bg.

This Privacy Policy explains what personal data we collect, the purposes for which we process it, the applicable legal basis, how long we retain it, and your rights under Regulation (EU) 2016/679 (GDPR) and applicable Bulgarian legislation.

1. Personal Data Controller

The gourmetbox.bg website and the GourmetBox brand are operated by:

FEN SI EOOD
Unified Identification Code: 205370240
Registered office: 28 Boryana Street, Sofia, Bulgaria
Email: support@gourmetbox.bg

Hereinafter referred to as “GourmetBox”, “we”, “us” or the “Controller”.

2. Who This Privacy Policy Applies To

This Privacy Policy applies to:

visitors to gourmetbox.bg;
registered users;
individuals placing orders;
representatives and employees of corporate customers;
individuals submitting enquiries or requesting quotations;
individuals requesting a corporate sample;
gift recipients;
newsletter subscribers;
individuals who interact with us through LinkedIn, Facebook, Instagram or other communication channels.

3. Personal Data We Collect

Depending on how you use our website and services, we may process the following information:

Identification and Contact Details

first and last name;
email address;
telephone number;
delivery address;
contact details of a company representative.

Order and Payment Information

products and services included in the order;
order history;
delivery information;
details concerning issued invoices and other accounting documents;
payment status.

We do not retain complete bank card details when payments are processed by an external payment service provider.

Gift Recipient Information

When a corporate customer or ordering party provides us with a recipient’s details, we may process:

name;
telephone number;
delivery address;
personal message or other information required to fulfil the order.

This information is used solely for preparing, personalising and delivering the gift, unless another applicable legal basis exists.

Technical Information

IP address;
device and browser type;
technical log data;
cookie identifiers;
information about the use of and interaction with the website;
approximate location determined through the IP address, where applicable.

Marketing and Communication Information

consent to receive marketing communications;
communication preferences;
interaction with newsletters, publications and advertising campaigns;
information submitted through forms on social media platforms.

We do not intentionally collect special categories of personal data, such as information concerning health, religion, political opinions or biometric data.

4. Sources of Personal Data

We receive personal data:

directly from you;
through an order, registration or form submitted on gourmetbox.bg;
by email, telephone or during personal communication;
through a corporate customer who instructs us to deliver a gift to a particular recipient;
through LinkedIn Lead Gen Forms;
through Facebook, Instagram and other social media platforms;
through cookies and analytics technologies where you have provided the required consent;
from payment providers, courier companies or other service providers where this is necessary to fulfil an order.

When you provide us with another person’s details, you must have a lawful basis for doing so and must inform that person that their information has been provided to GourmetBox.

5. Purposes and Legal Bases for Processing Personal Data

We process personal data for the following purposes:

Processing and Delivering Orders

Legal basis: performance of a contract or taking steps at your request before entering into a contract.

Preparing Quotations and Corporate Proposals

Legal basis: taking steps at your request before entering into a contract and our legitimate interest in responding to business enquiries.

Issuing Invoices and Accounting Documents

Legal basis: compliance with legal obligations.

Communicating with Customers and Partners

Legal basis: performance of a contract, taking steps before entering into a contract, or our legitimate interest in managing enquiries and customer relationships.

Providing a Corporate Sample

Legal basis: taking steps at your request and our legitimate interest in assessing and developing potential corporate relationships.

Creating and Managing a User Account

Legal basis: performance of a contract and provision of the requested functionality.

Improving the Website, Services and User Experience

Legal basis: our legitimate interest or, where analytics or advertising cookies are used, your prior consent.

Sending Newsletters and Marketing Communications

Legal basis: your consent.

You may withdraw your consent at any time by using the unsubscribe link included in the relevant communication or by contacting us at support@gourmetbox.bg.

The withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

Protecting Legitimate Interests and Preventing Misuse

Legal basis: our legitimate interest in protecting our website, business, customers and rights in the event of disputes or claims.

6. Information Collected Through LinkedIn Lead Gen Forms

When you complete a GourmetBox Lead Gen Form on LinkedIn, we may receive:

your name;
work email address;
company name;
professional role, where requested;
estimated number of corporate gifts;
information concerning the occasion, deadline, budget or another specific enquiry.

We use this information to:

review and qualify the corporate enquiry;
contact you;
clarify the occasion, number of recipients, deadline and budget;
assess the possibility of providing a representative GourmetBox sample;
prepare a proposal or quotation.

Completing the form does not automatically guarantee that you will receive a sample. GourmetBox may contact you to request additional information and confirm the corporate enquiry.

We will not use information submitted through LinkedIn to send regular marketing communications unless you have provided separate and explicit consent.

LinkedIn also processes personal data in accordance with its own terms and privacy policy.

7. Is Providing Personal Data Mandatory?

Providing certain information is necessary for us to:

process an order;
complete a delivery;
issue an invoice;
respond to an enquiry;
prepare a quotation;
review a request for a corporate sample.

If you do not provide the necessary information, we may be unable to provide the relevant service or respond to your enquiry.

8. Parties With Whom We Share Personal Data

We do not sell personal data.

Where necessary for a specific purpose, we may share personal data with:

courier and logistics partners;
banks and payment service providers;
accounting, legal and tax advisers;
hosting and cloud service providers;
technical support providers;
e-commerce and website functionality providers;
email and marketing service providers;
analytics service providers;
advertising and social media platforms, including LinkedIn and Meta, where applicable;
public authorities where required by law;
other service providers required to deliver a requested service.

Recipients process personal data only to the extent necessary to provide the relevant service and subject to applicable contractual and legal safeguards.

9. Transfers of Personal Data Outside the European Economic Area

Certain providers of technology, analytics, advertising or communication services may process personal data outside the European Economic Area.

In such cases, we use providers that apply an appropriate data protection mechanism, such as:

an adequacy decision adopted by the European Commission;
Standard Contractual Clauses;
other safeguards permitted under the GDPR.

10. How Long We Retain Personal Data

We retain personal data only for as long as necessary for the relevant purpose:

order, invoice and accounting information — for the periods required under applicable accounting and tax legislation;
user account information — while the account remains active and for the necessary period following its closure;
information concerning enquiries, quotations and LinkedIn Lead Gen Forms that have not resulted in a contract — for up to 12 months following the last communication;
information concerning a corporate sample — for up to 12 months following the end of the communication, unless a contractual relationship has been established;
information used for marketing communications — until consent is withdrawn or after 24 months without active engagement;
technical data and cookies — for the periods specified in our Cookie Policy;
information required for the defence of legal claims — until the applicable limitation periods have expired.

Once the relevant retention period expires, the information is deleted or anonymised unless a longer retention period is required by law.

11. Cookies and Similar Technologies

Gourmetbox.bg uses:

strictly necessary cookies;
functional cookies;
analytics cookies;
marketing and advertising cookies.

Strictly necessary cookies are used to ensure the operation and security of the website.

Analytics and marketing cookies are activated only after you have provided your prior consent, where such consent is required.

You may accept, reject or change your choices through the website’s cookie management panel. You may also manage cookies through your browser settings.

Detailed information concerning the types of cookies, providers, purposes and retention periods is available in our Cookie Policy.

12. Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

encrypted connections using SSL/TLS;
access controls and restrictions;
protection of servers and databases;
regular updating and maintenance of the systems we use;
backups and recovery procedures, where applicable;
contractual confidentiality obligations;
measures designed to prevent unauthorised access, loss, alteration or disclosure.

No system can guarantee absolute security, but we take reasonable measures appropriate to the nature and risks of the processing.

13. Your Rights

Under the GDPR, you have the right:

to obtain confirmation as to whether we process your personal data;
to access your personal data;
to request the correction of inaccurate or incomplete information;
to request the deletion of your information where the applicable legal requirements are met;
to request the restriction of processing;
to object to processing based on legitimate interests;
to object to direct marketing at any time;
to receive your information in a structured, commonly used and machine-readable format where the right to data portability applies;
to withdraw consent you have previously provided;
to lodge a complaint with a supervisory authority.

To exercise your rights, please contact us at support@gourmetbox.bg.

We may request additional information to verify your identity. We will respond within the time limits prescribed by applicable legislation.

14. Automated Decision-Making

GourmetBox does not make decisions that produce legal effects or similarly significantly affect you solely through automated processing.

We may use limited audience segmentation to measure and target advertising where this is permitted and you have provided the required consent.

15. Right to Lodge a Complaint

If you believe that your personal data is being processed unlawfully, you may lodge a complaint with:

Bulgarian Commission for Personal Data Protection
Address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
Website: www.cpdp.bg
Email: kzld@cpdp.bg

16. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes to our services, the technologies we use or applicable legislation.

The current version will always be published on gourmetbox.bg, with the date of the latest update stated at the beginning.

17. Contact

If you have any questions concerning this Privacy Policy or our processing of personal data, please contact us at:

support@gourmetbox.bg

GourmetBox handles your personal data with the same care and attention it gives to every detail of your gift.

Subscribe to GourmetBox