Last updated: 06.02.2026
This Policy explains how NIKOL 26 EOOD (“we”, “us”, “the Trader”) processes personal data when you use spices.bg and place orders for prepared food, and how cookies and similar technologies are used.
It is prepared in line with Regulation (EU) 2016/679 (GDPR) and applicable Bulgarian law. It complements our Terms and Conditions and Delivery Rules.
1. Data controller
NIKOL 26 EOODUIC (EIK): 202715674Registered seat / address: [fill in from the Commercial Register]Email: office@spices.bgPhone: +359 89 609 0500
For privacy requests: office@spices.bg.
2. Data we process
Depending on how you use the Site, we may process:
A) Order / contact dataName, phone, email, delivery address, order notes, preferences (e.g. disposable cutlery, delivery/pickup slot), order contents and amounts, order history and related communication, and payment-related information needed to process payment (card details are typically handled by the payment provider; we usually receive payment confirmation/status).
B) Technical / statistics dataIP address (including anonymised/hashed form where applicable), date/time of visit, pages viewed, referrer, browser/device information (in aggregated form), interface language.
C) Cookie data — see Section 8.
We do not request special-category data. If you voluntarily include such information in an order note (e.g. an allergy), we use it only to fulfil the order.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Accepting and fulfilling orders; delivery/pickup; customer contact | Contract / pre-contractual steps (Art. 6(1)(b)) |
| Payments, accounting, tax obligations | Legal obligation (Art. 6(1)(c)) |
| Complaints, legal claims, fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Site security and essential functionality (cart, language, session) | Legitimate interests / contract |
| Aggregated/anonymised traffic statistics (WP Statistics) | Legitimate interests – improving the website (Art. 6(1)(f)) |
| Marketing messages (only if you expressly opt in) | Consent (Art. 6(1)(a)) |
You may object to processing based on legitimate interests where applicable.
4. Recipients
We do not sell personal data. We may share data only with hosting/technical providers, payment providers (for card payments), logistics partners (if used), accountants/legal advisors when needed, and public authorities where required by law.
5. Retention
Order and accounting records are kept for the periods required by law (commonly up to 10 years where applicable). Complaint correspondence is kept until the matter is closed plus a reasonable follow-up period. Technical logs and statistics are kept only as long as needed for security and analysis (WP Statistics data is stored locally in our database and reviewed/purged periodically). Cookies last as described in Section 8 or until deleted in your browser.
6. Your rights
You have the right to access, rectification, erasure (where applicable), restriction, portability (where applicable), objection to legitimate-interest processing, and withdrawal of consent where processing is consent-based.
Contact: office@spices.bg. We may need to verify your identity.
You may lodge a complaint with the Commission for Personal Data Protection (CPDP), Sofia, Bulgaria: www.cpdp.bg.
7. Security
We apply organisational and technical measures (access limits, HTTPS, system updates). No system is completely secure.
8. Cookie policy
8.1 Strictly necessary cookies
These are required for the Site to work and do not require consent (cart, session, language).
Examples (names may vary): WooCommerce session/cart cookies; WordPress test/session cookies; Polylang language preference cookies. Typical duration: session or a short period (e.g. ~2 days for WooCommerce session, depending on settings).
8.2 Statistics (WP Statistics)
We use WP Statistics for traffic analysis. Data is processed locally on our server and is not sent to Google or advertising networks.
By default WP Statistics:
- does not use tracking cookies;
- uses aggregated/anonymised metrics (including IP hashing/anonymisation when configured);
- does not aim to identify a specific individual.
If we later enable settings that store full IPs or similar identifiers, we will update this Policy and obtain consent if required.
8.3 Marketing cookies
We currently do not use advertising pixels or third-party marketing cookies. If that changes, we will update this Policy and provide a consent mechanism.
8.4 Managing cookies
You can delete or block cookies in your browser. Blocking necessary cookies may break checkout (e.g. empty cart).
9. Children
The Site is not directed at children under 14. We do not knowingly collect children’s data.
10. Changes
We may update this Policy. The current version is always published on this page with the last-updated date.
11. Related documents
- Terms and Conditions
- Delivery Rules
