Privacy policy

Last updated: 3 November 2026

1. Who we are

The data controller is Karina Art 92 EOOD (Карина Арт 92 ЕООД), company ID (EIK) 208623193, registered address: 4 "755" St., Gorna Banya, Ovcha Kupel, 1614 Sofia, Bulgaria.

Phone: 0887 059 048 · Instagram: @karinadigitalart

mechetanakilogram.com is a gallery of Karina Art's painted teddy bears. There are no accounts, forms, online payments or newsletters on the site.

2. What data we process

• When you visit the site. The site is hosted by Cloudflare. Every visit technically sends the server your IP address, browser and device type, the page you opened and the time. This is used to serve the pages and protect the site from attacks. We don't use it to identify you.
• When you message us. Enquiries go through Instagram or Facebook Messenger. We see your name and profile there, your message and anything you choose to send us (for example names or photos for a personalised piece).
• When you order. Your name, phone number and delivery address (or courier office), plus invoice details if you need an invoice.
• When you call us. Your phone number and what you tell us.

3. Why, and on what legal basis

• To answer your enquiry and fulfil your order — Art. 6(1)(b) GDPR: steps before entering into a contract, and performing it.
• To meet our accounting and tax obligations (invoices and other records) — Art. 6(1)(c) GDPR: legal obligation.
• To keep the site secure and working — Art. 6(1)(f) GDPR: legitimate interest.

We don't use your data for advertising, we don't sell it, and we don't make automated decisions or profiles about you.

4. Cookies

We don't set cookies and don't use analytics, advertising or tracking tools. Fonts are served from our own site, not from outside services. That's why there is no cookie banner.

The Instagram, Facebook and Messenger buttons are plain links. Meta only receives data from you once you open them.

5. Who we share data with

• Cloudflare, Inc. — hosting and protecting the site.
• Meta Platforms Ireland Ltd. — when you message us on Instagram or Messenger. Meta also processes this data under its own privacy policy.
• A courier company — name, phone and address, to deliver your order.
• Our accountant — the details on invoices.
• Public authorities — only when the law requires it.

6. Transfers outside the EU

Cloudflare and Meta may process data outside the European Union, for example in the USA. This happens under the safeguards set out in the GDPR, such as the EU–US Data Privacy Framework or standard contractual clauses.

7. How long we keep data

• Messages about enquiries that didn't lead to an order — up to 12 months after the last contact.
• Order details — until the order is fulfilled and the period for complaints has passed.
• Invoices and accounting records — as long as accounting and tax law requires (up to 10 years).
• Technical data at Cloudflare is kept briefly, under Cloudflare's own rules.

8. Your rights

You can ask to access your data, correct or delete it, restrict how it is used, receive it in a portable format, and object to processing based on legitimate interest.

To use any of these rights, message us on Instagram or call 0887 059 048. We reply within one month.

If you think your rights have been breached, you can complain to the Bulgarian Commission for Personal Data Protection (www.cpdp.bg).

9. Changes

We may update this policy. The date at the top shows the latest version.