Privacy Policy

1. Introduction

VIVID TRADE EOOD (operating the brand “Vivid Home,” referred to as “we,” “us,” “our”), Reg. № 202878550, VAT № BG202878550, with registered office at Mayor Parvan Toshev 25 street, Sofia, Bulgaria, is the data controller responsible for your personal data collected through vividhome.eu and its subdomains.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have regarding your data. It applies to all visitors and customers of our Website.

We are committed to protecting your privacy and processing your personal data in full compliance with the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and applicable Bulgarian data protection legislation.

If you have any questions about how we handle your data, you can contact us at any time:

• Email: [email protected]
• Phone: +359 883 335 778
• Address: VIVID TRADE EOOD, Mayor Parvan Toshev 25 street, Sofia, Bulgaria

2. What Data We Collect

a) Information You Provide Directly

When you order from us, write to us, subscribe to our newsletter or submit a product review, you give us:

• Identity data: your name, surname
• Contact data: email address, phone number, billing address, shipping address
• Order data: the artwork, size, material and quantity you order, the delivery method you choose, the order total and any note you add to your order
• Payment data: your choice of payment method and the transaction reference, never your card number
• Communication data: the content of your e-mails and contact form messages, any photo or PDF you attach to them, and the artwork you e-mail us for a custom order
• Marketing data: the e-mail address you enter in our newsletter form or in the discount code popup, which subscribes you to our newsletter, and the discount code you were given
• Review data: the name, e-mail address, rating and text you submit with a product review, of which only the name, the rating and the text are published

b) Information Collected Automatically

When you visit our Website or send us one of our forms, we also receive technical data:

• IP address and browser identification, sent by your browser with every request: Cloudflare and our hosting provider process them to deliver and protect the Website, and we store them with any form you send us, as a record of the submission and to keep spam out
• Country, which Cloudflare derives from your IP address, so that we can show you the right offer and offer cash on delivery only where it is available
• Pages visited, time spent on each page, navigation path, device type, operating system and screen resolution, collected by Google Analytics, which currently sets its cookies on your first page view, before you choose anything in the cookie banner
• How you use a page, meaning your clicks, scrolling, mouse movement and screen size, collected by Hotjar, which can replay a visit as a recording and is currently loaded on your first page view, before you choose anything in the cookie banner
• Referring website and campaign details of the visit that brought you here and of up to 12 earlier visits, kept with your order together with your browser identification, so that we can tell which campaign, advertisement or partner link led to it
• Cookie and similar technology data (see our Cookie Policy for details)

c) Information from Third Parties

We may receive limited data from trusted third parties:

• Stripe, our payment provider: confirmation that a payment succeeded or failed, the transaction reference and the result of its fraud checks
• Delivery partners: shipping status updates, delivery confirmations, and failed delivery notifications

3. How We Use Your Data

We only process your personal data when we have a valid legal basis under GDPR Article 6. Here is how each legal basis applies:

a) Contract Performance (Article 6(1)(b))

Processing necessary to fulfil our contract with you:

• Processing and fulfilling your orders (production, packaging, shipping)
• Sending order confirmation, dispatch, and delivery notifications
• Providing customer support related to your purchases
• Passing your delivery details to the courier that brings your parcel
• Processing returns and refunds

b) Legitimate Interests (Article 6(1)(f))

Processing based on our legitimate business interests, balanced against your rights:

• Improving our Website, user experience, and product offerings
• Fraud prevention and security monitoring
• Keeping spam and automated abuse out of our forms and our checkout
• Measuring which campaign, advertisement or partner link brought you to us, using the campaign details of your visit and a random identifier that is not linked to your name or your e-mail address
• Internal record-keeping and business administration

c) Consent (Article 6(1)(a))

Processing based on your freely given consent, which you can withdraw at any time:

• Sending marketing emails, newsletters, and promotional offers
• Setting non-essential cookies (analytics, marketing)

d) Legal Obligation (Article 6(1)(c))

Processing required to comply with the law:

• Maintaining tax and accounting records
• Responding to lawful requests from regulatory authorities
• Complying with consumer protection regulations

4. Data Sharing

We share your personal data only with trusted third parties who need it to help us serve you. We require all third parties to respect the security of your data and process it in accordance with applicable law.

• Stripe: to take your card, Apple Pay, Google Pay or Link payment and to run its fraud checks
• Shipping and courier companies: to deliver your orders (name, address, phone number, and order reference only)
• Our hosting provider and Cloudflare: to run, deliver and protect the Website, which means they process your IP address and every request your browser makes
• Google Analytics: to help us understand how visitors use our Website
• Hotjar: to record how visitors use our pages and to replay a visit as a recording, which means it receives your IP address, your browser identification and what you do on the page
• Brevo: our e-mail delivery provider, which receives the recipient address, the subject and the full content of every message we send you
• Cloudflare Turnstile and hCaptcha: to check that a form or a payment is not sent by a bot, which means Turnstile receives your IP address and hCaptcha is loaded by Stripe inside its payment form
• Legal authorities: when required by law, court order, or regulatory obligation

Stripe is our only payment provider, and your card details are typed into Stripe’s own form and never reach our servers. Google Analytics, Google Ads and Hotjar currently set their cookies on your first page view, before you choose anything in the cookie banner, and Google Analytics 4 does not log or store IP addresses. We do not run the Meta Pixel today; if we switch it on, it will run only after you accept all cookies, as described in our Cookie Policy.

Your orders, the e-mails we send you and the forms you submit are also kept in our own administration system at admin.vividhome.eu. It is operated by VIVID TRADE EOOD on the same servers as this Website, so this is not a disclosure to another company.

We do not sell, rent, or trade your personal data to any third party. Ever.

5. International Data Transfers

Our primary servers and database are located within the European Union, ensuring your data benefits from GDPR protections by default.

Some of our service providers (such as Google, Cloudflare, Stripe and Brevo) may process data in countries outside the EU and the EEA. When this occurs, we ensure your data is protected by one or more of the following safeguards:

• EU adequacy decisions: the European Commission has determined that the recipient country provides an adequate level of data protection
• Standard Contractual Clauses (SCCs): EU-approved contract terms that require the recipient to protect your data to EU standards
• Binding Corporate Rules: for transfers within international corporate groups

You may request further details about the safeguards in place by contacting us at [email protected].

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our retention periods are:

After these periods expire, your data is securely deleted or anonymised so it can no longer be linked to you.

7. Your Rights

Under the GDPR (Articles 15 to 22), you have the following rights regarding your personal data:

a) Right of Access (Article 15)

You can request a copy of the personal data we hold about you, along with information about how it is processed.

b) Right to Rectification (Article 16)

You can ask us to correct any inaccurate or incomplete personal data we hold about you.

c) Right to Erasure (Article 17)

Also known as the “right to be forgotten”: you can request the deletion of your personal data where there is no compelling reason for us to continue processing it.

d) Right to Restrict Processing (Article 18)

You can ask us to limit how we use your data in certain circumstances, for example while we verify the accuracy of data you have contested.

e) Right to Data Portability (Article 20)

You can request your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON), and have it transferred to another controller where technically feasible.

f) Right to Object (Article 21)

You can object to processing based on our legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.

g) Right to Withdraw Consent (Article 7(3))

Where processing is based on your consent (for example marketing e-mails or non-essential cookies), you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. To stop marketing e-mails, use the unsubscribe link in any message we send you. To change your cookie choice, delete the stored data for vividhome.eu in your browser settings: the cookie banner then appears again on your next page view and you can choose differently. There is no separate cookie settings link on the Website.

h) Right to Lodge a Complaint

If you believe we have not handled your data correctly, you have the right to lodge a complaint with a supervisory authority. For Bulgaria, this is:

Commission for Personal Data Protection (CPDP)
Website: www.cpdp.bg
You may also contact the data protection authority in your country of residence.

How to Exercise Your Rights

To exercise any of these rights, send an email to [email protected] with the subject line “Data Request”. We may ask you to verify your identity before processing your request.

We will respond to all valid requests within 30 days. If your request is complex or we receive a high volume of requests, we may extend this by a further 60 days, and we will notify you of any such extension.

8. Data Security

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it:

• SSL/TLS encryption on all pages of our Website, ensuring data transmitted between your browser and our servers is encrypted
• PCI DSS-compliant payment processing: your card details are typed into Stripe’s own form, so we never handle or store them
• Access controls: only authorised personnel can access personal data, on a need-to-know basis
• Bot and spam protection: Cloudflare Turnstile on our forms and at the checkout, and a security plugin that blocks repeated attacks on the Website
• Regular security reviews and updates to our systems and processes

While we take every reasonable precaution, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee the absolute security of your data during transmission.

9. Children’s Privacy

Our Website and services are not intended for children under the age of 16. We do not knowingly collect, process, or store personal data from anyone under 16 years of age.

If we become aware that we have inadvertently collected personal data from a child under 16, we will take immediate steps to delete that data from our systems. If you believe a child has provided us with personal data, please contact us at [email protected].

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or business operations.

For significant changes that materially affect how we process your data, we will notify you by email (if we have your email address) or by posting a prominent notice on our Website before the changes take effect.

The “Last updated” date at the top of this page indicates when the policy was most recently revised. We encourage you to review this policy periodically.

11. Contact & Data Protection

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Data Controller: VIVID TRADE EOOD (Reg. № 202878550, VAT № BG202878550)
• Email: [email protected]
• Phone: +359 883 335 778
• Address: Mayor Parvan Toshev 25 street, Sofia, Bulgaria

If you are not satisfied with our response, you have the right to contact the Bulgarian data protection authority:

Commission for Personal Data Protection (CPDP)
Sofia, Bulgaria
Website: www.cpdp.bg

You may also contact the supervisory authority in the EU member state where you reside or work.