Privacy policy
Last updated: 16 October 2026
1. Controller
The controller of your personal data is the operator named in our legal notice, an individual trader registered in Sofia, Bulgaria (EU) ("Rubrawell", "we"). The legal notice lists the full name and address. Contact for privacy questions: support@rubrawell.com.
2. What data we collect
| Category | Examples | Source |
|---|---|---|
| Order data | Name, shipping and billing address, email, phone, items, order value | You, at checkout |
| Payment data | Payment method type, transaction status (we don't see or store full card numbers) | Payment providers |
| Delivery data | Tracking number, delivery status | Carriers, our fulfilment partner |
| Support data | Messages, photos you send for returns or warranty claims | You |
| Marketing data | Email address and consent, if you subscribe | You |
| Device and usage data | IP address, browser, pages viewed, cookies | Your device, via Shopify and cookies |
3. Why we use it and on what legal basis (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Processing and delivering your order, returns and warranty | Performance of a contract (Art. 6(1)(b)) |
| Customs and DDP clearance, tax and accounting records | Legal obligation (Art. 6(1)(c)) |
| Customer support | Contract / legitimate interest (Art. 6(1)(b), (f)) |
| Fraud prevention and store security | Legitimate interest (Art. 6(1)(f)) |
| Marketing emails | Consent (Art. 6(1)(a)); unsubscribe at any time |
| Non-essential cookies (analytics, advertising) | Consent (Art. 6(1)(a)) via the cookie banner |
4. Who we share it with
- Shopify (store platform and checkout) as our processor. Shopify may transfer data outside the EEA under appropriate safeguards such as the EU Standard Contractual Clauses.
- Payment providers (e.g. Shopify Payments and others shown at checkout) to process payments.
- Our fulfilment partner and carriers, including our partner warehouse in China, to pack, ship, clear customs and deliver your order. This requires transferring your name, address, phone and order contents to China and to carriers. We rely on Standard Contractual Clauses or, where applicable, on the transfer being necessary to perform your contract (Art. 49(1)(b)).
- Shopify's own tools for customer email (order confirmations, shipping updates and, if you subscribe, marketing emails) and Shopify Forms / Shopify Inbox when you use our contact form or chat.
- Authorities where required by law (e.g. customs, tax).
We don't sell your personal data.
5. Cookies
We use essential cookies to run the store and checkout. With your consent, we also use analytics and advertising cookies. Analytics and advertising cookies are only set after you accept them in the cookie banner; if you decline, only essential cookies are used. You can change your choice at any time via the cookie settings link in the footer.
6. How long we keep it
- Order and invoice data: as long as tax and accounting law requires.
- Support and warranty messages: for the warranty period (3 years from delivery) plus the time needed to handle any claim.
- Marketing consent: until you unsubscribe.
- Cookies: as stated in the cookie banner.
7. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interest, and to withdraw consent at any time without affecting earlier processing. Email support@rubrawell.com to use any right; we respond within one month.
You can also lodge a complaint with a supervisory authority: in Bulgaria, where the operator is registered, the Commission for Personal Data Protection (cpdp.bg), or the authority in your country of residence.
8. Security
We use the security measures of the Shopify platform, including encrypted checkout (TLS). Payment card data is handled by PCI DSS-compliant providers.
9. Children
The store is not directed at children under 16, and we don't knowingly collect their data.
10. Changes
We may update this policy. The current version is always on this page with its date.