Privacy policy

Last updated: September 2026

1. Who is responsible for your data

The data controller is Creativa Vision EOOD, UIC 203016517, 61 Lyuben Karavelov St., Sofia, Bulgaria. Contact: contact@kivello.eu.

2. What data we collect

When you visit kivello.eu or place an order we may collect: your name; email address; phone number; delivery and billing address; details of your orders; payment status (never your full card number); IP address, device and browser information; and data collected through cookies and analytics tools (see our Cookie Policy). If you contact us, we keep the content of your message.

3. Why we use your data and on what legal basis

  • To process and deliver your order, issue invoices and handle returns and complaints (performance of a contract; legal obligations).
  • To communicate with you about your order or your questions (performance of a contract; legitimate interest).
  • To send you news and offers by email, only if you subscribed; you can unsubscribe at any time via the link in every email (consent).
  • To improve our website and measure our advertising (consent for non-essential cookies; legitimate interest in aggregated statistics).
  • To prevent fraud and comply with the law, including accounting and tax rules (legal obligation; legitimate interest).

4. Payments

Payments are processed by Shopify Payments and the payment providers shown at checkout. Kivello does not store and has no access to your full card details.

5. Who receives your data

We share data only as needed with: Shopify International Ltd. (store hosting, checkout and payments); courier and postal companies delivering to your country; accounting and audit providers; email and marketing tools we use to send newsletters; analytics and advertising providers (Google, Meta) where you have consented to cookies; and public authorities when the law requires it. Some providers process data outside the EU/EEA; in that case transfers are protected by the European Commission's Standard Contractual Clauses or an adequacy decision.

6. How long we keep your data

Order and invoice data is kept for as long as required by accounting and tax law (in Bulgaria generally 10 years). Newsletter data is kept until you unsubscribe. Customer-service messages are kept for up to 3 years. Analytics data is kept according to the settings of the tool (Google Analytics: up to 14 months).

7. Your rights

Under the GDPR you have the right to: access your data; correct inaccurate data; delete your data ("right to be forgotten"); restrict processing; object to processing based on legitimate interest, including direct marketing; data portability; and withdraw consent at any time without affecting the lawfulness of processing before withdrawal. To exercise your rights write to contact@kivello.eu. We answer within one month.

8. Security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, misuse or destruction. Our store runs on Shopify's PCI-DSS-compliant infrastructure and all traffic is encrypted (HTTPS).

9. Complaints

If you believe we process your data unlawfully, you can lodge a complaint with the Bulgarian Commission for Personal Data Protection (2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg) or with the data-protection authority in the EU country where you live.

10. Changes

We may update this Privacy Policy when our services or the law change. The current version is always available at kivello.eu.