Effective from: 21.06.2026.

1. Introduction

This Privacy Policy (hereinafter referred to as the "Policy") describes how "FITCHIK" Ltd. ("the Merchant", "we") collects, uses, stores, and protects your personal data when you use the website pawhouse.eu, place an order, or contact us.

The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and Council of 27.04.2016 (General Data Protection Regulation — GDPR) and the Personal Data Protection Act of the Republic of Bulgaria.

2. Personal Data Administrator

  • Name: "FITCHIK" Ltd.
  • UIC: 208008232
  • Registered office and management address: Sofia 1618, Vitosha district, "Maistor Pavel from Krimin" St. No. 9
  • Manager: Dispina Savopulo
  • Contact email for personal data issues: office@pawhouse.eu

3. What personal data do we collect

3.1. When placing an order or registering

  • Identification data: name (individual) or company data (legal entity)
  • Contact data: email, phone
  • Delivery address: country, locality, street, number
  • Billing data (upon request): UIC / PIN, VAT number, CEO, address
  • Order data: ordered products, price, payment method

3.2. When contacting through the message form

  • Name
  • Email
  • Subject and content of the message

3.3. Automatically collected data

  • IP address — for technical and security purposes
  • Log files on the server — date and time of visit, page, browser, operating system
  • Cookies and similar technologies (see section 9)

4. Legal basis for processing

We process your personal data on the following grounds according to Article 6 of the GDPR:

  • Performance of a contract (Article 6(1)(b)) — for processing orders, delivery, invoicing, warranty service.
  • Legal obligation (Article 6(1)(c)) — for accounting and tax purposes, responding to requests from competent authorities.
  • Legitimate interest (Article 6(1)(f)) — for website security, fraud prevention, improving services.
  • Explicit consent (Article 6(1)(a)) — for marketing communications and non-regulated cookies, if you have provided it voluntarily.

5. Purposes of processing

  • Registration of user profile and management of your account
  • Processing and fulfillment of purchase orders
  • Issuance of invoices and accounting reporting
  • Delivery of goods via courier services
  • Communication with you (confirmations, responses to inquiries, order notifications)
  • Resolving complaints and disputes
  • Compliance with legal obligations
  • Improving the functionality and security of the website

6. Who we share your data with

Your personal data may be shared with the third parties below — only to the extent necessary to achieve the specific purpose, and under confidentiality conditions according to GDPR:

  • Courier services: Econt Express Ltd., Speedy AD — for delivery of orders
  • Hosting: OVH SAS (France) — storage of the website and database
  • Payment systems: the payment service providers you choose at checkout (e.g. PayPal, bank transfer, cash on delivery). The transfer of funds goes directly through their infrastructure.
  • Accounting: external accounting partner — for processing invoices and accounting records
  • Government authorities: in case of a legal obligation (NRA, judicial authorities, etc.)

We do not sell your personal data to third parties for marketing purposes.

Transfer outside the EU: when using payment providers established outside the EU (e.g. PayPal), the transfer of data is carried out on the basis of standard contractual clauses (Standard Contractual Clauses) approved by the European Commission, or another appropriate basis ensuring an adequate level of protection.

7. Retention period

  • Order and invoice data — 10 years (according to the Accounting Act)
  • Registration data (profile) — until your profile is terminated or up to 3 years after the last activity
  • Inquiries via the contact form — up to 1 year after the response, unless they result in a contract
  • Server log files — up to 90 days
  • Cookies — according to the deadlines in section 9

After the expiration of the deadlines, the data is deleted or anonymized.

8. Your rights under GDPR

As a data subject, you have the following rights:

  • Right of access (Art. 15) — to obtain confirmation and a copy of your personal data that we process
  • Right to rectification (Art. 16) — to request correction of inaccurate or incomplete data
  • Right to erasure ("right to be forgotten", Art. 17) — to request deletion in legally established cases
  • Right to restriction (Art. 18) — to restrict processing under certain conditions
  • Right to data portability (Art. 20) — to receive your data in a structured, machine-readable format
  • Right to object (Art. 21) — against processing based on legitimate interest
  • Right to withdraw consent at any time (when processing is based on consent)
  • Right not to be subject to automated decision-making (Art. 22)

To exercise these rights, please send a written request to office@pawhouse.eu. We will respond within the legally established 1-month period (with the possibility of extension by another 2 months in complex cases).

9. Cookies

The website uses cookies for the following purposes:

  • Technical (mandatory): for the proper functioning of the site — user session, cart, checkout. No consent required.
  • Functional: to remember language preferences and settings.
  • Analytical (if enabled): for anonymous visit statistics. Explicit consent is required.

You can manage or delete cookies through your browser settings. Please note that blocking technical cookies may affect the functionality of the site.

10. Data Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction, including:

  • Encryption of the connection via HTTPS / TLS
  • Regular database backups
  • Limited access to personal data (only to authorized personnel)
  • Server-level firewalls
  • Strong passwords and administrator access authentication

Despite our efforts, no data transmission over the internet can be 100% secure. In the event of a data breach, we will notify the Data Protection Commission and affected individuals within 72 hours in accordance with GDPR.

11. Right to Complain

If you believe your rights have been violated, you have the right to file a complaint with:

  • Data Protection Commission
  • Address: Sofia 1592, Prof. Tsvetan Lazarov Blvd. No. 2
  • Website: www.cpdp.bg
  • Email: kzld@cpdp.bg
  • Phone: 02/91-53-518

Before that, please contact us at office@pawhouse.eu — we will do our best to resolve any issue.

12. Changes to the Policy

We reserve the right to update this Policy. In case of significant changes, we will notify you via email (if you have a registered account) or through a visible message on the website within 7 days before the changes take effect.

We recommend periodically checking this page for the latest version.

13. Contacts

For questions regarding the processing of your personal data, please contact us:

  • "FITCHIK" Ltd.
  • UIC 208008232
  • Address: Sofia 1618, Vitosha district, "Maistor Pavel from Krimin" St. No. 9
  • Email: office@pawhouse.eu