Privacy Policy

Last updated: 29.05.2026

1. General Information

1.1. This Privacy Policy explains how ATELIER GROUP Ltd. (“we”, “us”, “our”) collects, uses, stores, and protects the personal data of visitors and customers of www.stringatelier.com.

1.2. ATELIER GROUP Ltd. is the data controller within the meaning of Regulation (EU) 2016/679 (the “GDPR”).

2. Data Controller

Company name: ATELIER GROUP Ltd. (ATELIER GROUP EOOD) UIC: 208462861 Registered address: Haskovo 6300, Bulgaria Contact email: hello@stringatelier.com Privacy email: privacy@stringatelier.com Phone: +359 886 228 674

3. Personal Data We Collect

3.1. We collect the following categories of data:

Contact data: name, email, phone number, delivery address.
Order data: products purchased, order value, payment method.
Payment data: only information needed to process payment via our payment provider. We do not store card details.
Communication data: emails, contact form messages, enquiries via Facebook or Instagram.
Photographs: images uploaded by customers for custom portrait orders.
Technical data: IP address, cookies, device and browser information, used to improve our service and ensure security.

4. How We Use Your Data

4.1. We process your data for the following purposes:

Processing and delivering your orders;
Communicating with you about orders, deliveries, or complaints;
Producing custom portraits from photographs you upload;
Issuing invoices and meeting accounting obligations;
Improving our service and user experience;
Marketing and promotional messages (only with your explicit consent);
Complying with legal obligations (e.g. tax and accounting records).

5. Legal Basis for Processing

5.1. We process your data on the following legal bases under Article 6 GDPR:

Performance of a contract (Art. 6(1)(b)) — when you place an order;
Legal obligation (Art. 6(1)(c)) — for accounting and tax records;
Consent (Art. 6(1)(a)) — for marketing communications and non-essential cookies;
Legitimate interest (Art. 6(1)(f)) — for service improvement, fraud prevention, and website security.

5.2. You may withdraw consent at any time by emailing privacy@stringatelier.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. Sharing Your Data

6.1. We share personal data only with trusted partners who help us deliver our service, including:

Warehouse and fulfilment providers — for preparing and packing orders;
Courier companies (Speedy, Econt, and EU-wide partner couriers) — for delivery;
Payment providers — for processing card payments;
Accounting firm — for invoicing and reporting;
Hosting provider — for website maintenance;
Email and marketing service providers — for transactional and (with consent) marketing emails;
Analytics providers (e.g. Google Analytics, Meta) — for website performance and advertising, where applicable.

6.2. All processors are contractually bound to confidentiality and GDPR compliance through data processing agreements.

6.3. International transfers: Some of our service providers (e.g. analytics, hosting, email) may process data outside the European Economic Area. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

7. Data Retention

7.1. We retain personal data only as long as necessary for the purposes for which it was collected:

Order and invoice data: 10 years (Bulgarian Accountancy Act);
Custom portrait photographs: deleted within 90 days after order fulfilment, unless you ask us to delete them sooner;
Marketing data: until you withdraw consent;
Correspondence: up to 1 year after the communication ends;
Website analytics data: as defined in our cookie settings.

8. Cookies

8.1. Our website uses cookies to ensure it functions correctly and to improve your experience.

8.2. We use the following types of cookies:

Strictly necessary — required for core website functions;
Analytics (e.g. Google Analytics) — to measure traffic and improve the site;
Marketing (e.g. Meta Pixel) — only with your explicit consent.

8.3. You can manage your cookie preferences through our cookie banner or your browser settings.

9. Data Security

9.1. We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or destruction.

9.2. The website uses an SSL certificate to encrypt all data transmitted between you and us.

9.3. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you and the competent supervisory authority within 72 hours, as required by Article 33 GDPR.

10. Your Rights

Under the GDPR, you have the following rights:

Right of access — to obtain a copy of the data we hold about you;
Right of rectification — to correct inaccurate or incomplete data;
Right of erasure (“right to be forgotten”) — to request deletion of your data;
Right to restrict processing — to limit how we use your data;
Right to data portability — to receive your data in a structured, machine-readable format;
Right to object — to processing based on legitimate interest or for direct marketing;
Right to withdraw consent — at any time, where processing is based on consent;
Right to lodge a complaint with a supervisory authority.

To exercise any of these rights, contact us at privacy@stringatelier.com. We will respond within one month.

Supervisory authorities:

You may lodge a complaint with the supervisory authority in your country of residence, work, or where the alleged infringement occurred.

A list of EU supervisory authorities is available at edpb.europa.eu.

11. Changes to This Policy

11.1. We may update this Policy from time to time to reflect changes in law or our services.

11.2. The updated version takes effect on the date of publication on our website. Material changes will be communicated by email or notice on the website.