Privacy policy

Last updated: 4 September 2026

This policy explains what personal data Cellova Health Bulgaria collects when you visit cellovahealth.bg, buy from us or write to us, why we collect it, who we share it with and what you can ask us to do about it.

1. Who is responsible for your data

The data controller is „Си Ейч Консептс“ ЕООД (CH Concepts Ltd), company number 208560049, trading as Cellova Health Bulgaria, 58 Dr. G. M. Dimitrov Blvd, Izgrev district, Sofia 1172, Bulgaria.

For any question about your data, write to info@cellovahealth.bg or call +359 898 622 006, Monday to Saturday, 9:00–17:00.

2. What we collect

Contact and order details — name, email address, phone number, delivery and billing address, order contents, order history.
Payment details — handled by our payment providers. We receive confirmation that a payment succeeded and the last digits and card type. We never see or store your full card number.
Account details — email address and password hash, if you create an account, plus saved addresses.
Subscription details — the plan and frequency you chose, renewal dates and status.
Messages — anything you send us by email, the contact form or phone.
Usage data — pages viewed, referring site, device and browser type, approximate location from your IP address, and identifiers stored in cookies. See the Cookie policy.
Marketing preferences — whether you consented to the newsletter and whether you opened or clicked our emails.

We do not ask for and do not want health data. If you choose to describe a health condition in a message to us, we use it only to answer you and we delete it when the conversation is closed.

3. Why we use it, and on what legal basis

To take and fulfil your order, including delivery, invoicing, returns and support — performance of the contract with you (Article 6(1)(b) GDPR).
To manage subscriptions, including renewal charges and renewal notices — performance of the contract (Article 6(1)(b)).
To keep accounting and tax records — compliance with a legal obligation (Article 6(1)(c)).
To send the newsletter and offers — your consent (Article 6(1)(a)), withdrawable at any time.
To run and secure the site, prevent fraud and abuse, and understand how the store is used — our legitimate interests (Article 6(1)(f)).
To answer complaints and defend legal claims — legitimate interests, and compliance with consumer law obligations.

4. Who we share it with

We do not sell your personal data. We share it only with the providers we need to run the shop, each acting on our instructions:

Shopify — the e-commerce platform hosting the store and checkout.
Klaviyo — email marketing and on-site activity used to send the newsletter you asked for.
Seal Subscriptions — managing subscription plans and renewals.
Shop Pay / Shop app — accelerated checkout, where you choose it.
Payment providers — to take and, where needed, refund payments.
Speedy and other carriers — your name, address and phone number, solely to deliver your parcel.
Accountants and authorities — where the law requires it.

Some of these providers process data outside the European Economic Area. Where that happens, the transfer is covered by the European Commission's standard contractual clauses or another lawful transfer mechanism.

5. How long we keep it

Order and invoicing records — for the period required by Bulgarian accounting and tax law.
Account data — while your account is open, and deleted after you ask us to close it.
Newsletter data — until you unsubscribe or ask us to delete it.
Support messages — up to 3 years after the conversation ends, so we can handle a later claim about the same order.
Cookies and usage data — for the lifetimes listed in the Cookie policy.

6. Your rights

Under the GDPR you can ask us to:

confirm what data we hold about you and give you a copy;
correct data that is wrong or incomplete;
delete your data, where we have no overriding legal reason to keep it;
restrict how we use it while a dispute about it is resolved;
send your data to you or another provider in a machine-readable format;
stop using it for direct marketing, which we will always do;
object to processing based on our legitimate interests.

Write to info@cellovahealth.bg. We answer within one month. Exercising these rights is free.

You can withdraw consent to marketing at any time with one click in any email, without affecting messages already sent.

7. Complaints

If you think we have handled your data wrongly, tell us first and we will try to fix it. You also have the right to complain to the Bulgarian supervisory authority:

Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, Bulgaria, cpdp.bg. If you live in another EU country you may complain to your own national authority instead.

8. Security

The site runs over an encrypted connection. Payment data is handled by certified payment providers and never reaches our systems. Access to order data is limited to the people who need it to run the shop.

9. Children

The store is not intended for children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, write to us and we will delete it.

10. Changes

If we change this policy we publish the new version here with a new update date. Where a change materially affects you, we tell you by email.