This policy explains what personal data Lovika EOOD collects through lovika-bg.com, why it collects it, how long it keeps it and what your rights are. We collect as little data as we can, and we never sell it.
In short
We use no advertising or analytics cookies and don't track what you do on the site.
The contact form asks only for your name, email and message — your phone number is optional.
To leave a review you sign in with Google or Facebook. We keep only your name and a profile identifier — never your email address or password.
You can ask for a copy of your data, or for us to delete it, at any time.
Who is responsible for your data
The controller of your personal data is Lovika EOOD (Ловика ЕООД), UIC 208498957, with its registered office and address of management at 15 Avliga St., floor 6, apt. 17, Zapaden district, 4003 Plovdiv, Bulgaria.
For anything to do with your personal data, write to us at lovikaltd@gmail.com.
We are not required to appoint a data protection officer, so we answer your questions ourselves.
What data we collect and why
The legal bases below are those of Article 6(1) of the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”).
When you browse the site
Like any website, the servers that deliver this site receive technical information: your IP address, browser and device type, the page requested and the time of the visit. We need it to show you the page and to protect the site from abuse — for example by limiting overly frequent requests. Our application uses your IP address only briefly, to limit request rates, and does not save it to our database; our hosting providers may keep it for a short time in their technical logs.
Legal basis: our legitimate interest in keeping the site running and secure (point (f)).
Fonts
The site's fonts are loaded from the Google Fonts service. To download them, your browser sends its IP address to Google's servers. More in Google's Privacy Policy.
Legal basis: our legitimate interest in the site looking the same and loading quickly on every device (point (f)).
When you write to us through the contact form
We collect:
your name;
your email address;
your phone number — only if you give it;
the text of your message.
We use them only to answer your inquiry and, if you wish, to prepare a quote. Messages are read in Lovika's protected admin panel.
Legal basis: steps taken at your request before entering into a contract (point (b)), and our legitimate interest in answering the inquiries we receive (point (f)).
When you leave a review
To make sure reviews come from real people, they are sent after signing in with Google or Facebook. The sign-in serves only to send the review — we don't create an account on the site and don't keep access to your profile.
From Google or Facebook we receive and keep only:
your name, as it appears on your profile;
an identifier of your profile — so that each person has one review and can edit it instead of posting a new one.
We never receive your password, and we don't keep your email address, profile picture or friends list.
Along with these, we keep your rating, your comment, up to 3 photos if you attach them, and the date you sent the review. Once we have checked the review, the site shows your name, rating, comment, photos and the date.
Please don't attach photos that show other people without their consent.
Legal basis: your consent, which you give by sending the review (point (a)). You can withdraw it at any time, and we will then delete the review. See how to request deletion.
You don't have to give us any data. Without an email address, though, we can't reply to you, and without signing in with Google or Facebook you can't post a review. We make no decisions based solely on automated processing and don't profile visitors.
Cookies
The site uses no advertising, analytics or other tracking cookies and does not itself store cookies in your browser. That's why we don't ask for your consent with a banner.
When you press “Sign in with Google” or “Continue with Facebook”, that provider's script loads. It may use its own cookies, needed for the sign-in you asked for. Those are covered by the policies of Google and Meta.
Who we share data with
We don't sell your data or use it for advertising. We rely on trusted providers who process it on our behalf and only on our instructions:
Netlify — hosting of the website;
Railway — hosting of the server application and the database where messages and reviews are kept;
Cloudflare — protecting the site from attacks and storing review photos.
Google and Meta (Facebook) process data during sign-in with their services as independent controllers, under their own terms. We disclose data to public authorities only when the law requires us to.
Transfers outside the EU
Some of these providers are based in the United States. Where data is transferred outside the European Economic Area, this happens on the basis of the European Commission's adequacy decision for the EU–US Data Privacy Framework or of standard contractual clauses approved by the Commission.
How long we keep data
Contact form messages
Up to 12 months after our last exchange with you. If we enter into a contract, we keep the data it needs for as long as the law requires — accounting law, for example.
Published reviews
Until you ask us to delete them or we stop showing reviews on the site.
Rejected reviews
Up to 6 months after moderation, to prevent abuse; then we delete them.
Technical data from visits
Briefly, in our hosting providers' technical logs, after which it is deleted automatically.
Your rights
Under the GDPR you have the right of:
Access — to find out whether we process data about you, and to get a copy of it.
Rectification — to have inaccurate or incomplete data corrected.
Erasure — to have your data deleted when it is no longer needed, when you withdraw your consent or when you object.
Restriction — to have processing paused while we check the data's accuracy or the basis for processing it.
Portability — to receive the data you gave us in a machine-readable format.
Objection — to processing based on our legitimate interest.
Withdrawing consent — at any time, without affecting the lawfulness of processing before the withdrawal.
To exercise your rights, write to us at lovikaltd@gmail.com. We reply without undue delay and within one month at the latest. Exercising your rights is free of charge. We may ask you something to make sure the request really comes from you.
If you believe we are infringing your rights, you can lodge a complaint with the Bulgarian Commission for Personal Data Protection (www.cpdp.bg). We would be glad to try to resolve it with you first.
How we protect data
The site works only over a secure connection (HTTPS). Only authorised people at Lovika can access messages and reviews, through an admin panel protected by a password and two-factor authentication.
Children
The site is not intended for children. Please don't leave a review if you are under 14 — in Bulgaria, the age from which you can consent to the online processing of your data yourself.
Changes to this policy
We will update this policy when we change how the site handles personal data. The date of the latest change is at the top of the page.
