Privacy policy

Privacy Policy

Last updated: May 2026

This Privacy Policy explains how REVELA ("we", "us", "our") collects, uses, and protects your personal data when you visit revelaskin.eu or purchase from us.

We are committed to handling your data with care, transparency, and full compliance with the General Data Protection Regulation (GDPR) and Bulgarian data protection law.

1. Who We Are (Data Controller)

REVELA
Registration number (ЕИК): 153846953
Registered address: Sofia, Suhata reka, Bulgaria
Email: sales@reveleskin.eu

2. What Personal Data We Collect

We collect the following categories of personal data:

  • Identity & contact data: name, email address, phone number, billing and delivery address
  • Transaction data: purchase history, order details, payment confirmation (we do not store full card numbers — payments are processed by our secure payment provider)
  • Technical data: IP address, browser type, device type, operating system, referring URL
  • Usage data: pages you visit on our site, time spent, clicks
  • Marketing data: your preferences for receiving marketing from us, and how you interact with our emails

3. How We Collect Your Data

  • Directly from you — when you place an order, create an account, contact us, or subscribe to our newsletter
  • Automatically — via cookies and similar tracking technologies as you browse our site
  • From third parties — such as payment processors, shipping providers, and advertising platforms (Meta, Google)

4. Why We Use Your Data and Our Legal Basis

Purpose Legal Basis
Processing and fulfilling your order Performance of a contract (Art. 6(1)(b) GDPR)
Sending order confirmations and delivery updates Performance of a contract (Art. 6(1)(b) GDPR)
Handling returns, refunds, and customer service Performance of a contract (Art. 6(1)(b) GDPR)
Complying with legal obligations (invoicing, tax, accounting) Legal obligation (Art. 6(1)(c) GDPR)
Sending marketing emails and promotions (if you opted in) Consent (Art. 6(1)(a) GDPR)
Running targeted advertising on Meta and Google Legitimate interests (Art. 6(1)(f) GDPR)
Analysing site behaviour to improve our store Legitimate interests (Art. 6(1)(f) GDPR)
Preventing fraud and securing our systems Legitimate interests (Art. 6(1)(f) GDPR)

5. Who We Share Your Data With

We only share your data with third parties when necessary and under strict data processing agreements:

  • Shopify Inc. — our e-commerce platform (servers in the US; covered by Standard Contractual Clauses)
  • Payment processors (e.g. Stripe, PayPal) — to securely process your payment
  • Shipping and logistics providers — to deliver your order
  • Email marketing providers (e.g. Klaviyo) — to send order and marketing communications
  • Advertising platforms (Meta/Facebook, Google) — for targeted advertising and campaign analytics
  • Analytics providers (e.g. Google Analytics) — to understand site performance

We do not sell your personal data to any third party.

6. International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA), including in the United States. Where data is transferred outside the EEA, we ensure it is protected by appropriate safeguards — typically Standard Contractual Clauses approved by the European Commission.

7. How Long We Keep Your Data

  • Order and transaction data: 10 years (Bulgarian accounting law requirement)
  • Customer account data: for the duration of your account, plus 2 years after last activity
  • Marketing consent: until you unsubscribe or withdraw consent
  • Technical/analytics data: up to 26 months

8. Your Rights Under GDPR

As a data subject in the EU, you have the following rights:

  • Right of access — request a copy of the personal data we hold about you
  • Right to rectification — ask us to correct inaccurate or incomplete data
  • Right to erasure ("right to be forgotten") — ask us to delete your data, subject to legal retention requirements
  • Right to restrict processing — ask us to pause processing of your data in certain circumstances
  • Right to data portability — receive your data in a structured, machine-readable format
  • Right to object — object to processing based on legitimate interests, including direct marketing
  • Right to withdraw consent — where we rely on your consent, you can withdraw it at any time without affecting prior processing

To exercise any of these rights, email us at sales@reveleskin.eu. We will respond within 30 days.

9. Cookies

Our website uses cookies to make it work, remember your preferences, and help us understand how people use the site. These include:

  • Essential cookies — required for the store to function (e.g. your cart, your session)
  • Analytics cookies — help us understand traffic and behaviour (e.g. Google Analytics)
  • Marketing cookies — used by Meta and Google to show you relevant ads

You can control non-essential cookies through your browser settings or via the cookie consent banner on our site.

10. Children's Data

Our products are intended for adults. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with their data, please contact us at sales@reveleskin.eu and we will delete it promptly.

11. Right to Lodge a Complaint

If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with the Bulgarian supervisory authority:

Commission for Personal Data Protection (CPDP)
Комисия за защита на личните данни
Website: www.cpdp.bg
Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Email: kzld@cpdp.bg

We would, however, appreciate the chance to address your concern directly before you contact the CPDP.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will always reflect the most recent version. If we make significant changes, we will notify you by email or a notice on our website.

13. Contact

For any privacy-related questions, email us at sales@reveleskin.eu.