Privacy Policy
Last updated: 26 October 2026
1. Introduction
This Privacy Policy explains how the Yani online store, available at https://shop.omniumstudio.com, collects and processes the personal data of its visitors and customers.
This Policy applies when you visit the website, create a customer account, place or fulfil an order, contact customer service, or use other features provided through the website.
Personal data is processed in accordance with applicable legislation, including the General Data Protection Regulation (Regulation (EU) 2016/679 — GDPR) and applicable Bulgarian legislation.
2. Data Controller
The controller of personal data is:
Company name: Omnium Studio EOOD
UIC (EIK): 205199580
Address: 1330 Sofia, Krasna Polyana 1, Block 137A, Entrance B, Bulgaria
- Email: [имейл за контакт относно лични данни]
- Website: https://shop.omniumstudio.com
If you have questions about the processing of your personal data or wish to exercise your rights, you may contact the Controller using the contact details provided above.
3. What Personal Data We Process
Depending on how you use the website, we may process the following categories of data:
3.1. Order and Delivery Data
First and last name;
Delivery address;
Telephone number;
Email address;
Information about the products ordered, the order value and its status;
Information required for issuing accounting documents, where applicable.
3.2. Payment Data
We process information about the selected payment method, payment status, transaction amount and transaction identifier, where provided.
Where a payment is processed by an external provider, such as a payment institution, that provider may independently process certain data in accordance with its own terms and privacy policy.
Payment card details are processed by the relevant payment service provider where applicable. The personal data processed by the Controller depends on the payment method selected and may include the payment status, transaction amount and transaction reference. We do not store full payment card details on our website where these are processed directly by an external payment service provider.
3.3. Customer Account Data
If the website offers account registration, we may process login details, email address, name, addresses, order history and account settings.
3.4. Communications with Us
When you contact us by email, telephone or another available communication channel, we process the information you provide, including the content of your message and the information necessary to respond and provide follow-up assistance.
3.5. Technical Data and Website Usage Data
Depending on the website settings and your consent, where required, we may process your IP address, browser and device information, approximate location data, pages visited, interactions with the website, and information collected through cookies or similar technologies.
Not all categories of data are collected in every case. We process only the data necessary for the relevant purpose or where another valid legal basis for processing exists.
4. Why We Process Personal Data and Our Legal Bases
We process personal data for the following purposes:
4.1. Placing and Fulfilling Orders
We use the necessary data to receive and process orders, arrange payment and delivery, notify the Customer of the order status, and provide assistance if a problem arises.
Legal basis: Performance of a contract or taking steps at the request of the individual prior to entering into a contract.
4.2. Accounting and Legal Obligations
We process and retain certain data where necessary to issue documents, maintain accounting records, fulfil tax obligations or comply with other legal requirements.
Legal basis: Compliance with a legal obligation.
4.3. Customer Service and Handling Complaints
We use data to respond to enquiries, follow up on order-related issues, process cancellations, returns and complaints, and protect the legal rights of the parties.
Legal basis: Performance of a contract, compliance with a legal obligation or legitimate interests, depending on the circumstances.
4.4. Customer Accounts and Website Features
Where customer accounts are available, we process the necessary data to create and maintain an account and provide the selected features.
Legal basis: Performance of a contract or taking steps at the request of the individual.
4.5. Marketing and Promotional Communications
Where applicable, we may send information about products, new collections, promotions or other news, provided that the necessary legal basis exists and applicable rules on electronic communications are observed.
Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Legal basis: Consent or another applicable legal basis, where all relevant legal requirements are met.
4.6. Security, Prevention of Misuse and Protection of Rights
We may process necessary technical information and order-related data to protect the website, prevent fraud, identify misuse, and establish, exercise or defend legal claims.
Legal basis: Legitimate interests or another applicable legal basis, depending on the specific purpose and subject to applicable legal requirements.
4.7. Website Usage Analysis and Improvement
If analytics tools are implemented, we may use data about how visitors interact with the website to understand its usage and improve its features.
Where prior consent is required for these technologies, they are used only after such consent has been obtained.
5. Cookies and Similar Technologies
The website may use cookies and similar technologies to operate, remember certain settings, analyse visits and support advertising activities.
Cookies may be divided into the following categories:
Strictly necessary cookies: Required for essential functionality, security or website operation.
Functional cookies: Help remember settings and preferences.
Analytics cookies: Help measure and analyse website usage.
Advertising cookies: May be used to measure advertising campaigns or personalise advertisements.
Strictly necessary technologies are used in accordance with applicable rules. Prior consent is obtained for other technologies where required by law.
You can manage your choices through the website’s cookie consent tool, where available. You may also change your browser settings; however, blocking certain cookies may affect the operation of some website features.
6. Who We May Share Personal Data With
Personal data is made accessible only where necessary for the purposes described in this Policy, where a valid legal basis exists and in compliance with applicable requirements.
Depending on the services used to operate the online store and fulfil orders, we may share relevant personal data with the following categories of recipients, where necessary and where a valid legal basis exists:
Courier companies, such as Speedy or Econt, for arranging and tracking deliveries;
Payment service providers, such as myPOS or another provider used to process payments;
Hosting, maintenance and technical service providers, necessary for the operation and security of the online store;
Email and communications service providers, where used to provide customer support;
Analytics or advertising service providers, only where such tools are actually implemented and in compliance with applicable rules;
Accountants, legal advisers and other professional advisers, where necessary;
Competent public authorities, where disclosure is required by law or necessary to protect legal rights.
Service providers processing data on our behalf should be subject to appropriate contractual obligations and security measures. Where a provider acts as an independent data controller, it is responsible for its own obligations under applicable legislation.
7. Transfers of Data Outside the European Economic Area
As a general rule, we aim to have personal data processed within the European Economic Area.
If a particular service involves transferring personal data to a country outside the European Economic Area, the transfer will take place only where an applicable lawful transfer mechanism exists, such as an adequacy decision or appropriate safeguards under the GDPR.
Depending on the providers actually used, additional safeguards may apply. Specific information will be provided where relevant to the service concerned.
8. How Long We Retain Personal Data
We retain personal data only for as long as necessary for the relevant purpose, unless a longer retention period is required or permitted by law.
The retention period depends on the type of data and the legal basis for processing. For example:
Order and delivery data: For the period necessary to fulfil the contract, provide customer service and address related matters.
Accounting and tax documents: For the periods prescribed by applicable legislation.
Communications and complaints: For the time necessary to handle the matter and protect the parties’ rights, subject to applicable time limits.
Marketing data based on consent: Until consent is withdrawn or the relevant purpose ends. We may retain minimal information necessary to respect your decision to opt out.
Cookie data: For the lifetime of the relevant cookie or in accordance with the settings of the tool used.
When data is no longer necessary and there is no legal basis for continued retention, it is deleted or appropriately anonymised.
9. How We Protect Personal Data
We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures may include restricting access, using appropriate security settings, protecting systems and selecting service providers that offer appropriate safeguards.
No system can guarantee absolute security. In the event of a personal data incident, we will take the actions required by applicable legislation.
10. Your Rights
Subject to the conditions and limitations set out in the GDPR, you have the right to:
Access the personal data we process about you;
Rectification of inaccurate or incomplete data;
Erasure of data where the legal requirements are met;
Restriction of processing in the cases provided for by law;
Object to processing based on legitimate interests, including direct marketing;
Data portability, where the legal conditions are met;
Withdraw your consent where processing is based on consent;
Lodge a complaint with the competent supervisory authority.
The right to erasure is not unconditional in every situation. For example, we may be legally required to retain certain documents for accounting or other statutory purposes.
To exercise your rights or ask questions about how your personal data is processed, please contact us at [official contact email address].
We may request additional information where this is necessary and proportionate to verify your identity. We will respond within the time limits set out in the GDPR. As a general rule, we will respond within one month of receiving your request. Where permitted by the GDPR, this period may be extended, and we will inform you if an extension is necessary.
11. Right to Loge a Complaint with the Supervisory Authority
If you believe that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the competent supervisory authority.
In Bulgaria, this is: Commission for Personal Data Protection (CPDP)
- Website: https://www.cpdp.bg/
Address and current contact details: Available on the Commission’s official website.
You may contact us first if you wish to clarify the matter, but doing so is not a prerequisite for lodging a complaint.
12. Children’s Data
The online store is not specifically intended for children, and orders should be placed by individuals who have the necessary legal capacity under applicable legislation.
If we become aware that we have collected personal data in a manner that violates applicable requirements for the protection of children, we will take appropriate action in accordance with the law.
13. External Websites and Services
The website may contain links to external websites or use third-party features.
When you visit an external website or use a third-party service, the processing of your personal data may be governed by that party’s own privacy policy. We recommend that you review the relevant policy before providing personal data.
14. Changes to the Privacy Policy
We may update this Policy in response to changes in legislation, the operation of the website, the services used or our personal data processing practices.
The current version will be published on this page with the date of the latest update. Where the law requires specific notification or other action, the appropriate measures will be taken.
15. Contact
For questions about personal data and this Privacy Policy, please contact:
Data Controller: Omnium Studio EOOD
UIC (EIK): 205199580
- Address: 1330 Sofia, Krasna Polyana 1, Block 137A, Entrance B, Bulgaria
- Email: [имейл за контакт относно лични данни]
For information about orders, payments and delivery, please see our Terms and Conditions. To exercise your right to withdraw from a purchase, return an item or submit a complaint regarding a product, please see our Returns and Right of Withdrawal Policy.
