Privacy Policy

1. Introduction

Armandtray operates www.armandtray.com, offering sofa and home furnishing accessories to customers across Europe. This Privacy Policy explains how personal data is collected, used, stored and disclosed in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Bulgarian data protection legislation.

For the purposes of this website, Armandtray acts as the data controller for the personal data processed in connection with its business activities.

2. Personal Data We Collect

Depending on how you use our website, we may collect:

• Contact information: name, email address, telephone number and delivery address.
• Order information: products ordered, order reference, billing details and order history.
• Payment-related information: payment status, transaction references and relevant payment confirmations.
• Customer communications: messages and information submitted through our contact channels.
• Website information: IP address, browser details, device information and cookie preferences, where applicable.

We collect only the information reasonably necessary for the purposes described in this policy.

3. How We Use Your Personal Data

We process personal data for the following purposes:

• To receive, manage and fulfil orders.
• To process payments and maintain transaction records.
• To respond to customer enquiries and provide order-related assistance.
• To maintain website functionality and remember cookie preferences.
• To identify unusual transactions and address potential misuse of our services.
• To comply with applicable accounting, tax and other legal obligations.
• To establish, exercise or defend legal claims where necessary.

4. Legal Bases for Processing

Depending on the purpose, we process personal data under one or more of the following legal bases under Article 6 of the GDPR:

• Contractual necessity: to process and fulfil orders and respond to requests relating to a purchase.
• Legal obligation: to maintain records and meet applicable statutory requirements.
• Legitimate interests: to administer our business, maintain website operations, address misuse and handle legal claims, where these interests do not override your rights and freedoms.
• Consent: to use non-essential cookies or send direct marketing communications where consent is required.

Where processing is based on consent, you may withdraw that consent at any time.

5. Payment Processing and Stripe

Payments on our website are processed by Stripe, an independent payment service provider.

Depending on the payment method and transaction, information may include transaction amounts, payment status, billing details, payment method information and other details required to process or verify a payment.

Stripe may process personal data as a processor acting on our instructions and may act as an independent controller for certain activities, including compliance with its own legal obligations and the detection or prevention of fraudulent transactions. Stripe’s processing is subject to its applicable privacy terms.

We do not intend to collect or store full payment card details or card security codes on our website where these are handled directly by the payment provider.

For further information, please visit: https://stripe.com/privacy

6. Cookies and Similar Technologies

Our website uses cookies and similar technologies to support essential functions and, where permitted, other website features.

Strictly necessary cookies may be used where required to provide services requested by you or operate essential website functions. Non-essential cookies are used only after you click “Accept” on our cookie consent banner where consent is required.

You may change or withdraw your preferences through the available cookie settings. Further details are provided in our Cookie Policy.

7. Sharing Personal Data

Personal data may be shared, where necessary, with:

• Stripe and relevant payment service providers for payment processing.
• Delivery and fulfilment providers for order delivery.
• Website hosting and service providers supporting our business operations.
• Accountants, legal advisers or professional service providers where required.
• Public authorities, courts or regulatory bodies where disclosure is required by law.

Service providers are given access only to the information necessary for their relevant functions, subject to applicable legal requirements and contractual arrangements.

8. International Data Transfers

Where personal data is transferred outside the European Economic Area, we will rely on an applicable legal transfer mechanism under the GDPR, where required. This may include an adequacy decision adopted by the European Commission or appropriate safeguards such as Standard Contractual Clauses.

Further information about relevant safeguards may be requested using the contact details below.

9. Data Retention

We retain personal data only for as long as necessary for the relevant purpose or as required by applicable law.

• Order and accounting records: retained for the statutory periods applicable to the relevant records under Bulgarian accounting and tax legislation. Certain accounting records may require retention for up to 10 years.
• Customer service enquiries: generally retained for up to 3 years after the enquiry is closed, unless a longer period is needed to resolve a dispute or meet a legal obligation.
• Customer account information: retained while the account remains active and for a necessary period afterwards to meet legal obligations or resolve outstanding matters.
• Payment records: retained for the applicable accounting, tax and legal retention periods. Stripe may retain information separately under its own retention policies and legal obligations.
• Marketing preferences: retained until consent is withdrawn or the information is no longer required, while retaining limited suppression records where necessary to respect opt-out requests.
• Cookie information: retained according to the applicable cookie expiry settings and the periods described in our Cookie Policy.

When personal data is no longer required, it will be deleted or anonymised, subject to applicable legal retention obligations and legitimate requirements to establish, exercise or defend legal claims.

10. Your Data Protection Rights

Subject to the conditions and limitations set out in applicable law, you may have the right to:

• Request access to your personal data.
• Request correction of inaccurate information.
• Request erasure of your personal data.
• Request restriction of processing.
• Object to processing based on legitimate interests or direct marketing.
• Request data portability where applicable.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a competent data protection supervisory authority.

To exercise your rights, contact us using the details in Section 14. We may request information necessary to verify your identity before responding.

You may lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) or another competent supervisory authority in the European Economic Area.

Official website: https://cpdp.bg/en/

11. Data Protection and Confidentiality

We apply appropriate organisational and technical measures to protect personal data against unauthorised access, disclosure, alteration or loss. Access to personal data is limited according to operational requirements, and relevant service providers are expected to handle information in accordance with applicable data protection obligations.

Where a personal data breach requires notification under the GDPR, the relevant notification obligations will be followed.

12. Children’s Data

Our website is intended for general consumers and is not specifically directed at children. We do not knowingly seek to collect personal data from children where such collection is not permitted by applicable law. Where required, appropriate steps will be taken to address such data.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our processing activities, website functions or applicable legal requirements. The latest version will be published on this page with its revision date.

14. Contact Information

For questions about this Privacy Policy or to exercise your data protection rights, please contact us:

Brand: Armandtray
Website: www.armandtray.com
Email: seller@armandtray.com
Registered Company Name: [XXX]
Registered Address: [XXX]
Telephone: [XXX]