This Privacy Policy explains how Regina processes personal data when you visit our website, submit an inquiry, communicate with us, or use our services.
For the purposes of applicable data protection legislation, the data controller is "REGINA HERBAL" LTD, UIC 204660493, with its registered office and management address at 17 Topolite Street, 9350, hereinafter referred to as "Regina", "we", "us", or "our".
- What personal data we may process
Depending on how you interact with us, we may process the following categories of data:
Contact details: first name, last name, email address, phone number, company/business.
Inquiry data: information you voluntarily provide us in the contact form or by email, including project type, budget, message, and other project information.
Contractual and invoicing data: data necessary for offers, contracts, invoicing, accounting, and project execution.
Technical data: IP address, device/browser type, approximate location information, logs, and other technical data when processed by our site or providers.
Website usage data: pages visited, site interactions, and analytical information if we use analytical tools and, where applicable, after the necessary consent.
Marketing communication: communication preferences and history if you have subscribed or given other valid grounds to receive such communication.
- How we obtain personal data
We usually obtain data directly from you — for example, when you fill out a form, send an email, have a conversation with us, accept an offer, or we start working on a project.
In some cases, we may obtain limited information from publicly available business sources, partners, or technical providers when necessary and lawful for the relevant purpose.
- For what purposes and on what grounds we process data
We process personal data only when we have an applicable legal basis. Depending on the specific situation, the grounds may be as follows:
3.1 Inquiries and offer preparation
When you send us an inquiry, we use the provided data to respond, understand project needs, and prepare a proposal. When the inquiry is made by a potential client — a natural person, processing may be necessary for taking steps prior to entering into a contract. For business communication, our legitimate interest in responding to professional inquiries and developing our business may also apply, after assessing the applicability of this ground.
3.2 Contract performance and project management
We use the necessary data to organize, perform, and deliver assigned services, communicate about the project, manage changes, deadlines, and payments, and provide agreed support.
3.3 Accounting and legal obligations
We may process and store certain data when necessary to comply with applicable accounting, tax, regulatory, or other legal obligations.
3.4 Security and business protection
We may process limited technical and communication data to protect the site, prevent abuse, identify technical problems, protect our rights, and resolve disputes, where we have an applicable legal basis.
3.5 Analytics and site improvement
If we use analytics tools, data processing through optional cookies or similar technologies is carried out in accordance with applicable rules and site consent settings.
3.6 Marketing
If we send marketing communications, we will do so only when we have an appropriate legal basis. When communication is based on consent, you can withdraw it at any time.
- Contact forms and communication
When you fill out a form on the site, the information provided is used to process your inquiry and subsequent communication. Do not provide sensitive personal data unless it is actually necessary and pre-agreed with us.
Our website is built and hosted using the Shopify platform. Shopify processes certain technical and user-entered data in its role as our service provider, in accordance with its own privacy policy and applicable contractual terms.
- Cookies and similar technologies
The site uses cookies and similar technologies to function properly and enhance your user experience. We use the following categories:
Strictly necessary cookies — ensure the basic functionality of the site (e.g., navigation, security, cart operation, and order checkout with Shopify). These cookies are essential for the site to work and do not require consent.
Analytical cookies — help us understand how visitors use the site to improve it. They are activated only after your consent.
Functional cookies — allow remembering your preferences and settings. They are activated only after your consent, where applicable.
Marketing cookies — used to display relevant content and ads. They are activated only after your consent.
When the law requires prior consent for a particular technology, it is activated only after you have made a choice. You can withdraw or change your consent at any time through the site's cookie settings.
A detailed list of the cookies used may be published in a separate Cookie Policy or in the cookie settings panel.
- To whom we may provide personal data
We may provide personal data only when necessary and when there is an applicable legal basis, including to:
hosting and web platform providers — Shopify;
providers of business email and communication tools (Google/Gmail);
accountants, legal, and other professional consultants;
providers of analytical/marketing tools, when we use them;
subcontractors or technical partners, when necessary for a specific project and appropriate contractual and organizational measures have been implemented;
competent state authorities, when provision is required by law.
We do not sell your personal data.
- International transfers
Some of our providers (e.g., Shopify and Google) may process data outside the European Economic Area. Where such a transfer is applicable, a valid transfer mechanism and appropriate safeguards are used in accordance with applicable legislation, including standard contractual clauses.
- How long we store data
We store personal data only for as long as necessary for the purpose for which it was collected, as well as for the periods we are obliged to comply with by law.
Unsuccessful/inactive inquiries: up to 12 months.
Active clients and project communication: for the duration of the project and a subsequent reasonable period necessary for support, rights protection, and business documentation.
Accounting documents: in accordance with applicable legal deadlines.
Marketing data: until consent/objection is withdrawn or the applicable basis ceases to exist.
Technical logs and analytical data: according to the actual configuration and terms of the providers used.
- Your rights
Subject to applicable legislation, you may have the right to:
obtain information and access to your personal data;
request correction of inaccurate or incomplete data;
request erasure of data when legal conditions are met;
request restriction of processing;
object to certain processing, including when it is based on legitimate interest;
receive applicable data in a structured, commonly used, and machine-readable format and/or request transfer, where the right to data portability is applicable;
withdraw your consent at any time, when processing is based on consent, without affecting the lawfulness of processing before withdrawal.
To exercise a right, contact us at regina95.web@gmail.com. We may request reasonable information to confirm your identity before fulfilling a request.
- Complaint to a supervisory authority
If you believe that your personal data is being processed in violation of applicable rules, you can file a complaint with the competent supervisory authority.
For Bulgaria, this is the Commission for Personal Data Protection (CPDP). Current contact details and methods are published on the official CPDP website.
- Automated decision-making
We do not use automated decision-making that produces legal effects concerning you or similarly significantly affects you. If this changes, we will update this Policy and provide the required information.
- Security
We implement reasonable technical and organizational measures appropriate to the nature of the data and the risks of processing. However, no internet service or electronic transmission can be guaranteed to be absolutely secure.
- Data of other persons provided by a client
If, within a project, a client provides us with personal data of their clients, employees, or other persons, the roles and responsibilities of the parties must be determined according to the specific processing. When Regina acts as a data processor on behalf of a client, a separate data processing agreement may be necessary.
- External sites
Our site may contain links to third-party sites and services. Their privacy practices are not controlled by Regina, and we recommend that you review their respective policies.
- Changes to this Policy
We may update this Policy as our services, providers, technologies, or legal requirements change. The current version will be published on this page, along with the date of the last update.
Last updated: 6.09.2026