Last updated: 2 November 2026
This policy explains what personal data the Shine M online shop (e-shinem.com) collects, what it uses it for, who it shares it with, how long it keeps it and what rights you have. It has been prepared in accordance with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act.
Data controller
SHINE M Ltd. (ШАЙН М ООД), UIC 203119727, registered office: 74 Patriarh Evtimiy Blvd., Sofia, Bulgaria. Phone: +359 896 760 731. Email: shinehobbi@gmail.com.
What data we collect
- When you order or register: first and last name, email, phone, delivery address or Econt office, and invoice details if you request an invoice.
- When you sign in with Google: name, email, profile picture and your Google account identifier. Your Google password never reaches us.
- Order data: items purchased, amounts, date, and delivery and payment method.
- Technical data: IP address, browser and device type, cookies. For details on cookies, see the Cookie Policy.
What we use it for and on what legal basis
- Processing your order, delivery, returns and complaints – performance of a contract (Art. 6(1)(b) GDPR).
- Your shop account and Google sign-in – performance of a contract, at your request.
- Accounting and taxes – legal obligation (Art. 6(1)(c)).
- Visitor statistics (Google Analytics) – only with your consent (Art. 6(1)(a)), given in the cookie banner.
- Protecting forms from automated requests (Google reCAPTCHA) and site security – legitimate interest (Art. 6(1)(f)).
We do not sell personal data and do not use it for automated decision-making or profiling.
Who we share data with
- Econt Express Ltd. – your name, phone and delivery address, so that the parcel can be delivered.
- SuperHosting.BG Ltd. – website hosting; the data is stored on servers in the European Union.
- Google Ireland Ltd. – Google sign-in, Google Analytics (with your consent) and Google reCAPTCHA.
- Our accountant and public authorities – where required by law.
How long we keep data
- Your account – until you ask us to delete it.
- Orders and invoices – 10 years, as required by the Accounting Act.
- Google Analytics data – up to 2 years.
Sign in with Google
If you sign in with Google, we receive only your name, email and profile picture, to create your shop account and show your picture at the top of the site. We get no access to your mail, contacts or any other Google data. You can remove the connection at any time in your Google account settings; your shop account remains until you ask us to delete it.
Your rights
You have the right to access your data, to rectification, erasure, restriction of processing, data portability and to object, as well as to withdraw your consent at any time. To exercise your rights, write to us at shinehobbi@gmail.com – we reply within one month. You also have the right to lodge a complaint with the Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg.
Security
The connection to the site is encrypted (HTTPS). Only the people who process orders have access to the data.
Changes to this policy
We may update this policy when the way we process data or the law changes. The date of the last update is shown at the top.
Contact
Shine M · 74 Patriarh Evtimiy Blvd., Sofia · tel. +359 896 760 731 · shinehobbi@gmail.com