Privacy policy

  PRIVACY POLICY

  Last updated: 1 July 2026

  This Privacy Policy explains how Yokiko EOOD (a sole-owner limited liability company registered in the Republic of Bulgaria, UIC 201463684) ("Protocol 13", "we", "us") collects, uses and protects your personal data when you visit or make a purchase at https://protocol13.eu (the "Site"). We act as the data controller for this processing
  under Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and the Bulgarian Personal Data Protection Act.

  1. WHO WE ARE (DATA CONTROLLER)

  Controller: Yokiko EOOD
  UIC (ЕИК): 201463684
  Registered address: 1A Kozhuh Planina St., Sofia, Bulgaria
  Represented by: Yoana Paspalanova (Managing Director)
  Contact for data protection: protocol.13.team@gmail.com, +359 878 878 807

  We have not appointed a Data Protection Officer, as we are not legally required to. You can raise any privacy question using the contact details above.

  2. WHAT PERSONAL DATA WE COLLECT

  Depending on how you use the Site, we may process:

  - Identity and contact data: name, email address, phone number, delivery and billing address.
  - Order and transaction data: products ordered, order value, order history, and returns. We offer Cash on Delivery, so payment is collected on our behalf by the courier when your order is delivered. We do not process or store card or bank-account numbers for purchases made through the Site.
  - Account data: if you create an account, your login email and account preferences.
  - Communications: messages you send us via the contact form, email, or social media, and our replies.
  - Marketing data: your consent status and preferences for newsletters and promotions.
  - Technical and usage data: IP address, device and browser type, language, pages viewed, and similar information collected through cookies and similar technologies (see our Cookie Policy and Section 8).

  You do not have to provide personal data, but some data is necessary to complete a purchase or create an account. If you do not provide it, we may be unable to provide the service.

  3. HOW WE COLLECT YOUR DATA

  - Directly from you, when you place an order, create an account, subscribe to our newsletter, or contact us.
  - Automatically, through cookies and similar technologies when you use the Site.
  - From our processors, for example our e-commerce platform and courier confirm transaction and delivery information.

  4. WHY WE PROCESS YOUR DATA AND OUR LEGAL BASES

  - To process and deliver your orders, manage returns and your customer account: performance of a contract (Art. 6(1)(b)).
  - To collect payment via cash on delivery: performance of a contract and legal obligation (Art. 6(1)(b) and (c)).
  - To respond to enquiries and provide customer support: contract and legitimate interests (Art. 6(1)(b) and (f)).
  - To keep accounting, tax and transaction records: legal obligation (Art. 6(1)(c)).
  - To send marketing emails and newsletters: your consent (Art. 6(1)(a)).
  - To set analytics and marketing cookies: your consent (Art. 6(1)(a)).
  - To maintain Site security and prevent fraud and abuse: legitimate interests (Art. 6(1)(f)).

  Where we rely on consent, you can withdraw it at any time (see Section 9). Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights, and you may object at any time (Section 9).

5. WHO WE SHARE YOUR DATA WITH (RECIPIENTS AND PROCESSORS)

  We do not sell your personal data. We share it only with parties that help us run the Site, each bound by a data processing agreement:

  - Shopify: our e-commerce platform and hosting provider (stores order, account and Site data).
  - BigArena: our fulfillment and logistics provider (warehousing, order processing, packing, courier dispatch, returns handling and cash-on-delivery processing). Receives name, address, phone and order details.
  - Econt and/or Speedy: couriers that deliver your orders and collect the Cash-on-Delivery amount (receive name, address, phone, order value).
  - Shopify Email: sending newsletters and transactional emails (if you have subscribed).
  - Our external accounting service provider: accounting and tax compliance.
  - A third-party currency-display service: converts and displays prices (BGN/EUR) and processes only technical Site data.
  - Public authorities, where we are legally required to disclose data.

  6. INTERNATIONAL TRANSFERS

  Some of our processors (for example Shopify and certain service providers) are located outside the European Economic Area, including in Canada and the United States. Where data is transferred outside the EEA, we rely on appropriate safeguards under GDPR, such as an adequacy decision, the EU-US Data Privacy Framework, and/or Standard
  Contractual Clauses, so that your data receives an equivalent level of protection. You can request a copy of the relevant safeguards using the contact details in Section 1.

  7. HOW LONG WE KEEP YOUR DATA

  - Order, transaction, accounting and tax records: retained as required by Bulgarian law (the Accountancy Act and the Tax-Insurance Procedure Code), generally up to 10 years from the end of the relevant financial year.
  - Account data: until you delete your account, or after a period of inactivity.
  - Marketing data: until you withdraw consent or unsubscribe.
  - Support correspondence: typically up to 3 years.
  - Cookies: for the periods stated in our Cookie Policy.

  When data is no longer needed, we delete or anonymise it.

  8. COOKIES

  We use cookies and similar technologies. Strictly necessary cookies are always active. Analytics and marketing cookies are used only with your consent, which you give via our cookie banner. For full details and how to change your choices, see our Cookie Policy.

  9. YOUR RIGHTS

  Under the GDPR you have the right to:

  - Access the personal data we hold about you.
  - Rectify inaccurate or incomplete data.
  - Erasure ("right to be forgotten") where applicable.
  - Restrict or object to processing (including direct marketing and processing based on legitimate interests).
  - Data portability: receive your data in a structured, machine-readable format.
  - Withdraw consent at any time, without affecting prior lawful processing.
  - Lodge a complaint with the supervisory authority (Section 11).

  To exercise any right, contact us at protocol.13.team@gmail.com. We respond within one month and do not charge a fee for legitimate requests.

  10. AUTOMATED DECISION-MAKING

  We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.

  11. SUPERVISORY AUTHORITY

  If you believe we have processed your data unlawfully, you may complain to the Bulgarian data protection authority:

  Commission for Personal Data Protection (CPDP / КЗЛП)
  2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
  Phone: +359 2 915 3 518
  Email: kzld@cpdp.bg
  Web: www.cpdp.bg

  12. CHILDREN

  The Site and our products are intended for adults aged 18 or over. We do not knowingly collect data from children.

  13. SECURITY

  We apply appropriate technical and organisational measures (encryption in transit, access controls, vetted processors) to protect your data against unauthorised access, loss or misuse.

  14. CHANGES TO THIS POLICY

  We may update this Privacy Policy from time to time. The "Last updated" date shows the current version. Material changes will be communicated on the Site.

  15. CONTACT

  Questions about this policy or your data:
  Yokiko EOOD, protocol.13.team@gmail.com, +359 878 878 807, 1A Kozhuh Planina St., Sofia, Bulgaria