Privacy policy

1. Who is responsible for your data

The data controller is "24wonders" Ltd., VAT number BG207551257, 13 Arch. Nikola Lazarov St., 1756 Sofia, Bulgaria (“24wonders”, “we”, “us”).

For any question about this policy or your personal data, write to support@24wonders.com.

2. What we collect and why

We only collect the data we need for the purposes below. For each one we name the legal basis under Article 6 GDPR.

• Orders — your name, email address, phone number, delivery address and what you ordered. We use this to take payment, make and deliver your order, send order emails and handle returns. Legal basis: performance of a contract (Art. 6(1)(b)), and our legal obligations under tax and accounting law (Art. 6(1)(c)).
• Payment details — when you pay by card, your card details are entered on Stripe’s secure payment page and processed by Stripe. We never see or store your full card number. For orders paid on delivery, the courier collects the payment.
• “Notify me” sign-ups — your email address, the page you signed up on and the time. We use it to tell you when new wonders are released. Legal basis: your consent (Art. 6(1)(a)). You can withdraw it at any time with the unsubscribe link in every email or by writing to us.
• Messages you send us — your name, email address and what you write. We use it to answer you. Legal basis: performance of a contract where it concerns an order (Art. 6(1)(b)); otherwise our legitimate interest in answering enquiries (Art. 6(1)(f)).
• Technical data — when you visit the site our hosting provider automatically records your IP address, browser type, the page requested and the time. This is needed to deliver the site and keep it secure. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f)).
• Your bag — the items in your bag are stored only in your own browser until you go to checkout. We do not receive them before then.

We do not sell your personal data, and we do not use it for automated decision-making or profiling that has legal or similarly significant effects on you. Stripe may automatically screen payments for fraud as part of processing them.

3. Cookies and similar technologies

This site only uses storage that is strictly necessary for it to work, which does not require consent:

• 24wonders-bag (browser local storage) — keeps the items in your bag between visits. Kept until you empty your bag or clear your browser data.
• 24wonders-consent (browser local storage) — remembers your cookie choice so we do not ask again. Kept for 12 months.

We do not currently use analytics, advertising or social media cookies. If we add any, they will only run after you choose “Accept all” in the cookie banner. You can change your choice at any time with the “Cookie settings” link at the bottom of every page.

When you pay, Stripe’s checkout page sets its own cookies to process the payment and prevent fraud. These are described in Stripe’s cookie policy at stripe.com/cookies-policy/legal.

4. Who we share your data with

We share personal data only with service providers who process it on our behalf under a data processing agreement, and only as far as they need it:

• Vercel Inc. (USA) — hosts the website.
• Stripe Payments Europe Ltd. (Ireland) and its affiliates — processes card payments and runs the payment page. Receives your name, email address and order details.
• Zoho Corporation B.V. (Netherlands), Zoho Mail — sends the order emails to you and to us.
• [FULFILMENT PARTNER] — prints, packs and ships your order. Receives your name, shipping address and order details.
• Delivery companies — receive your name, shipping address and, where needed for delivery, your phone number or email address.
• [NEWSLETTER PROVIDER] — sends our “Notify me” emails.
• Accountants, tax authorities, courts or other public authorities — where the law requires it.

5. Transfers outside the EU

Some of our providers, such as Vercel and Stripe’s affiliates, process data in the United States. Where data leaves the European Economic Area, it is protected by the EU–US Data Privacy Framework where the provider is certified under it, or by the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.

6. How long we keep your data

• Order and invoice records — for as long as tax and accounting law requires ([RETENTION PERIOD, E.G. 10 YEARS]).
• Other order data, such as order emails — up to 3 years after the order, so we can handle returns, warranty questions and legal claims.
• “Notify me” sign-ups — until you unsubscribe or withdraw your consent.
• Messages you send us — up to 2 years after our last contact, unless they relate to an order.
• Hosting logs — for the short period set by our hosting provider, normally no more than 30 days.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data erased, where we have no legal reason to keep it;
• restrict how we use your data;
• receive the data you gave us in a structured, machine-readable format, and have it sent to another company (data portability);
• object to processing based on our legitimate interests;
• withdraw your consent at any time, without affecting processing that took place before you withdrew it.

To use any of these rights, write to support@24wonders.com. We will answer within one month. We may ask you to confirm your identity first.

You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work. Our lead authority is [SUPERVISORY AUTHORITY].

8. Security

The site is served only over an encrypted connection (HTTPS), payments are handled by Stripe, which is certified to the PCI DSS Level 1 standard, and access to personal data is limited to the people and providers who need it.

9. Children

Our shop is not aimed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this policy when our services or the law change. The date at the top shows when it was last updated. If the changes are significant, we will tell you on the site or by email.