Privacy Policy

Last updated: 12 November 2026

The Bulgarian version of this page is authoritative. Translations into other languages are provided for convenience only; in the event of any discrepancy between them and the Bulgarian text, the Bulgarian text shall prevail.

This policy explains how the online shop "Gemba Kids" at https://gembakids.com processes your personal data. It has been prepared in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and the Bulgarian Personal Data Protection Act.

1. Data controller

The controller of your personal data is:

• GEMBA EOOD (a single-member private limited liability company, "GEMBA" EOOD)
• UIC (Unified Identification Code): 208656371
• VAT number: BG208656371
• Registered office and address of management: бул. Княз Борис I № 109, ет. 13, ап. 50, 9002 Варна, България (Bulgaria)
• Manager: Slavcho Ivanchev Ivanov
• Email: [email protected]

For any questions relating to your personal data, you can contact us at [email protected].

2. What personal data we process

We process the following categories of data:

• Identification and contact data: name, delivery address, billing address, email address, telephone number.
• Order data: goods ordered, amounts, order number, payment reference number, payment status, correspondence relating to the order, complaints and withdrawal from the contract.
• Account data: the data you entered when registering and in your account settings, as well as your order history.
• Invoicing data: where you request an invoice, the details of the individual or the business (name, company number and, optionally, VAT number).
• Technical data: IP address and device data recorded in server logs.
• Newsletter data: your email address, if you have consented to receive our newsletter.

We do not see or store payment card details. Payments are processed by the payment service provider GembaPay (card payments are processed via Stripe). We receive from the payment service provider only the information needed for the order, such as the transaction reference number and whether the payment was successful.

The data required for the order (name, address, email address, telephone number) are necessary for entering into and performing the contract. Without them, we cannot accept, fulfil and deliver your order.

3. Purposes and legal bases

We do not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR.

4. Sales documents and invoices

Following successful card payment, we immediately send you by email a PDF sales receipt in accordance with Article 52o of Ordinance No. N-18. It contains its own 10-digit number, the order number, the payment reference number, the goods, the total amount and a QR code. This document is not an invoice.

An invoice is issued on request for any paid order at https://gembakids.com/invoice. To request one, the order number and the email address used to place the order are used, and the invoice is sent to that same email address.

In accordance with accounting and tax legislation, we keep a register of documents issued. It records the document number, the order, the payment reference number, the amounts, the invoice recipient's details, and the time and outcome of sending the email to you.

5. Recipients of the data

We share personal data only to the extent necessary for the purposes stated, with the following recipients and processors:

• Payment service provider: GembaPay and Stripe – to process payments and refunds.
• Supplier and its logistics partners: CJ Dropshipping (China) – to fulfil and deliver orders. The data required for delivery are passed to them: name, address and telephone number.
• Cloudflare: content delivery network (CDN) and website protection.
• The hosting infrastructure on which the website runs.

Emails are sent via our own mail server.

We may also disclose data to public authorities where we are required to do so by law.

6. Transfers of data outside the EEA

The goods are dispatched from the supplier's warehouses, which are located mainly outside the European Union. Your delivery data (name, address and telephone number) are therefore transferred to CJ Dropshipping and its logistics partners in China, i.e. outside the European Economic Area (EEA).

There is no European Commission adequacy decision for China. The transfer takes place on the basis of Article 49(1)(b) GDPR, as it is necessary for the performance of the contract between you and us. Without transferring these data, we cannot deliver your order. We therefore transfer only the data necessary for delivery.

7. Retention period

• Account data: retained for as long as the account exists.
• Order data, sales documents, invoices and the register of documents issued: retained for the periods laid down in accounting and tax legislation.
• Newsletter data: retained until you withdraw your consent.
• Technical data in server logs: retained for as long as necessary for security purposes.

Once the relevant period has expired, the data are deleted or anonymised.

8. Deleting your account

You can delete your account yourself from your account settings. When you do so, your personal data are deleted or anonymised. The exception is order data that we are required to retain by law. These are kept only for the statutory period and only for the purposes required by law.

9. Newsletter

We send the newsletter only if you have given your express consent to it. You can withdraw your consent at any time by writing to us at [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

10. Cookies

We use only strictly necessary cookies: for the basket, for the session when you log in to your account, and to save your language and theme preferences. We also use Cloudflare security cookies. We do not currently use advertising or tracking cookies. If we introduce such cookies in the future, we will ask for your consent beforehand.

11. Your rights

Under the GDPR, you have the right to:

• access the personal data we process about you;
• rectification of inaccurate or incomplete data;
• erasure of your data (the "right to be forgotten"), unless we are required by law to retain them;
• restriction of processing;
• data portability in respect of the data you have provided to us and that we process on the basis of a contract or consent;
• object to processing based on legitimate interest;
• withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise your rights, write to us at [email protected]. We will respond without undue delay and in any event within one month, in accordance with the GDPR. We may ask for additional information to verify your identity.

12. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. The website is protected by Cloudflare's security services. Payment card details are processed by the payment service provider and do not reach us. Access to personal data is limited to those persons who need it to fulfil orders or our legal obligations.

13. Children

The shop offers products for children and babies, but it is intended for parents and other adult buyers, not for use by children. Persons under the age of 16 must not create an account or place orders. We do not knowingly collect personal data from persons under 16. If we discover that we have received such data, we will delete them, unless the law requires us to retain them.

14. Complaints

If you believe that we are processing your personal data in breach of the law, you can lodge a complaint with a supervisory authority. In Bulgaria, this is the Commission for Personal Data Protection (cpdp.bg). You may also contact the supervisory authority in the country where you live or work. We recommend that you contact us first at [email protected] so that we can try to resolve the matter.

15. Changes to this policy

We may update this policy, for example in the event of changes to our data processing or to the law. The current version is published on this page together with the date of the last update.