Privacy Policy
Last updated: 12 November 2026
The Bulgarian version of this page is authoritative. Translations into other languages are provided for convenience only; in the event of any discrepancy between a translation and the Bulgarian text, the Bulgarian text shall prevail.
This policy explains how the online shop "Gemba Kids" at https://gembakids.com processes your personal data. It has been prepared in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and the Bulgarian Personal Data Protection Act.
1. Data controller
The controller of your personal data is:
- GEMBA EOOD (a single-member limited liability company, "GEMBA" EOOD)
- UIC (Unified Identification Code): 208656371
- VAT number: BG208656371
- Registered office and management address: бул. Княз Борис I № 109, ет. 13, ап. 50, 9002 Варна, България (Bulgaria)
- Manager: Slavcho Ivanchev Ivanov
- E-mail: [email protected]
For any questions relating to your personal data, you can contact us at [email protected].
2. What personal data we process
We process the following categories of data:
- Identification and contact data: name, delivery address, billing address, e-mail address, telephone number.
- Order data: goods ordered, amounts, order number, payment reference number, payment status, correspondence relating to the order, complaints and withdrawal from the contract.
- Account data: the data you entered when registering and in your account settings, as well as your order history.
- Invoicing data: where you request an invoice, the details of the individual or company (name, company number and, optionally, VAT number).
- Technical data: IP address and device data recorded in server logs.
- Newsletter data: your e-mail address, if you have consented to receive our newsletter.
We do not see or store bank card details. Payments are processed by the payment service provider GembaPay (card payments are processed via Stripe). We receive from the payment service provider only the information needed for the order, such as the transaction reference number and whether the payment was successful.
The data required for the order (name, address, e-mail address, telephone number) is necessary for entering into and performing the contract. Without it, we cannot accept, fulfil and deliver your order.
3. Purposes and legal bases
| Purpose | Legal basis under the GDPR |
|---|---|
| Entering into and performing the contract of sale, processing the order and payment | Art. 6(1)(b) – performance of a contract |
| Delivery of the goods, including sending a tracking number | Art. 6(1)(b) – performance of a contract |
| Customer service, complaints, withdrawal from the contract and refunds | Art. 6(1)(b) – performance of a contract; Art. 6(1)(c) – legal obligation (under the Bulgarian Consumer Protection Act) |
| Creating and maintaining an account | Art. 6(1)(b) – performance of a contract (the account terms of use) |
| Issuing sales receipts and invoices, keeping a register of issued documents, accounting and tax obligations | Art. 6(1)(c) – legal obligation (accounting and tax legislation) |
| Website security, prevention of misuse and protection against attacks | Art. 6(1)(f) – legitimate interest in maintaining a secure and functioning website |
| Sending the newsletter | Art. 6(1)(a) – consent |
We do not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR.
4. Sales receipts and invoices
Following a successful card payment, we immediately send you by e-mail a PDF sales receipt in accordance with Article 52o of Ordinance No. H-18. It contains its own 10-digit number, the order number, the payment reference number, the goods, the total amount and a QR code. This document is not an invoice.
An invoice is issued on request for any paid order at https://gembakids.com/invoice. For this purpose, the order number and the e-mail address used to place the order are required, and the invoice is sent to that same e-mail address.
In accordance with accounting and tax legislation, we keep a register of issued documents. It records the document number, the order, the payment reference number, the amounts, the details of the invoice recipient, and the time and outcome of sending the e-mail to you.
5. Recipients of the data
We disclose personal data only to the extent necessary for the purposes stated, to the following recipients and processors:
- Payment service provider: GembaPay and Stripe – for processing payments and refunds.
- Supplier and its logistics partners: CJ Dropshipping (China) – for fulfilling and delivering orders. They receive the data necessary for delivery: name, address and telephone number.
- Cloudflare: content delivery network (CDN) and website protection.
- The hosting infrastructure on which the website runs.
E-mails are sent via our own mail server.
In addition, we may disclose data to public authorities where we are required to do so by law.
6. Transfers of data outside the EEA
Goods are dispatched from the supplier's warehouses, which are located mainly outside the European Union. For this reason, your delivery data (name, address and telephone number) is transferred to CJ Dropshipping and its logistics partners in China, i.e. outside the European Economic Area (EEA).
There is no European Commission adequacy decision for China. The transfer is carried out on the basis of Article 49(1)(b) GDPR, as it is necessary for the performance of the contract between you and us. Without transferring this data, we cannot deliver your order. We therefore transfer only the data necessary for delivery.
We do not have a public data processing agreement, standard contractual clauses or an EU representative for this supplier, and we therefore do not claim that the transfer is covered by such safeguards. For Stripe, a data processing agreement incorporating standard contractual clauses is publicly available.
7. Retention period
- Account data: retained for as long as the account exists.
- Order data, sales receipts, invoices and the register of issued documents: retained for the periods laid down in accounting and tax legislation.
- Newsletter data: retained until you withdraw your consent.
- Technical data in server logs: retained for as long as necessary for security purposes.
Once the relevant period has expired, the data is deleted or anonymised.
8. Deleting your account
You can delete your account yourself from your account settings. Upon deletion, your personal data is deleted or anonymised. The exception is order data that we are required by law to retain. Such data is kept only for the statutory period and only for the purposes required by law.
9. Newsletter
We send the newsletter only if you have given your express consent. You may withdraw your consent at any time by writing to us at [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
10. Cookies
We use only strictly necessary cookies: for the basket, for the session when you log in to your account and for saving your language and theme preferences. We also use Cloudflare security cookies. We do not currently use advertising or tracking cookies. Should we introduce such cookies in the future, we will ask for your consent beforehand.
11. Your rights
Under the GDPR, you have the right to:
- access the personal data we process about you;
- rectification of inaccurate or incomplete data;
- erasure of your data (the "right to be forgotten"), unless we are required by law to retain it;
- restriction of processing;
- portability of the data you have provided to us and which we process on the basis of a contract or consent;
- object to processing based on legitimate interest;
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise your rights, write to us at [email protected]. We will respond without undue delay and in any event within one month, in accordance with the GDPR. We may ask for additional information to verify your identity.
12. Security
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. The website is protected by Cloudflare's security services. Bank card details are processed by the payment service provider and do not reach us. Access to personal data is restricted to those persons who need it to fulfil orders or our legal obligations.
13. Children
The shop offers goods for children and babies, but is intended for parents and other adult purchasers, not for use by children. Persons under the age of 16 must not create an account or place orders. We do not knowingly collect personal data from persons under 16. If we discover that we have received such data, we will delete it unless the law requires us to retain it.
14. Complaints
If you believe that we are processing your personal data in breach of the law, you may lodge a complaint with a supervisory authority. In Bulgaria, this is the Commission for Personal Data Protection (cpdp.bg). You may also contact the supervisory authority in the country in which you live or work. We recommend that you first contact us at [email protected] so that we can try to resolve the matter.
15. Changes to this policy
We may update this policy, for example in the event of changes to our data processing or to the law. The current version is published on this page together with the date of the last update.