Last updated: 26 September 2026
This policy explains what personal data ARAY collects when you visit this website, join the email list, use the assistant or place an order, why we collect it and what your rights are.
Who we are
ARAY, 4700 Smolyan, Bulgaria. Email: araywear@gmail.com. We are the controller of your personal data.
What we collect and why
Orders
Name, delivery and billing address, email, phone number and what you ordered. We use it to make and deliver your order, to handle returns and to answer your questions. Legal basis: the contract with you (Art. 6(1)(b) GDPR) and our accounting and tax obligations (Art. 6(1)(c) GDPR).
Payments are processed by Shopify and its payment partners. We never see or store your full card number.
Email list
Your email address, if you sign up to hear when a drop opens. Legal basis: your consent (Art. 6(1)(a) GDPR). Every email has an unsubscribe link, and you can also write to us.
Assistant
What you type in the assistant is sent to our server and to an AI service that writes the reply. Before a question is stored, email addresses and phone numbers are removed from it. Stored questions are deleted after 30 days. Your IP address is turned into a one-way code, used only to stop abuse. Please do not share personal data in the chat. Legal basis: our legitimate interest in answering questions about ARAY (Art. 6(1)(f) GDPR).
Messages to us
When you write to us, we use your email and message to reply. Legal basis: our legitimate interest in answering you (Art. 6(1)(f) GDPR).
Cookies
The shop uses cookies that are needed for the bag, checkout and security. Cookies for statistics or marketing are only used where you agree to them, and you can change your choice at any time.
Who receives your data
- Shopify, which hosts the shop, the checkout and payments.
- Our production partner and the courier, who make and deliver your order.
- The hosting provider of the assistant and the AI service that writes its replies.
- Our email provider, when you write to us.
- Authorities, only where the law requires it.
We do not sell your personal data.
Transfers outside the EU
Some of these providers may process data outside the European Economic Area. Where they do, the transfer is protected by an adequacy decision or the European Commission's Standard Contractual Clauses.
How long we keep it
- Order data and invoices: as long as Bulgarian accounting and tax law requires.
- Email list: until you unsubscribe.
- Assistant questions: 30 days.
- Messages to us: as long as needed to answer and follow up.
Your rights
You can ask for access to your data, correction, deletion, restriction, a copy in a portable format, and you can object to processing based on legitimate interest. Where we rely on consent, you can withdraw it at any time. Write to araywear@gmail.com and we will reply within one month.
You can also complain to the Bulgarian Commission for Personal Data Protection: www.cpdp.bg.
Changes
If this policy changes, the new version is published on this page with a new date.
