Privacy policy

Last updated: 24 October 2026

Who is responsible for your data

Spider Ink is the studio's brand. The data controller is ЕС Груп България ЕООД (S Group Bulgaria LTD), company registration number 208016439. Registered office and address: 23 Aleksandar Malinov Boulevard, City Point Shopping Centre, floor 2, unit 77, Mladost 1A, Sofia 1729, Bulgaria.

For questions and requests about your personal data: studio@spider-ink.com, 0879 13 69 00. The studio is in Mladost 3, behind Block 342, Sofia.

What data we process and why

• Voucher orders: name, email address, phone number, billing details, value, recipient, message and selected delivery method. The legal basis is entering into and performing a contract under Article 6(1)(b) of the GDPR.
• Payments: amount, currency, status, transaction identifier and limited payment method details. Card field data is sent to Stripe; we do not store the full card number or CVC in WordPress. Payments and refunds form part of performing the contract.
• Delivery: if you choose Econt, we use the name, phone number and office or address required for delivery. No courier address is needed for collection from the studio.
• Accounting: order and accounting document data is processed to fulfil applicable legal obligations under Article 6(1)(c).
• Enquiries and website security: correspondence, IP addresses, technical logs and information about reported issues. The basis is our legitimate interest in answering enquiries, maintaining a secure service and defending legal claims under Article 6(1)(f). Where an enquiry concerns an order, the contractual basis also applies.

Required fields are marked in the form. Without the necessary details, we cannot process your order or delivery. Do not enter national identification numbers, medical information or card details in voucher messages or other free-text fields.

When the voucher is for someone else

We receive the recipient's name and message from the buyer to personalise the gift. We use them only for this purpose, on the basis of our legitimate interest in fulfilling the requested gift. The recipient has the same rights over their data. Please share this policy with them; if we contact the recipient directly, we also provide this information. We do not use their data for advertising.

Who we share data with

Authorised staff and service providers have access only to the extent needed for their task:

• SuperHosting and technical support providers — for the website, email, security and backups;
• Stripe and the payment institutions involved — for payments, authentication, fraud prevention and legal obligations;
• Econt — where delivery is selected;
• accounting and legal advisers, and competent authorities where there is a legal basis.

WooCommerce is the ordering software used in our WordPress website. This does not mean every order is automatically shared with every plugin provider. Stripe may act as a processor or an independent controller, depending on the activity. Details: Stripe's privacy policy.

Processing outside the European Economic Area

International providers such as Stripe may process data outside the EEA. Applicable mechanisms include adequacy decisions or standard contractual clauses and any necessary additional safeguards. Stripe's policy explains its specific mechanisms. You can ask us for further information about the safeguards applicable to our providers.

How long we keep data

The voucher is valid for 6 months, but this is not an automatic deletion period for all data. Orders and payment evidence are retained to perform the contract, comply with applicable accounting and tax retention periods, and defend legal claims. Enquiries are kept until resolved and for as long as needed for any subsequent dispute. Technical logs and backups are retained according to their security purpose and the relevant provider's cycle. When there is no longer a basis for retention, the data is deleted or anonymised.

Your rights

Subject to the applicable conditions, you have rights of access and a copy, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests. Where processing relies on consent, you can withdraw it for the future. Erasure does not override mandatory retention of accounting documents or the need to defend legal claims.

Email studio@spider-ink.com. We normally respond within one month; we will inform you of any legally permitted extension. We may request proportionate identity verification. You can lodge a complaint with the Commission for Personal Data Protection or with the competent supervisory authority where you live, work or believe an infringement has occurred.

Cookies, maps and social networks

The website uses technical mechanisms for sessions, the shopping cart, login and secure payment. Strictly necessary technologies do not require consent. Analytics and advertising technologies, when enabled, require a prior choice and the ability to refuse or withdraw consent.

The website includes an embedded Google Maps map that loads automatically with the page. When it loads, Google receives your IP address and technical data and may use cookies. WooCommerce Order Attribution tracking is disabled. Other third-party embeds and payment services may receive your IP address and technical data when they load. Links to Instagram, Facebook, TikTok and YouTube lead to separate services with their own policies.

Orders and marketing are separate

You do not have to consent to advertising to buy a voucher. The order confirmation, voucher code and fulfilment updates are service emails. If we offer a marketing subscription in future, it will be separate, optional and without a preselected checkbox.