Privacy policy
Last updated 23 October 2026 · version 3
This policy says what personal data Capasithé keeps about you, why and on what legal basis, who receives it, how long we keep it and what rights you have. It covers the website, your account, your orders and your emails to us.
Who is responsible for your data
The controller of your personal data is КАПАСИТЕ ЕООД (CAPASITHE LTD), company number (ЕИК) 208967625, zh.k. Druzhba 1, bl. 195, vh. V, et. 4, ap. V44, 1592 Sofia, Bulgaria, which runs Capasithé.
For anything about your personal data, write to privacy@capasithe.com. We have not appointed a data protection officer, as the law does not require one of a business like ours; this address reaches the person responsible.
What we keep, why, and on what basis
The legal bases named below are those of Article 6(1) of the General Data Protection Regulation (GDPR): a contract with you, a legal obligation, our legitimate interests, or your consent.
- Your account. Your email address, the language you use and, if you choose them, the country prices are shown for and whether you see business prices. We need them to sign you in, to send you sign-in codes and to keep your designs and orders together. Basis: contract.
- Signing in and security. Your sign-in sessions, with the kind of device and browser and a shortened form of the network address they came from, and records of sign-in attempts and other security events, which keep your email address only as a fingerprint. Sign-in codes are stored only as fingerprints too. We use them to keep your account safe, to show you where you are signed in and to stop attacks. Basis: our legitimate interest in a secure shop and secure accounts.
- Your designs and files. The boxes you configure, the designs you make and the files you upload, with whatever they contain. We keep them so that you can work on them, see their proofs and order them. Basis: contract, and before you have an account our legitimate interest in keeping your work for you.
- Your orders. Your name, the delivery address, your email address, for a business its name and VAT number, what you ordered, the approved proof, the price, VAT and delivery charged, the payment's reference and the order's progress. We need them to make, deliver and invoice your order, to handle complaints and to keep the accounts the law requires. Basis: contract, and the legal obligations of accounting and tax law.
- VAT number checks. When a business gives us its VAT number, we check it with the European Commission's VIES service and keep the answer, with the name and address VIES gives for the number. Basis: legal obligation (the evidence VAT law requires for a sale without VAT).
- Payments. Stripe takes your card details on its own payment page. We receive whether the payment succeeded, its amount and its reference, never your card number. Basis: contract, and the legal obligations of accounting and tax law.
- Emails. The emails we send you (sign-in codes, proofs, news of your order) and the emails you send us, with what they contain. Basis: contract, and our legitimate interest in answering you.
- Your privacy choices. What you chose in Privacy choices, when, on which version of its text, and the browser or account it was made in, never your name or address. Basis: legal obligation (the GDPR requires us to be able to show your consent).
- Analytics, only if you allow it. If you allow analytics in Privacy choices, and while we use it, Google Analytics counts visits, the pages seen and the campaigns visitors came from, recognising your browser by its cookies. When you pay, we tell it the order's number, amount and kind of box, never your name, email or address. Basis: consent, which you can withdraw at any time in .
- Where a visit came from. If you came through one of our campaign links, the campaign's name is kept with the designs you start and with your orders, so that we know which campaigns work. Basis: our legitimate interest in knowing which campaigns bring customers.
- Server logs. Every request to the shop is logged with its time, what was asked for, your network address and your browser, without passwords, codes or cookies. We use the logs to run the shop, to find faults and to detect attacks. Basis: our legitimate interest in a working and secure shop.
- Error reports and counted visits. When a page fails in your browser, it sends us the error without anything that names you or your device; and we count the visits that reached a price, with the campaign they came from and nothing else. Basis: our legitimate interest in a working shop.
- Your country, from your network address. To show prices with the right VAT, we look up the country of your network address in a database on our own server (DB-IP's). Nothing is sent to anyone for it and the lookup is not stored; only a country you choose yourself is remembered. Basis: our legitimate interest in showing you correct prices.
We do not sell your data, and we make no decision about you by automated means alone. You do not have to give us your data, but without an email address you cannot have an account, and without a name and an address we cannot deliver an order.
Who receives your data
We share personal data only as far as each recipient needs it. Those who process data on our behalf do so under contracts that bind them to our instructions.
- Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg) hosts the shop, its database, files and backups, and sends our emails, in its region in Frankfurt, Germany.
- Stripe (Stripe Payments Europe, Limited, Ireland) receives your email address and the order's amount, takes payments and makes refunds. Stripe also uses payment data as a controller in its own right, for example to prevent fraud and to meet its own legal duties: see Stripe's privacy policy.
- Zoho (Zoho Corporation B.V., the Netherlands) hosts our mailboxes, so the emails you send us and our replies are kept there.
- Couriers and the post: Speedy in Bulgaria, DPD elsewhere in the European Union and Bulgarian Posts outside it receive the name and address on each parcel, to deliver it.
- Production partners who make part of an order for us receive the artwork and the details of the order they need for that part.
- Our accountant, who keeps our books, receives our invoices and the orders behind them.
- Authorities: the National Revenue Agency (НАП) receives sales data as tax law requires, and an authority or a court receives data when the law obliges us to provide it.
- The European Commission receives a business's VAT number when we check it in VIES.
- Google (Google Ireland Limited) receives analytics data only if you allow analytics and only while we use Google Analytics: see Google's privacy policy.
Outside the European Economic Area
We keep your data in the European Union. Stripe and Google may process data in the United States and other countries. Both take part in the EU–US Data Privacy Framework, which the European Commission has found to protect personal data adequately, and they use the Commission's standard contractual clauses for other transfers. When we deliver outside the European Union, the carrier in the country of delivery receives the name and address on the parcel, as the delivery requires.
How long we keep it
- Invoices and accounting records: 10 years from the end of the year they belong to, as Bulgarian accounting law requires.
- Orders (what was ordered, by whom, delivered where, and what became of it): 5 years after delivery, the time in which claims under a contract expire in Bulgarian law.
- The print files of a delivered order: 12 months after delivery, so that we can reprint it under the guarantee or for a repeat order. The approved proof stays with the order.
- Designs and uploaded files in your account: until you delete them in My boxes. Deleting a design deletes its files, unless an order still needs them.
- Designs made without an account: kept while your browser's session lasts (until 30 days pass without a visit, and at most 180 days), and deleted with their files 24 hours after it ends. Sign in to keep a design: it then joins your account.
- Your account: until you ask us to close it. We then remove your name, email address, company and VAT number from it, and keep your orders and invoices for the periods above. Closing the account does not delete your designs: delete the ones you no longer want in My boxes first, or ask us to.
- Sign-in: a sign-in lasts at most 30 days, and a browser's visit without an account at most 180 days; 30 days after a session ends we erase its network address and device details. Sign-in codes are deleted a day after they expire.
- The security log: 180 days, and its nightly copy 400 days.
- Server logs: on the server until newer logs take their place, and their nightly copy 400 days.
- Records of your privacy choices: 3 years. Your browser remembers the choice itself for 6 months, and then we ask again.
- Analytics: the identifiers Google Analytics gives your browser are kept with an order only until the order is reported, and at most 30 days for an order never paid. Google keeps analytics data for the period we set in Google Analytics, at most 14 months.
- Error reports: 90 days. Counted visits: 2 years.
- Backups: our backups keep a copy of the database and files for up to a year (daily ones 30 days, weekly ones 90 days, monthly ones 365 days). Data deleted from the shop leaves the backups as they expire.
Your rights
Under the GDPR you have the right to:
- see the personal data we hold about you and receive a copy of it;
- have wrong data corrected;
- have your data deleted, unless we must keep it, as with invoices;
- have its use restricted while a question about it is settled;
- receive the data you gave us in a machine-readable form, or have it sent to someone else;
- object to what we do on the basis of our legitimate interests;
- withdraw a consent at any time in , without affecting what was done before.
Write to privacy@capasithe.com from the address of your account, or tell us how we can confirm that it is you. We answer within one month, and if a request is complex we tell you within that month that we need up to two months more. It is free, unless a request is clearly unfounded or excessive.
Complaints to the supervisory authority
If you think we handle your data unlawfully, you may complain to the Bulgarian Commission for Personal Data Protection (КЗЛД), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, cpdp.bg, or to the supervisory authority of the EU country where you live or work. We would be glad to hear from you first.
How we protect it
The shop works over encrypted connections only. Sign-in uses one-time codes, never stored in readable form, and sign-ins that end by themselves. Our staff sign in with a second factor. Only those who need data can reach it, and every action staff take on an order is recorded.
Children
The shop is not meant for children under 16, and we do not knowingly keep data about them.
Changes to this policy
When we change this policy, we publish the new version here with its date and version, at the top of this page. If a change affects what you have consented to, we ask you again.