Privacy policy
and Personal Data Protection
Last updated: 22.10.2026
This policy explains how we process your personal data when you visit our website or purchase goods from it, and what rights you have in relation to that processing.
1. PERSONAL DATA CONTROLLER
| Item | Details |
| Controller | MIYAMMI-29 EOOD |
| UIC (Unified Identification Code) | 207831825 |
| Registered office and management address | 14 Kesten Street, Entrance V, Floor 2, Apartment 4, 9000 Varna |
| Email address for data protection enquiries | hola@lostbandidos.com |
| Telephone | +359879939535 |
| Data protection officer | None appointed |
2. WHAT DATA WE PROCESS
- Identification data: first name, middle name, and surname.
- Contact details: delivery address, billing address, email address, telephone number.
- Order data: items purchased, sizes, value, date, payment and delivery method.
- Payment data: payment status and the last digits of the card. We do not store full payment card details.
- Returns and claims data: submitted requests, photographs, inspection reports, correspondence.
- Technical data: IP address, device and browser type, data on visits to the Website collected through cookies.
- Account data: username and order history, if you create an account.
- Marketing data: email address, if you have subscribed to a newsletter.
3. PURPOSES, LEGAL BASES AND RETENTION PERIODS
| Purpose | Legal basis | Retention period |
| Order fulfilment, delivery, communication regarding the order | Performance of a contract - Article 6(1)(b) GDPR | Until the contract has been performed and the limitation periods have expired |
| Issuing and retaining accounting documents | Legal obligation - Article 6(1)(c) GDPR | In accordance with the Accountancy Act and tax legislation |
| Handling returns and complaints | Performance of a contract and legal obligation | Two years from delivery, or until the dispute is concluded, as applicable |
| Sending newsletters and marketing communications | Consent - Article 6(1)(a) GDPR | Until consent is withdrawn |
| Marketing and analytics cookies | Consent | In accordance with the Cookie Policy |
| Prevention of fraud and abuse | Legitimate interests - Article 6(1)(e) GDPR | 3 years from the last order or return |
| Establishment, exercise and defence of legal claims | Legitimate interests | Until the applicable limitation periods expire |
3.1. Legitimate interests - clarification
We process data on your order and return history to prevent fraud and abuse of the right of withdrawal. Our legitimate interests consist in protection against the systematic return of worn or used goods, which causes us pecuniary loss.
You have the right to object to processing based on legitimate interests at any time.
4. AUTOMATED DECISION-MAKING
We do not make decisions based solely on automated processing which produce legal effects concerning you or significantly affect you. The assessment of any potential abuse of the right of withdrawal is carried out by an employee, rather than automatically, and you may object to it.
5. VIDEO RECORDING WHEN OPENING RETURNED PARCELS
To document the condition of returned goods, the process of opening parcels is recorded on video. The recording covers the parcel and its contents, not individuals.
| Aspect | Information |
| Legal basis | Legitimate interests - proving the condition of the returned goods in the event of a dispute |
| Scope of the recording | The parcel and the goods; the details on the waybill |
| Retention period | 6 months, or until the dispute is concluded, as applicable. |
| Access | Authorised employees; provided to the Customer upon request in relation to the specific case |
6. RECIPIENTS OF THE DATA
We provide data to the following categories of recipients, who act as processors or as independent controllers:
- E-commerce platform: Shopify International Ltd. / Shopify Inc.
- Courier companies: Econt and Speedy.
- Payment service providers: licensed payment institutions and banks that process payments for orders.
- Accounting services: the accounting firm that provides services to the company.
- Marketing platforms: Meta Platforms Ireland Ltd. (Facebook, Instagram).
- Analytics tools: Google Ireland Ltd. (Google Analytics).
- Providers of software and applications for the online store: services for sending email messages and managing cookie consent.
- Public authorities, where provided for by law.
We provide information on the specific recipients of your data upon request.
6.1. Joint controllership with Meta
When using Meta's measurement and advertising tools (“Meta Pixel”), we and Meta Platforms Ireland Ltd. act as joint controllers in relation to the collection and transmission of the data. Meta also processes the transmitted data for its own purposes as an independent controller.
The main content of the joint controllership agreement is available at: https://www.facebook.com/legal/controller_addendum.
7. TRANSFERS OF DATA OUTSIDE THE EEA
Some of our providers process data outside the European Economic Area (EEA):
- Shopify - data may be processed in Canada and the United States of America. Basis: the European Commission's adequacy decision for Canada and standard contractual clauses adopted by the European Commission.
- Google (Google Analytics) and Meta (Facebook, Instagram, Meta Pixel) - data may be processed in the United States of America. Basis: the European Commission's decision on the EU-US Data Privacy Framework, insofar as the recipient is certified under it, and in other cases - standard contractual clauses.
Where another provider of ours processes data outside the EEA, the transfer is carried out on the basis of an adequacy decision by the European Commission or standard contractual clauses, accompanied, where necessary, by supplementary technical and organisational measures. You can obtain information about the applicable safeguards at the email address indicated above.
8. YOUR RIGHTS
- Right of access - to obtain confirmation as to whether we process your data and a copy of those data.
- Right to rectification - to request the correction of inaccurate data or the completion of incomplete data.
- Right to erasure - to request the erasure of the data where one of the grounds under the GDPR applies.
- Right to restriction of processing.
- Right to data portability - to receive the data in a structured, commonly used and machine-readable format.
- Right to object to processing based on legitimate interests, as well as to direct marketing.
- Right to withdraw your consent at any time, without affecting the lawfulness of processing before its withdrawal.
- Right to lodge a complaint with the supervisory authority.
These rights are exercised by submitting a request to: hola@lostbandidos.com. We respond within one month, which may be extended by a further two months where the request is complex; you will be notified of this.
8.1. Supervisory authority
Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Boulevard; 1592 Sofia, tel. 02/915 3518; email: kzld@cpdp.bg; www.cpdp.bg
9. PERSONS UNDER 14 YEARS OF AGE
Our website is not directed at persons under 14 years of age. Where processing is based on consent in connection with information society services, for persons under 14 years of age, consent or confirmation from the holder of parental responsibility is required.
If we establish that we have collected data relating to a person below that age without duly obtained consent, we will erase those data.
10. DATA SECURITY
We implement appropriate technical and organisational measures to protect data against unauthorised access, loss, alteration or disclosure, including an encrypted connection, restricted employee access and contractual safeguards from our providers.
11. COOKIES
The use of cookies and similar technologies is governed by a separate Cookie Policy available on the Website.
12. CHANGES
This policy may be amended. The current version is published on the Website with the date of the last update indicated. We will notify you of material changes in an appropriate manner.
