Privacy Policy

We value your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, and share personal data when you visit or make a purchase from our website.

Ipek Gorur, headquartered at R. Fernando Farinha 35A, 1950-448 Lisbon, Portugal, VAT number 320348040, is the entity responsible for processing your personal data in accordance with EU General Data Protection Regulation (GDPR).

Information We Collect

Order Information: name, billing and shipping address, payment details, email address, and phone number. This information is necessary to process and deliver your order.
Customer History: purchase history, communications with customer support, and responses to campaigns or surveys.
Device Information: browser type, IP address, time zone, cookies, and pages you visit on our site. This helps us improve our website and prevent fraud.
Cookies: our site uses cookies to enhance your browsing experience. You may disable cookies in your browser settings, but some site features may not function properly.

How We Use Your Information

We process your personal data for the following purposes:

To fulfill and deliver your orders, process payments, and provide customer service (contractual necessity).
To comply with legal and tax obligations (legal requirement).
To prevent fraud and secure our website (legitimate interest).
To communicate with you about products and updates, if you have subscribed to our newsletter (consent or legitimate interest if you are a customer).

Sharing of Personal Data

We share personal data only with trusted service providers that help us run our business, such as:

Shopify (platform provider)
Payment processors (for secure transactions)
Shipping and logistics partners (for order delivery)
Analytics tools (to improve our website)
We may also disclose personal data to authorities if required by law.

Data Retention

We keep your personal data only as long as necessary for the purpose it was collected, and in line with legal obligations. For example:

Order information is kept for accounting and tax purposes.
Marketing-related data is kept for up to 5 years or until you withdraw consent.

Your Rights

As a data subject, you have the right to:

Access the data we hold about you.
Request correction or deletion of your personal data.
Object to or restrict certain processing activities.
Withdraw your consent at any time (for marketing and similar purposes).
Request data portability.

To exercise your rights, please contact us at hello@bulbyco.com.

Supervisory Authority

If you believe your data rights have been violated, you may file a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados – CNPD):
Rua de São Bento, no. 148, 3º, 1200-821 Lisbon, Portugal
Tel: +351 213928400
Email: geral@cnpd.pt

Children’s Data

We do not knowingly collect or process personal data from children under 16 years of age. If we become aware of such collection, we will delete the information immediately.

International Transfers

Because we use Shopify and related services, your data may be transferred outside the EU (for example, to Canada or the United States). Shopify and its partners ensure that appropriate safeguards are in place so your data is protected as if processed in the EU.