Data Controller
The Data Controller is HAPPY CLEVER KIDS LTD, UIC 206931281, address: 14 Burov Street, Ruse (7000), email info@happycleverkids.com, phone +359 88 343 22 00.
Categories of Data Processed
- Identification and contact data – name, phone number, email, delivery/billing address, company details when issuing an invoice;
- Profile data – username, password in encrypted/hashed form, order history, and preferences;
- Inquiry and communication data – content of messages, calls, correspondence, and responses;
- Event participation data – details of a parent/legal representative, data about a child when necessary for organizing a specific event, age group, specific instructions when provided by the customer;
- Technical data – IP address, logs, device/browser identifiers, data from cookies and similar technologies;
- Marketing data – subscription data, given/withdrawn consents, interactions with newsletters and campaigns.
Purposes and Legal Grounds
| Purpose | Legal Basis |
| Processing orders, payments, delivery, complaints, and accounting services | Performance of a contract and legal obligation |
| Registration and maintenance of user accounts | Performance of a contract / steps taken prior to entering a contract |
| Responding to inquiries via contact form, email, or phone | Legitimate interest or steps taken at the request of the data subject |
| Sending marketing messages and newsletters | Consent |
| Website analytics, security, prevention of abuse, and protection of the website | Legitimate interest; for non-essential cookies – consent |
| Compliance with legal obligations (tax authorities, accounting, protection of rights in disputes) | Legal obligation and legitimate interest |
Recipients of the Data
The data may be disclosed to accountants, courier operators, hosting providers, website maintenance providers, email marketing platforms, payment service providers, IT consultants, providers of analytics and marketing services, public authorities, and other parties where necessary for a legitimate purpose and where a legal basis exists.
Transfers Outside the EEA
When using services of international providers, including analytics, marketing, cloud, or communication platforms, data may be processed outside the European Economic Area. In such cases, the Data Controller shall ensure an appropriate legal basis for the transfer, including an adequacy decision, standard contractual clauses, or another lawful mechanism under the GDPR. Specific providers and mechanisms should be documented and kept up to date in the internal register and the cookie policy.
Data Retention Periods
- Contractual and accounting data – for the periods required under applicable accounting and tax legislation;
- User account data – until the account is closed and for a reasonable period thereafter for the defense against legal claims, unless a longer retention period is required by law;
- Inquiries – until the communication is completed and for up to 1 year thereafter, unless they are related to a contract or a dispute;
- Marketing consents and proof thereof – until consent is withdrawn and for a reasonable period thereafter to demonstrate compliance;
- Technical logs and security data – for a limited period, as necessary and in accordance with internal policies.
Data Subject Rights
Each individual has the right to access, rectify, erase, restrict processing, and to data portability, as well as the right to object to processing. They also have the right to withdraw their consent at any time without affecting the lawfulness of processing carried out prior to the withdrawal. The individual also has the right to lodge a complaint with the Personal Data Protection Commission.
Children’s Data
Where data related to children is processed through the website or events, this must be done with heightened care and, as a rule, through a parent/legal representative or another authorized adult. No more data about children should be collected than is necessary for the respective service or the organization of a specific event. When using photos, videos, or publications featuring children, separate explicit consent must be obtained where required.
Automated Decision-Making
As of the date of preparation of this document, no fully automated decision-making with legal or similarly significant effects on individuals is carried out. If profiling or personalized segmentation with such effects is introduced, these documents shall be updated accordingly.
