Privacy policy

Last updated: November 2026

CozyNuva is a webshop operated by Plan B Marketing EOOD (“we”, “us”, “CozyNuva”), located at ul. Dr. Lyuben Popov 70, floor -1, apartment 1, 9000 Varna, Bulgaria. We process personal data in accordance with the General Data Protection Regulation (GDPR). This policy explains what data we collect, why, how long we keep it, and what your rights are.

1. Data controller

Plan B Marketing EOOD
ul. Dr. Lyuben Popov 70, floor -1, apartment 1
9000 Varna, Bulgaria
Email: [email protected]

2. Data we process

  • Order data: name, billing and shipping address, email address, phone number, ordered products, order history.
  • Account data: login credentials, saved addresses and wishlist, when you create an account.
  • Payment data: payment method and payment status. Card and bank details are processed exclusively by our payment processor Stripe; we never store card numbers.
  • Communication: messages sent via the contact form, email and customer service.
  • Newsletter: email address and preferences, only with your consent.
  • Technical data: IP address, browser data, cookie identifiers and site usage data.

3. Purposes and legal bases

  • Performance of a contract: processing and delivering orders, payment, returns and customer service.
  • Legal obligation: fiscal and accounting retention requirements.
  • Legitimate interest: improving the webshop, fraud prevention and security.
  • Consent: newsletter and non-essential cookies. You may withdraw consent at any time.

4. Who we share data with

We only share data with parties required for our services:

  • Stripe — payment processing and fraud prevention.
  • Supplier/carrier within the EU — storage and shipping of your order.
  • Hosting and email providers — technical infrastructure.
  • Public authorities — only when legally required.

We conclude data processing agreements with our processors. We never sell your data to third parties.

5. Transfers outside the EEA

Where a service provider is located outside the European Economic Area (for example Stripe Inc.), transfers take place on the basis of EU adequacy decisions or Standard Contractual Clauses.

6. Retention periods

  • Order and invoice data: up to 10 years (fiscal retention obligation).
  • Account data: as long as your account is active; deleted on request.
  • Correspondence: up to 2 years after last contact.
  • Newsletter: until you unsubscribe.

7. Security

We take appropriate technical and organisational measures: encrypted connections (TLS), restricted access, and no storage of payment card data on our servers.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and the right to object. You may withdraw newsletter consent at any time via the unsubscribe link or your account.

Send requests to [email protected]. We respond within 30 days. You also have the right to lodge a complaint with the supervisory authority in your country (for example the Autoriteit Persoonsgegevens in the Netherlands) or with the Bulgarian Commission for Personal Data Protection (CPDP).

9. Cookies

Read how we use cookies in our cookie policy.

10. Changes

We may update this policy; the most recent version is always on this page.