Privacy Policy

At ThePosterStars we take your privacy seriously. This policy explains what personal data we collect, why we collect it, and what rights you have. It applies to all visitors and customers of theposterstars.com.

1. Who we are

The data controller responsible for your personal data is:

If you have any questions about this policy or how we handle your data, please contact us at the email address above.

2. Data we collect

2.1 Data you provide to us

• Order information: name, delivery address, email address, phone number.
• Payment data: processed securely by our payment provider. We do not store card numbers.
• Communications: messages you send us via email or contact forms.
• Account data (if you create an account): email and password (stored as a hash).

2.2 Data collected automatically

• Usage data: pages visited, time on site, referring URL.
• Technical data: IP address, browser type and version, device type, operating system.
• Cookies and similar technologies — see Section 8.

3. How we use your data

Purpose	Data used
Processing and fulfilling your order	Name, address, email, phone, payment data
Sending order confirmations and shipping updates	Email, name
Responding to your enquiries	Email, name, message content
Preventing fraud and ensuring security	IP address, order data
Improving our website (analytics)	Usage data, cookies (with consent)
Marketing communications	Email (with consent or existing customer)
Legal and tax obligations	Order and payment records

4. Legal basis for processing

We process your personal data under the following legal bases (GDPR Article 6):

• Performance of a contract — to fulfil your order and provide related customer support.
• Legal obligation — to comply with accounting, tax, and consumer law requirements.
• Legitimate interests — to prevent fraud, maintain security, and improve our services, where these interests are not overridden by your rights.
• Consent — for analytics cookies and marketing emails. You may withdraw consent at any time.

5. Sharing your data

We do not sell your personal data. We share it only when necessary:

• Fulfilment partners: printing and shipping providers who need your delivery address.
• Payment processors: your payment data is handled directly by our payment provider (e.g. Stripe), which is PCI-DSS compliant.
• Analytics providers: e.g. Google Analytics — only if you have accepted analytics cookies. Data is anonymised.
• Legal authorities: if required by law or court order.

All third-party processors are bound by data processing agreements and are required to handle your data in accordance with GDPR.

6. How long we keep your data

Data type	Retention period
Order and transaction records	10 years (Bulgarian accounting law)
Customer account data	Until account deletion, then 2 years
Marketing email consent	Until you unsubscribe
Customer support correspondence	3 years
Analytics data	26 months (Google Analytics default)

7. Your rights

As a resident of the EU/EEA, you have the following rights under GDPR:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct inaccurate data.
• Right to erasure — ask us to delete your data ("right to be forgotten"), subject to legal retention obligations.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests or for direct marketing.
• Right to restrict processing — ask us to pause processing in certain circumstances.
• Right to withdraw consent — at any time, for any processing based on consent (e.g. cookies, marketing).

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP), the Bulgarian supervisory authority:

If you are based in another EU country, you may also contact your local data protection authority.

8. Cookies

We use cookies and similar tracking technologies. You can manage your preferences via our cookie banner or by clicking Cookie preferences.

Category	Purpose	Can be declined?
Strictly necessary	Shopping cart, checkout session, security (CSRF). Essential for the site to function.	No
Analytics	Google Analytics — measures traffic and user behaviour. IP addresses are anonymised. No cross-site tracking.	Yes
Marketing	Retargeting pixels and ad-performance measurement on platforms such as Meta and Google Ads.	Yes

Your consent is stored in a cookie for 365 days. You can withdraw or change it at any time.

9. International transfers

Some of our service providers (e.g. Google, Stripe) may process your data outside the European Economic Area. When they do, we ensure appropriate safeguards are in place — such as Standard Contractual Clauses approved by the European Commission — to protect your data.

10. Children's privacy

Our website is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently received data from a child, please contact us and we will delete it promptly.

11. Changes to this policy

We may update this policy from time to time. When we make significant changes, we will update the date at the top of this page. We encourage you to review this policy periodically.

12. Contact us

If you have any questions or concerns about this Privacy Policy or your personal data, please contact us:

Related policies: Terms of Service · Shipping Policy · Returns Policy