Legal Information
Returns & Refunds Policy
Your 14-day right to change your mind, and our commitment to your satisfaction
Read more
Privacy Policy
How we collect, use, and protect your personal data
11 min read
This Privacy Policy explains what personal data we collect when you visit elevenspectacles.com or buy from us, why we collect it, who we share it with, how long we keep it, and what rights you have under the EU General Data Protection Regulation (GDPR).
Who is responsible for your data
The controller of your personal data is:
Nikta 11 Ltd. (trading as Eleven Spectacles)
Petko Yu. Todorov Street 33, 9000 Varna, Bulgaria
UIC: 207628419 · VAT: BG207628419
Email: support@elevenspectacles.com
We have not appointed a Data Protection Officer, as the GDPR does not require one for our activities. For any privacy question, write to support@elevenspectacles.com with the subject "Data Protection Inquiry".
What we collect, why, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Processing and delivering your order | Name, email, phone number, shipping and billing address, order contents, payment status | Contract (Art. 6(1)(b)) |
| Payment and fraud prevention | Payment details (handled by Stripe), billing data, device and IP information used by Stripe for fraud checks | Contract (Art. 6(1)(b)) and legitimate interest in preventing fraud (6(1)(f)) |
| Order emails (confirmation, shipping, returns) | Name, email, order details | Contract (Art. 6(1)(b)) |
| Customer support and contact form | Name, email, your message, order number | Contract or steps before a contract (6(1)(b)); legitimate interest (6(1)(f)) |
| Returns, withdrawals and guarantee claims | Order data, your statement, photos you send | Contract (6(1)(b)) and legal obligation (6(1)(c)) |
| Newsletter | Email address, preferred language | Consent (Art. 6(1)(a)) |
| Partner portal (opticians and retail partners only) | Login details, partner account and order data | Contract (Art. 6(1)(b)) |
| Website security and operation | IP address, browser type, request logs, error reports | Legitimate interest in a secure, working website (6(1)(f)) |
| Cookieless visit statistics (PostHog) | Aggregated page views and interactions, counted without cookies | Legitimate interest in improving the website (6(1)(f)) |
| Detailed analytics (PostHog, Google Analytics) | Pseudonymous identifiers, IP address, pages viewed, clicks, device data, session recordings | Consent (Art. 6(1)(a)) – "Analytics" in the cookie banner |
| Advertising measurement (Google Ads, Meta, Pinterest) | Ad-click identifiers, conversion events, hashed contact details for purchases | Consent (Art. 6(1)(a)) – one switch per partner in the cookie banner |
| Accounting and tax records | Invoices, order and payment records | Legal obligation (Art. 6(1)(c)) |
| Legal claims | Data relevant to a dispute | Legitimate interest in establishing or defending claims (6(1)(f)) |
Do you have to give us your data? The data marked as needed at checkout is required to conclude and deliver your order; without it we cannot accept the order. Everything based on consent is optional, and refusing it has no effect on your ability to shop.
Automated decisions: we do not make decisions about you based solely on automated processing. Stripe screens payments automatically for fraud; if a payment is blocked, you can contact us and we will review it manually.
Analytics and advertising
Optional tracking is controlled in our Cookie Settings and is described in detail in our Cookie Policy. In short:
- Nothing optional runs before you choose. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a refusal of all optional categories until you choose otherwise.
- Analytics (PostHog and Google Analytics 4): with your consent, we use pseudonymous identifiers stored on your device to understand how the site is used. PostHog may also record a sample of sessions (mouse movements, clicks and page changes) so we can find usability problems; form inputs are masked. Without your consent, PostHog stores nothing on your device and only counts visits in aggregate using a hash that changes daily and cannot be linked across days.
- Google Ads, Meta and Pinterest are separate choices. With your consent, they measure whether our ads lead to visits and purchases and may use this to show you our ads on their platforms.
- Server-side purchase measurement: when you complete an order and have consented to Meta or Pinterest, we send that partner the order value, the products and a hashed (SHA-256) form of your email address, phone number, name, city, postcode and country, together with ad-click identifiers. Your cookie choice is recorded at checkout and applied to these server-side events. Without consent, nothing is sent.
- Order statistics: when an order is paid, we record the order value and products in PostHog so our sales figures are complete. If you consented to analytics, this is linked to your pseudonymous analytics profile; otherwise it is stored without one.
You can withdraw consent at any time in Cookie Settings. Withdrawal does not affect processing that took place before it.
Virtual try-on
The virtual try-on uses your camera only after you allow it in your browser. Face detection runs entirely on your device. No images, video or face measurements are sent to us or stored. To run the try-on, your browser downloads the face-detection software from jsDelivr and Google; as with any download, these providers receive your IP address.
Who we share your data with
We share personal data only where needed for the purposes above. Our service providers act as processors under a data processing agreement and may use your data only on our instructions.
| Recipient | What for | Location / transfer safeguard |
|---|---|---|
| Stripe (Stripe Payments Europe Ltd., Ireland) | Payment processing, fraud prevention | EU; transfers to the US under the EU-US Data Privacy Framework (DPF) and SCCs |
| Railway (Railway Corp.) | Hosting of our website and order database | Data stored in the EU (Netherlands); SCCs for access by the US provider |
| Cloudflare (Cloudflare, Inc.) | Content delivery, image storage, security and abuse protection | Global network; DPF and SCCs |
| Brevo (Sendinblue SAS, France) | Sending order emails and the newsletter | EU |
| PostHog (PostHog Inc., EU cloud) | Website analytics, session recordings, error tracking | Data stored in the EU; SCCs for support access from outside the EU |
| Sentry (Functional Software, Inc.) | Technical error monitoring (no names, cookies or form contents) | US; DPF and SCCs |
| Google (Google Ireland Ltd.) | Google Analytics, Google Ads – only with consent | Transfers to the US under the DPF and SCCs |
| Meta (Meta Platforms Ireland Ltd.) | Meta Pixel and Conversions API – only with consent | Transfers to the US under the DPF and SCCs |
| Pinterest (Pinterest Europe Ltd., Ireland) | Pinterest Tag and Conversions API – only with consent | Transfers to the US under the DPF and SCCs |
| Shipping carriers (e.g. DHL, DPD) | Delivering your order | Carrier's network; independent controllers for delivery |
| Accountants, lawyers, authorities | Bookkeeping, legal advice, legally required disclosures | Bulgaria / EU |
For advertising measurement, Google, Meta and Pinterest may also process data for their own purposes as independent or joint controllers; their privacy policies apply to that processing: Google, Meta, Pinterest. Where we are joint controllers with Meta for the Pixel, Meta is responsible for handling your rights requests for its part of the processing.
"SCCs" means the Standard Contractual Clauses adopted by the European Commission. You can ask us for a copy of the safeguards that apply to a transfer.
How long we keep your data
| Data | Retention |
|---|---|
| Order, invoice and payment records | 10 years from 1 January of the year after the order (Bulgarian Accountancy Act, Art. 12); invoices for tax purposes until 5 years after the tax limitation period ends |
| Customer support and contact messages | 2 years after the matter is closed |
| Return, withdrawal and guarantee records | Until the legal guarantee and limitation periods for the order have expired |
| Newsletter subscription | Until you unsubscribe; proof of consent for 3 years afterwards |
| Partner portal account | For the duration of the partnership, then deleted unless needed for legal records |
| Analytics data (with consent) | PostHog events up to 7 years (our provider's fixed retention period); session recordings 30 days; Google Analytics up to 14 months |
| Server and error logs | Up to 90 days |
| Card details | Never stored by us (held by Stripe under its own legal obligations) |
When a retention period ends, we delete or anonymise the data.
How we protect your data
- All traffic is encrypted with HTTPS/TLS, with HSTS enforced
- Payment data is handled by Stripe (PCI DSS Level 1); we never receive full card numbers
- Access to personal data is limited to the people who need it, with individual accounts
- Our providers are bound by data processing agreements and security obligations
- If a breach is likely to put your rights at risk, we notify the Bulgarian Commission for Personal Data Protection within 72 hours and inform you without undue delay where the risk is high
Your rights
Under the GDPR you have the right to:
- Access your personal data and receive a copy (Art. 15)
- Rectify inaccurate or incomplete data (Art. 16)
- Erase your data when there is no longer a reason to keep it (Art. 17)
- Restrict processing, for example while we check accuracy (Art. 18)
- Data portability – receive data you gave us in a machine-readable format (Art. 20)
- Object to processing based on legitimate interest (Art. 21). You can object to direct marketing at any time, without giving a reason
- Withdraw consent at any time – in Cookie Settings, via the unsubscribe link in any newsletter, or by email
- Lodge a complaint with a supervisory authority (see below)
How to exercise them: email support@elevenspectacles.com. We may ask you to confirm your identity, for example from the email address used for your order. We respond within one month; for complex requests we may extend this by up to two further months and will tell you why. Requests are free unless they are manifestly unfounded or excessive.
Some data must be kept despite an erasure request, for example invoices we are legally required to retain. In that case we restrict its use to that legal purpose and tell you.
Newsletter
You can subscribe to our newsletter on our website. We use your email address and language only to send it. Every newsletter contains an unsubscribe link; you can also unsubscribe by emailing us. Order-related emails (confirmations, shipping and return updates) are part of your purchase and are sent regardless of your newsletter choice.
Children
Our shop is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
Complaints
You can lodge a complaint with the data protection authority in your EU country of residence, place of work or where the alleged infringement took place. Our lead authority is:
Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
cpdp.bg
Other EU authorities: European Data Protection Board – Members. We would appreciate the chance to resolve your concern first at support@elevenspectacles.com.
Offline caching (progressive web app)
Our website uses a service worker to store static files, product images and pages you have visited on your device, so the site loads faster and works offline. This cache stays on your device, contains no personal details such as names, addresses or payment data, expires automatically and can be cleared in your browser settings.
Third-party links
Our website links to other websites and social networks. Their own privacy policies apply once you leave our site.
Changes to this policy
We update this policy when our services or the law change. The date at the bottom shows the latest version. If a change affects how we use data you have already given us, we will inform you in advance and, where required, ask for your consent again.
Effective date: October 5, 2026
Previous version: January 7, 2026