Privacy policy

Last updated: 16 October 2026.

1. Who we are

Tiagini is a trading name of Toptenads EOOD, a single-member limited liability company under Bulgarian law, 12 Sv. Kliment Ohridski Street, flat 10, 9000 Varna, Bulgaria, registered in the Bulgarian Commercial Register under UIC 203203253, VAT BG203203253. We are the controller of the personal data described in this policy. Email: contact@tiagini.com. Phone: +353 85 224 5652. We have not appointed a data protection officer because the law does not require one for a business of our size and activity.

2. What this policy covers

This policy explains what personal data we collect when you visit tiagini.com, create an account, place an order, buy or receive a gift card, sign up for emails or contact us; why we use it; who we share it with; how long we keep it; and your rights. It applies to visitors and customers in the European Union and anywhere else you use our site.

3. The data we collect

3.1 Data you give us

When you order: name, delivery and billing address, email address, phone number, the items you buy, and your payment details. Card details go directly to our payment provider; we never see or store full card numbers.

When you create an account: name, email address and your order history. If you sign in with Google or Shop, we receive your name and email address from that service.

When you buy a gift card: your details as above, and the recipient's name, email address and your message, if you add one.

When you sign up for emails: your email address, and your name if you give it.

When you contact us: your name, email address and what you write to us, including photos you send with a return or complaint.

3.2 Data we collect automatically

When you use the site: IP address, browser and device type, operating system, language, the pages you view, the products you look at and add to the cart, the site you came from, and the date and time. Some of this is collected with cookies and similar tools; see section 7.

3.3 Data from other sources

Our payment provider tells us whether a payment succeeded and gives us a fraud risk score. Couriers give us delivery status. Google and Meta give us aggregated statistics about our advertising; they do not give us your identity.

4. Why we use your data and on what legal basis

4.1 To process and deliver your order, handle payment, returns and refunds, and answer your questions about an order. Legal basis: performance of a contract with you (GDPR art 6(1)(b)).

4.2 To run your account and let you see your orders. Legal basis: performance of a contract.

4.3 To send you order confirmations, shipping updates and other messages about your order. Legal basis: performance of a contract.

4.4 To keep accounting and tax records and to meet other legal duties, such as consumer and product safety law. Legal basis: legal obligation (art 6(1)(c)).

4.5 To prevent fraud and keep the site secure. Legal basis: our legitimate interest in protecting our business and customers (art 6(1)(f)).

4.6 To send you marketing emails, including a welcome offer, if you have signed up. Legal basis: your consent (art 6(1)(a)). You can unsubscribe at any time with the link in every email.

4.7 To measure how the site is used and to improve it. Legal basis: your consent to analytics cookies (art 6(1)(a)), given through the cookie banner.

4.8 To show you advertising on Google, YouTube, Facebook and Instagram, including ads for products you looked at on our site, and to measure whether our ads lead to purchases. Legal basis: your consent to advertising cookies (art 6(1)(a)), given through the cookie banner. Without your consent we still receive counts of purchases without identifying you.

4.9 To respond to legal claims and to protect our rights. Legal basis: legitimate interest.

Where we rely on legitimate interest, you can object; see section 10.

5. Who we share your data with

We share data only with companies that help us run the store, and only what each one needs.

5.1 Shopify. Our store runs on Shopify, provided by Shopify International Limited, Dublin, Ireland, with group companies in Canada and the United States. Shopify hosts the site, stores order and account data, sends our order and marketing emails (Shopify Email) and provides the cookie banner, customer accounts and Shop sign-in. Shopify's own privacy policy is at shopify.com/legal/privacy.

5.2 Payment providers. Shopify Payments (a service of Shopify, with card processing by Stripe) and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg). They receive your name, address, email and payment details to take payment and check for fraud.

5.3 Couriers. The courier that delivers your parcel receives your name, delivery address, phone number and email address so they can deliver and send tracking updates.

5.4 Google. Google Ireland Limited, Dublin, Ireland. We use Google Workspace to run our email, Google sign-in for customer accounts, and Google's advertising and analytics tools described in section 7. For advertising and analytics, Google acts as an independent controller for the data it collects through its tools; Google's privacy policy is at policies.google.com/privacy.

5.5 Meta. Meta Platforms Ireland Limited, Dublin, Ireland, for advertising on Facebook and Instagram as described in section 7. Meta acts as a joint controller with us for the collection of event data through the Meta Pixel and as an independent controller for its later use; Meta's privacy policy is at facebook.com/privacy/policy.

5.6 Our accountant and advisers, where required by law or to defend a claim.

5.7 Authorities, where the law requires it.

5.8 Other service providers. Like most online stores, we use further specialist services to run and grow the business, and the set changes over time. They fall into these categories: tools that analyse how the site performs and how visitors use it; tools that help us research keywords, search results and the market; tools that help us create, test and measure advertising; tools that help us answer customer messages and collect product reviews; tools that help us detect fraud; and software we use internally to manage orders, stock, accounting and files. Most of these tools work with data about our site or our market and never see your personal data. Where a tool does process your personal data, it does so under a contract that limits it to our instructions, or, for advertising and analytics tools that set cookies, only after your consent through the cookie banner. We name any such tool in this policy or in the cookie banner when we add it.

We do not sell your personal data.

6. Transfers outside the European Union

Some of the companies above process data in the United States or other countries outside the EU. Where that happens, the transfer is protected by one of the safeguards in the GDPR: the EU-US Data Privacy Framework, for companies certified under it (this includes Google LLC, Meta Platforms, Inc. and Shopify Inc.), or the European Commission's standard contractual clauses. You can ask us for details of the safeguard used for a particular transfer.

7. Cookies, advertising and analytics

7.1 What cookies are and how you choose

Cookies are small files stored in your browser. Similar tools include pixels, tags and local storage. When you first visit tiagini.com from the EU, a banner lets you accept all cookies, decline the optional ones, or choose by category. You can change your choice at any time using the "Manage preferences" link in the banner or the cookie settings link in the footer. Declining does not stop you using the site or placing an order.

Essential cookies keep the site working: your cart, your login, the checkout, security and your cookie choice. They are set without consent because the site cannot work without them. Shopify lists them at shopify.com/legal/cookies.

Optional cookies are set only with your consent and fall into two groups: analytics (section 7.2) and advertising (sections 7.3 and 7.4).

7.2 Google Analytics

With your consent we use Google Analytics 4 to understand how visitors use the site: which pages are viewed, which products are looked at, how visitors arrive and whether they buy. Google Analytics uses cookies and collects your IP address (truncated), device and browser data, and a random user identifier. The data is processed by Google on our behalf. Reports we see are aggregated. Retention of user-level data in Google Analytics is set to 14 months.

7.3 Google Ads

We advertise on Google Search, Google Shopping and YouTube. With your consent, the Google tag on our site records events such as viewing a product, adding to cart and purchasing, together with a cookie identifier, and sends them to Google. Google uses this to measure whether our ads led to a sale (conversion tracking) and to show our ads to people who visited our site or looked at particular products (remarketing), on Google services and on partner sites. We also share product catalogue data with Google Merchant Center so Google can show our products in Shopping results; this contains no personal data.

We use Google Consent Mode. If you decline advertising cookies, the Google tag sends only cookieless signals that let Google estimate conversions in aggregate; no cookies are set and no identifier is stored.

You can control personalised advertising from Google at adssettings.google.com and opt out of Google Analytics with the browser add-on at tools.google.com/dlpage/gaoptout.

7.4 Meta (Facebook and Instagram)

We advertise on Facebook and Instagram. With your consent, the Meta Pixel on our site records events such as viewing a product, adding to cart and purchasing, together with a cookie identifier and, if you are logged in to Facebook or Instagram, Meta links them to your account. We may also send the same events from our server to Meta (the Conversions API), with your email address and phone number in hashed form, so that Meta can match purchases to the ads that were shown. Meta uses this to measure our ads, to show our ads to people who visited our site (custom audiences) and to find people with similar interests (lookalike audiences).

If you decline advertising cookies, the Meta Pixel is not loaded and no events are sent to Meta from your visit.

You can control the ads you see from Meta in your Facebook or Instagram settings under Ads preferences, and at facebook.com/ads/preferences.

7.5 Other tools

Shopify's own analytics record visits and sales so we can see how the store performs; this runs on Shopify's servers and is covered by Shopify's privacy policy. Shop Pay and Google sign-in set cookies only when you use them. We may add other analytics or advertising tools in future, for example to test page layouts or to measure ads on another platform. Any such tool that sets cookies or similar identifiers is loaded only with your consent and appears in the cookie banner under the analytics or advertising category; see also section 5.8.

8. Marketing emails

If you give us your email address for a welcome offer, newsletter or "tell me first" notice, we send you emails about our products, offers and news. We use Shopify Email to send them. Every email has an unsubscribe link; we act on it at once. We do not send marketing SMS. If you are a customer, we may also email you about products similar to those you bought, under the rule for existing customers in EU e-privacy law; you can opt out at any time in the same way.

9. How long we keep your data

Order, invoice and payment records: 10 years after the end of the year of the order, as required by Bulgarian accounting and tax law.

Account data: as long as your account exists. You can delete your account in your account settings or by writing to us; we then keep only the order records above.

Gift card data: until the card has expired and the accounting period above has ended.

Marketing email data: until you unsubscribe, then a record of your unsubscription so we do not email you again.

Messages to contact@tiagini.com: 3 years after the last message, longer if needed for a claim.

Analytics and advertising data in Google and Meta: as set in those tools (Google Analytics 14 months; Google Ads and Meta audience data up to 180 days, conversion data as those companies describe).

Server and security logs: up to 12 months.

10. Your rights

Under the GDPR you have the right to:

1. Access the personal data we hold about you and get a copy.
2. Correct data that is wrong or incomplete.
3. Have your data deleted, where we no longer need it or you withdraw consent.
4. Restrict how we use your data in certain cases.
5. Receive the data you gave us in a machine-readable format and have it sent to another provider.
6. Object to processing based on our legitimate interest, and to object at any time to direct marketing.
7. Withdraw consent at any time, with effect for the future, for example by unsubscribing from emails or changing your cookie choice.

To use these rights, write to contact@tiagini.com. We answer within one month. We may ask you to confirm your identity first.

You also have the right to complain to a supervisory authority. Our lead authority is the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, Bulgaria, cpdp.bg. You can also complain to the authority in the EU country where you live.

11. Children

Our site and products are for adults. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, write to us and we delete it.

12. Security

Data on tiagini.com is sent over an encrypted connection (TLS). Payment details are handled by our payment providers, who are certified under the PCI DSS standard. Access to customer data in our systems is limited to the two founders and protected by two-factor authentication.

13. Changes to this policy

We may update this policy when our tools or the law change. The date at the top shows the latest version. If a change affects how we use your data in a significant way, we tell you by email or with a notice on the site.