This Privacy Policy describes how stemandmesh (“we”, “us”, or “our”) collects, uses, stores, and discloses personal information when you visit or make a purchase from www.stemandmesh.com (the “Site”).

We operate in strict accordance with the European Union General Data Protection Regulation (GDPR) and applicable Bulgarian data protection legislation.

1. Data Controller

The legal entity responsible for the processing of your personal data (the Data Controller) is:

  • Company Name: VOE TRADE EOOD
  • Company Registration / VAT Identification Number: 205646984-BG205646984
  • Registered Address: 5 Knyaz Aleksandar Batenberg Str., Levski, 5900 Bulgaria
  • Official Website: www.stemandmesh.com
  • Data Protection Contact Email: internal@stemandmesh.com
  • Telephone: +359 884906995

2. Information We Collect

When you visit the Site or place an order for our plant care tools (including watering cans, fine mist sprayers, transplanting trowels, soil sieves, and plant support clips), we collect certain information necessary to process your transaction and fulfill our services:

  • Identity & Contact Data: Full name, billing address, shipping address, email address, and telephone number.
  • Order & Transaction Data: Details regarding the specific products purchased, order reference numbers, purchase dates, and monetary value of transactions.
  • Technical & Usage Data: IP address, browser type, device information, and standard web log details gathered during your site interaction.

3. Purpose & Legal Basis for Processing

We process your personal information based on the following legal grounds under GDPR Article 6:

  1. Performance of a Contract (Art. 6(1)(b)): To process transactions, fulfill orders, assemble packaging, manage dispatches, and provide customer support services.
  2. Legal Obligation (Art. 6(1)(c)): To comply with statutory accounting, tax, and reporting requirements under Bulgarian and EU commercial law.
  3. Legitimate Interests (Art. 6(1)(f)): To manage customer inquiries, protect against fraudulent activity, and maintain the operational security and functionality of our website.

4. Payment Processing via Stripe

We do not store or directly handle complete credit card, debit card, or full payment credentials on our servers.

All payment transactions placed through www.stemandmesh.com are processed directly and securely by our third-party payment processing provider, Stripe Payments Europe, Ltd. (“Stripe”).

When you complete a transaction:

  • Your payment details are transmitted directly to Stripe.
  • Stripe collects, processes, and stores financial information in accordance with their own Privacy Policy and strict PCI-DSS compliance standards.
  • We receive only transaction confirmations and payment references necessary to fulfill your order.

5. Data Retention Period

We retain personal data only for as long as required to fulfill the purposes for which it was collected, or as mandated by statutory retention requirements under applicable Bulgarian and European legislation:

  • Customer Account & Order Data: Retained for the duration of the order processing and active customer relationship, plus the standard legal period required under Bulgarian commercial law.
  • Tax & Accounting Records: Transaction data, invoices, and payment records are retained for up to 10 years to comply with mandatory tax laws and fiscal regulations in Bulgaria and the EU.
  • General Inquiries: Customer communication records via email or phone are retained for up to 2 years following resolution to handle any follow-up queries.

Upon the expiry of the applicable retention period, personal data is permanently deleted or securely anonymised.

6. Disclosure of Personal Information

We do not sell, rent, or trade your personal data. We disclose personal information strictly to external service partners who assist in our business operations:

  • Payment Processors: Stripe Payments Europe, Ltd., for processing customer payments securely.
  • Fulfillment & Logistics Partners: Logistics operators and postal services carrying out physical parcel delivery within Europe.
  • Regulatory Authorities: Government, tax, or legal bodies when required by compulsory legal obligations under Bulgarian or EU law.

7. Geographic Scope & International Transfers

Our products and services are offered exclusively to customers located within European countries. Your personal data is processed within the European Economic Area (EEA). If data is transferred outside the EEA by our technical service providers (such as Stripe), appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission, are implemented.

8. Your Data Protection Rights under GDPR

If you are a resident of the European Economic Area (EEA), you possess specific rights regarding your personal data:

  • Right of Access: The right to request copies of your personal data held by us.
  • Right to Rectification: The right to request correction of inaccurate or incomplete information.
  • Right to Erasure (“Right to be Forgotten”): The right to request deletion of your personal data under specific statutory conditions.
  • Right to Restrict Processing: The right to request limits on how we process your personal data.
  • Right to Data Portability: The right to receive your data in a structured, commonly used format.
  • Right to Object: The right to object to the processing of your data based on legitimate interests.

To exercise any of these rights, please submit a written request to internal@stemandmesh.com. We will respond to valid requests within one month as required under GDPR.