Privacy Policy — Vexlumo Fashion Studio

Vexlumo Studio OOD ("Vexlumo", "we", "us", "our"), registered in Bulgaria with UIC 207541830, with registered address at ул. Свети Наум 14, вх. Б, Лозенец, 1407 Sofia, Bulgaria, is the data controller responsible for your personal data.

We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or engage with our services, in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and the Bulgarian Personal Data Protection Act.

If you have questions or concerns about this policy or our data practices, please contact us at privacy@vexlumo.com.

1. Information We Collect

1.1 Information You Provide Directly

We collect personal information that you voluntarily provide when you:

Fill in the contact or booking form on our website (name, email address, phone number, company name, project brief)
Send us an email or call us directly
Enter into a service agreement or contract with us
Subscribe to our newsletter or marketing communications
Participate in surveys, competitions, or promotional activities

1.2 Information Collected Automatically

When you visit our website, we may automatically collect certain technical data including:

IP address and approximate geographic location (country/city level)
Browser type, version, and operating system
Pages visited, time spent, and navigation paths
Referring URLs and exit pages
Device identifiers and screen resolution

This data is collected via cookies and similar tracking technologies. Please see Section 8 for details on our cookie use.

1.3 Images and Creative Assets

In the course of providing our services, we may create, store, and process photographic and video content featuring individuals (models, clients, brand representatives). Specific consent for the use of such imagery is governed by separate model release agreements and production contracts.

2. How We Use Your Information

We use the information we collect for the following purposes, each supported by a lawful basis under Article 6 GDPR:

To respond to enquiries and provide services — processing necessary for the performance of a contract or to take steps prior to entering a contract (Art. 6(1)(b))
To send booking confirmations and project communications — necessary for contract performance (Art. 6(1)(b))
To send marketing newsletters — based on your consent (Art. 6(1)(a)); you may withdraw consent at any time
To improve our website and services — legitimate interests (Art. 6(1)(f))
To comply with legal obligations — including tax, accounting, and invoicing requirements under Bulgarian and EU law (Art. 6(1)(c))
To protect our rights and prevent fraud — legitimate interests (Art. 6(1)(f))

3. How We Share Your Information

We do not sell, trade, or rent your personal information to third parties. We may share data with:

Service providers — such as email platforms, website hosting providers, payment processors, and accounting software — who process data on our behalf under data processing agreements
Professional advisors — lawyers, accountants, and insurers, where necessary and subject to confidentiality obligations
Competent authorities — where required by law, court order, or regulatory requirement
Business successors — in the event of a merger, acquisition, or sale of assets, subject to the same privacy protections

4. International Data Transfers

Your data is primarily stored and processed within the European Economic Area (EEA). Where we use service providers based outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or transfers to countries with an adequacy decision.

5. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this policy:

Enquiry and contact form data: 3 years from last contact
Client contract data: 10 years (Bulgarian accounting law requirement)
Marketing consent records: until consent is withdrawn, plus 2 years
Website analytics data: 26 months (rolling)
CCTV footage from studio premises: 30 days, then deleted

6. Your Rights Under GDPR

You have the following rights regarding your personal data. To exercise any of these rights, contact us at privacy@vexlumo.com. We will respond within 30 days.

Right of access — obtain a copy of the personal data we hold about you
Right to rectification — request correction of inaccurate or incomplete data
Right to erasure — request deletion of your data in certain circumstances
Right to restriction of processing — request that we limit how we use your data
Right to data portability — receive your data in a structured, machine-readable format
Right to object — object to processing based on legitimate interests or for direct marketing
Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing
Right to lodge a complaint — with the Commission for Personal Data Protection (CPDP) of Bulgaria, at www.cpdp.bg, or with the supervisory authority in your EU member state

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include TLS/HTTPS encryption for all web communications, access controls, regular security assessments, and staff training.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

8. Cookies

Our website uses cookies — small text files stored on your device — to ensure functionality and improve your experience. We use:

Essential cookies — required for the website to function (no consent required)
Analytics cookies — help us understand how visitors use the site (consent required)
Marketing cookies — used to serve relevant advertising (consent required)

You can manage cookie preferences through your browser settings or via our cookie consent banner. Withdrawing analytics or marketing consent will not affect site functionality.

9. Children's Privacy

Our website and services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it promptly.

10. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies. This policy applies solely to information collected by Vexlumo.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our business practices. We will post the updated policy on this page with a revised "Last updated" date. For material changes, we will notify you by email where we hold your contact details.

12. Contact Us

For any questions, requests, or complaints relating to this Privacy Policy or our data practices, please contact our Data Protection contact:

Email: privacy@vexlumo.com
Post: Vexlumo Studio OOD, ул. Свети Наум 14, вх. Б, Лозенец, 1407 Sofia, Bulgaria
Phone: +359 2 491 7730

You also have the right to make a complaint at any time to the Commission for Personal Data Protection (CPDP), the Bulgarian supervisory authority for data protection issues, at www.cpdp.bg.