Privacy Policy

Last updated: 26.10.2026

I. Introduction

This Privacy Policy explains what personal data we collect when you use the online store basecamp-shop.com (the "Site"), shop from it or receive our messages, for what purposes we use them, with whom we share them, how long we keep them and what your rights are.

If you have any questions, contact us on +359 894 505 117 or at [email protected].

Controller of personal data

„ЕксКоСпортс България“ ООД (XCoSports Bulgaria OOD) (the "Controller", "we"), UIC (ЕИК) 201059861, with its seat and registered address at: 11 Orel Str., floor 3, Lozenets district, Sofia, Bulgaria; telephone: +359 894 505 117; e-mail: [email protected].

Supervisory authority

Commission for Personal Data Protection (КЗЛД), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, [email protected], www.cpdp.bg. The current contact telephone numbers of the Commission are published on its website.

II. Purposes and scope

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (the "Regulation", "GDPR") and the Personal Data Protection Act (Закон за защита на личните данни).
This Policy applies to the Site, to orders placed through it and to the commercial messages we send to the customers of Basecamp stores.
The use of cookies and similar technologies is described in detail in the separate Cookie Policy: https://basecamp-shop.com/en/page/cookies

III. Definitions

For the purposes of the Regulation and of this Policy:

Personal data means any information relating to a natural person who is identified or who can be identified, directly or indirectly, for example by a name, e-mail address, telephone number or an online identifier.
Processing is any operation performed on personal data – collection, recording, storage, use, transmission, erasure and others.
Controller is the person who determines the purposes and means of the processing.
Processor is a person who processes personal data on behalf of the controller.
Recipient is a person to whom personal data are disclosed.
Consent is a freely given, specific, informed and unambiguous indication of the person's wishes, given by a statement or by a clear affirmative action.
Profiling is automated processing of personal data to evaluate personal aspects, for example interests or purchasing behaviour.

IV. Principles

We process personal data lawfully, fairly and in a transparent manner; only for specified and legitimate purposes; to the minimum extent necessary; accurately and kept up to date; for no longer than necessary; and in a manner that ensures their security.

V. What data we process, for what purposes and on what legal basis

1. Visiting the Site

On every visit, our servers record technical data: IP address, type of browser and device, pages visited, date and time. We use them to make the Site work and to protect it from abuse and attacks. Legal basis: our legitimate interest in ensuring the operation and security of the Site (Article 6(1)(f) of the Regulation).

2. Customer account

When you create an account, we process your full name, e-mail address, password, delivery addresses, telephone number, company details for the invoice (if you enter them), order history and favourite products. The password is stored in a protected form. Legal basis: performance of a contract (Article 6(1)(b)). Registration is not obligatory – you can also order without an account.

3. Order

When you order, we process your full name, e-mail address, telephone number, delivery address or office, the goods ordered and the amounts, the selected payment and delivery method, the payment status and, for orders by a legal entity, the company details for the invoice. We do not receive or store your bank card details. Legal bases: performance of a contract (Article 6(1)(b)) and compliance with our legal obligations under accounting and tax legislation (Article 6(1)(c)).

4. Payment

When paying by card, through PayPal or in instalments, you are redirected to the page of the relevant payment service provider. It processes the payment data as an independent controller in accordance with its own privacy policy. We receive from it only the result of the payment, the amount and a transaction identifier. Legal basis: performance of a contract (Article 6(1)(b)).

5. Delivery

To deliver the order, we provide the courier with the full name, telephone number, delivery address or office and the parcel details. Legal basis: performance of a contract (Article 6(1)(b)).

6. Return of goods and withdrawal from the contract

When you submit a return request, we process the order number, the e-mail address, the telephone number, your message and the bank account (IBAN) and the name of its holder for the refund. Legal bases: compliance with our legal obligations under the Consumer Protection Act (Закон за защита на потребителите) (Article 6(1)(c)) and performance of a contract (Article 6(1)(b)).

7. Complaints and warranty service

For a complaint, we process the order details, the description of the problem and the photographs you send us, and, where necessary, we pass information about the problem to the manufacturer. Legal bases: compliance with a legal obligation (Article 6(1)(c)) and performance of a contract (Article 6(1)(b)).

8. Enquiries by telephone, by e-mail and on social networks

When you contact us, we process your name, contact details and the content of the message in order to reply to you and to keep a history of the communication. Legal bases: our legitimate interest in replying to enquiries (Article 6(1)(f)) and taking steps at your request prior to entering into a contract (Article 6(1)(b)). When you write to us on Facebook or Instagram, the relevant platform also processes the data as an independent controller.

9. Commercial messages to customers

When you create an account or place an order, we also use your e-mail address and telephone number for messages about our goods, promotions and campaigns. Legal basis: our legitimate interest in keeping in touch with our customers and offering our goods (Article 6(1)(f)). You can object at any time – through the unsubscribe link in every message or by writing to [email protected] – and we then stop sending you such messages.

10. Newsletter

You can subscribe to the newsletter through the form at the bottom of the Site, when ordering or when registering. For the newsletter, we process your e-mail address. The subscription is activated after you confirm it through the link in the e-mail you receive. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time through the unsubscribe link.

Newsletters are sent through the Mailchimp platform. In the Mailchimp list we keep the customers' e-mail addresses together with summary markers – whether the customer is from Bulgaria or from abroad and whether they have shopped more than once – in order to send relevant content.

11. Measuring visits and advertising

Only if you allow them in the cookie banner:

Measuring visits – Google Analytics shows us how the Site is used (pages visited, source of the visit, actions such as adding to the cart and purchase). Microsoft Clarity records how you move around the pages (clicks, scrolling, mouse movement) so that we can see where the Site is difficult to use.
Advertising – Meta Pixel, TikTok Pixel and OpenAI Pixel allow us to show relevant advertisements on Facebook, Instagram, TikTok and ChatGPT and to measure their results. The Mailchimp script displays newsletter subscription forms on the Site.

If you came to the Site from an advertisement, we record which campaign and advertisement you came from, in order to measure its results. This information is sent only after you have allowed the relevant category.

In addition to your browser, our server also sends information:

to Meta – about the pages and categories visited, the goods viewed, the cart, the orders started and placed, searches and registrations: goods, value, order number, identifiers from the cookies, the identifier of the click on an advertisement, IP address and technical data about the device. When you place an order and when you are logged in to your account, we also send your contact details (e-mail address, telephone number, full name, city, postcode and country), but only in hashed form (encoded so that they cannot be read in plain form). Only if you have allowed "Advertising".
to Google Analytics – about the orders placed: goods, value, order number and the identifiers from the Google Analytics cookies. Only if you have allowed "Measuring visits".

We report an order paid online only after the payment has been confirmed.

For the collection of data through Meta Pixel and their transmission to Meta, we and Meta Platforms Ireland Limited are joint controllers under Meta's joint controller agreement, the essence of which is available at https://www.facebook.com/legal/controller_addendum. For the subsequent processing, Meta is an independent controller.

OpenAI Pixel sends OpenAI Ireland Limited information about the goods viewed and added to the cart, the orders started and placed, and registrations (goods, value, order number), identifiers from the cookies and technical data about the device. If you enter contact details in a form on the Site (e-mail address, telephone number, full name, city, postcode and country), OpenAI Pixel sends them only in hashed form. OpenAI uses these data to measure the results of our advertisements in ChatGPT and is an independent controller of the data received.

TikTok Pixel sends TikTok Technology Limited information about the pages visited, the goods viewed and added to the cart, the orders started and placed, searches and registrations (goods, value, order number), identifiers from the cookies and technical data about the device. Microsoft Clarity sends Microsoft Ireland Operations Limited information about the way you use the pages, identifiers from the cookies and technical data about the device.

Legal basis: your consent (Article 6(1)(a)), which you can change or withdraw at any time through the cookie settings link at the bottom of the Site.

12. Advertising audiences

In order to show advertisements to our customers and to people with similar interests on Facebook and Instagram, we periodically pass to Meta a list with the contact details of the customers of Basecamp stores (e-mail address, telephone number, full name, city and country) in hashed form, together with the total value of each customer's purchases. Meta uses the hashed data only to find matching profiles and does not use them for other purposes. Legal basis: our legitimate interest in advertising our goods to our customers (Article 6(1)(f)). You can object at any time by writing to [email protected], and we will then not include your data in the list.

13. Record of your cookie choice

When you respond to the banner, we record your choice, the date and time of the response and technical data about the device needed to prove the choice. We do not record a name or e-mail address. Legal basis: our legal obligation to be able to demonstrate the consent given (Article 7(1) and Article 6(1)(c) of the Regulation).

14. Internal reports

We use the order and sales data to prepare internal reports on sales, stock and the operation of the store. Legal basis: our legitimate interest in managing our business (Article 6(1)(f)).

15. Prize draws

When you take part in a prize draw organised by us, we process the data you provide when registering to take part – full name, e-mail address, telephone number and purchase details (the number of the till receipt or of the online order) – in order to administer participation, check the conditions, draw and notify the winners and hand over the prizes. From the winners we also ask for an address to which we send the prize by courier. Legal basis: performance of the rules of the prize draw, which you accept by registering (Article 6(1)(b)). We announce the winners by first name and the first letter of the surname, on the basis of our legitimate interest in conducting the prize draw transparently (Article 6(1)(f)).

In order to withhold and declare the tax due on the prizes, we ask for the Unified Civil Number (ЕГН) only from the winners – upon receipt of the prize – and use it only for this purpose. Legal basis: legal obligation (Article 6(1)(c)).

We keep the participants' data for up to 60 days after the prizes are handed over, and the documents relating to the tax on the prizes for the periods laid down in accounting and tax legislation. When registration to take part is through Google Forms, the data from the form are stored in Google's service. The rules of each prize draw may contain additional information. We use the data from the registration for a prize draw for marketing only if you have given separate consent for this.

16. Purchases in a store

When you provide us with your full name, telephone number or e-mail address during a purchase in one of our stores, we process them to complete the purchase (Article 6(1)(b)) and for the purposes under items V.9 and V.12.

VI. Special categories of data

We do not collect data concerning health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic and biometric data or data concerning sex life. Please do not send them to us. If we receive them without necessity, we will erase them.

VII. Data obtained from third parties

As a rule, we do not obtain personal data from third parties. When we have a reasonable suspicion of an infringement of our rights, for example of trade mark rights, we may use data from public registers, such as the Commercial Register, to protect our rights. Legal basis: our legitimate interest in protecting our rights.

VIII. Retention periods

Data	Period
Customer account	until the account is deleted at your request
Orders, invoices and accounting documents	10 years, in accordance with the Accountancy Act (Закон за счетоводството) and tax legislation
Return requests and complaints	for the period of the legal guarantee and, when they contain accounting data, 10 years
Enquiries from persons who have not become customers	3 months after the last communication
Commercial messages and advertising audiences	until your objection or until your data are erased
Newsletter subscription	until consent is withdrawn
Participation in prize draws	60 days after the prizes are handed over; tax documents – 10 years
Record of your cookie choice	5 years from the date of the response
Data needed to report an order to Meta and Google Analytics (your cookie choice, identifiers from the cookies, IP address and browser data)	30 days from the order
Technical server records	for the period necessary for the security of the Site
Cookies	for the periods stated in the Cookie Policy

When the data are necessary for defence in a legal dispute, we may keep them until the dispute is finally concluded.

IX. Obligatory and voluntary nature of the data

The provision of data is voluntary. Without the data needed for the order (full name, telephone number, e-mail address and delivery address), we cannot accept and fulfil the order. Without contact details, we cannot reply to your enquiry.

X. Recipients of the data

We provide data only to the extent necessary and only to:

Recipient	For what
Speedy AD, DPD and other couriers with whom we send parcels abroad (for example euShipments and DHL Express)	delivery and return of parcels
Revolut Bank UAB, Paysera LT UAB, PayPal (Europe) S.à r.l. et Cie, S.C.A., UniCredit Consumer Financing EAD	payments and payment in instalments (independent controllers)
providers of hosting and cloud services	servers on which the Site runs, and delivery of its content
The Rocket Science Group LLC (Mailchimp)	sending newsletters and commercial messages; subscription forms on the Site – only with your consent
Google Ireland Limited	Google Analytics – only with your consent; Google Forms – forms for taking part in prize draws
Microsoft Ireland Operations Limited	Microsoft Clarity – only with your consent
Meta Platforms Ireland Limited	advertising, Meta Pixel and advertising audiences
OpenAI Ireland Limited	advertising in ChatGPT, OpenAI Pixel – only with your consent
TikTok Technology Limited	advertising on TikTok, TikTok Pixel – only with your consent
e-mail service provider and customer service system provider	sending and receiving e-mails and replying to enquiries
the company's accountant, established in Bulgaria	accounting services
public authorities (National Revenue Agency (НАП), courts and others)	when required by law

We have contracts with the processors acting on our behalf which oblige them to protect the data and to use them only on our instructions. We do not sell personal data.

XI. Transfer of data outside the European Economic Area

Some of the providers listed (for example Google, Meta, Microsoft, OpenAI, TikTok and Mailchimp) are part of groups established in the United States of America and may transfer data there. In these cases, the transfer is based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, in which these providers participate, or on standard contractual clauses approved by the European Commission.

XII. Profiling

We do not take decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you.

The segmentation of customers in the newsletter list (item V.10) and the advertising audiences (item V.12) constitutes limited profiling for the purposes of direct marketing. You can object to it at any time (section XVI).

XIII. Protection of personal data

We apply appropriate technical and organisational measures against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, the data. Only employees who need access to the data for their work have it.

XIV. Your rights

Right of access – to obtain confirmation as to whether we process your data and a copy of them.
Right to rectification – to request the correction of inaccurate data and the completion of incomplete data.
Right to erasure ("right to be forgotten") – under the conditions of Article 17 of the Regulation. We may refuse to erase data that the law obliges us to keep, for example accounting documents.
Right to restriction of processing – under the conditions of Article 18 of the Regulation.
Right to data portability – to receive the data you have provided to us in a structured and machine-readable format, when the processing is based on consent or on a contract and is carried out by automated means.
Right to object – described separately in section XVI.
Right to withdraw consent – at any time, without affecting the lawfulness of processing before the withdrawal. Consent to cookies is changed through the cookie settings link at the bottom of the Site, and the newsletter subscription through the unsubscribe link.
Rights related to automated decision-making – not to be subject to a decision based solely on automated processing which significantly affects you.
Right to lodge a complaint with the Commission for Personal Data Protection (КЗЛД) or with the supervisory authority in the country where you live or work.
Right to an effective judicial remedy and right to compensation for damage suffered as a result of an infringement of the Regulation.

XV. How to exercise your rights

Send a request to [email protected] or a letter to the Controller's address. State your full name, the details by which we can find you (for example the e-mail address you shop with) and what you are requesting.
We reply within one month. For complex or numerous requests, the period may be extended by a further two months, and we inform you of this within the first month.
To protect your data, we may request additional information to confirm your identity. We do not require a copy of an identity document unless we cannot identify you in another way.
Exercising your rights is free of charge. We notify the recipients to whom we have provided the data of any rectification, erasure or restriction, unless this proves impossible or involves disproportionate effort.

XVI. Right to object

You can at any time, on grounds relating to your particular situation, object to processing that we carry out on the basis of legitimate interest. We then stop the processing, unless we demonstrate compelling legitimate grounds which override your interests, or the data are necessary for defence in a legal dispute.
You can at any time and without giving a reason object to the processing of your data for direct marketing, including profiling for that purpose – the commercial messages (item V.9) and the advertising audiences (item V.12). You can end the newsletter subscription (item V.10) at any time. Use the unsubscribe link in the messages or write to [email protected]. After the objection, we stop using your data for these purposes.

XVII. Links to other sites

The Site contains links to our pages on Facebook, Instagram, YouTube and X (Twitter) and to partners' sites. These sites have their own privacy policies and we are not responsible for them. We recommend that you read their policies.

XVIII. Children

The Site is not intended for children. We do not knowingly collect personal data of persons under 14 years of age.

XIX. Changes to the Privacy Policy

We may update this Policy. The current version is published on this page with the new date of last update. In the event of significant changes, we will notify you in an appropriate manner.

XX. Contact

For questions about this Policy and the processing of your personal data, contact us on +359 894 505 117 or at [email protected].