Privacy policy

Last updated: October 24, 2026

1. Controller and scope

This Privacy Policy explains how MEALUP OOD ("Mealup" Ltd.), UIC 208518242, with its registered office and management address at Tvarditsa village 8155, Burgas Municipality, Burgas Province, 10 Deseta St. ("MEALUP", "we"), as the controller of personal data, collects, uses, stores and protects your personal data when you visit or shop at mealup.eu.

Processing is carried out in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and the Personal Data Protection Act. Contact for all matters relating to personal data: info@mealup.eu.

2. Definitions

"Personal data" means any information relating to an identified or identifiable natural person. "Processing" means any operation performed on personal data (collection, storage, use, transfer, erasure, etc.). "Controller" means the person who determines the purposes and means of the processing, i.e. MEALUP.

3. What personal data we collect

  • Identification and contact data: first name, last name, email address, phone number.
  • Delivery and billing data: delivery address and billing address.
  • Order and transaction data: order history, products ordered, amounts, date, payment status.
  • Payment data: processed directly by our payment service providers; we do not store your full card number.
  • Technical and usage data: IP address, device and browser type, operating system, pages visited and actions on the site (collected through cookies, subject to the relevant consent).
  • Communication: the content of your correspondence with us (emails, messages, inquiries).
  • Marketing preferences: your consent to, or refusal of, receiving our newsletter and promotions.

We do not knowingly collect special categories of personal data (e.g. health data).

4. Purposes and legal bases for processing

Purpose of processing Legal basis (Art. 6 GDPR)
Processing and fulfilling orders, delivery, customer service and returns Performance of a contract
Issuing documents, accounting and tax reporting Legal obligation
Responding to inquiries and support Performance of a contract / legitimate interest
Fraud prevention and security protection Legitimate interest
Improving the site and analyzing traffic Consent (analytics cookies)
Sending the newsletter and marketing messages Consent
Advertising measurement (Meta, Google) Consent (advertising cookies)

Where the legal basis is consent, you can withdraw it at any time, without affecting the lawfulness of the processing carried out before the withdrawal.

5. Who we share data with (processors and recipients)

We share personal data only with trusted providers that are needed to run the store, and only to the extent necessary:

  • Shopify (e-commerce platform and store hosting);
  • Payment service provider (payment processing);
  • Courier companies (Econt, Speedy, BOX NOW and Pigeon Express) for delivering orders;
  • Meta Platforms (Facebook/Instagram Pixel and Conversions API) for advertising measurement, only if you have given consent;
  • Google (Google Analytics) for traffic statistics, only if you have given consent;
  • Email marketing platform for sending the newsletter, only to people who have subscribed;
  • Competent public authorities, where we are required to do so by law.

We do not sell your personal data to third parties.

6. International data transfers

Some of our providers (e.g. Shopify, Meta, Google) may process data outside the European Economic Area (EEA). In such cases, the transfer is protected by appropriate safeguards, namely standard contractual clauses approved by the European Commission or the EU-US Data Privacy Framework.

7. Retention period

We keep personal data only for as long as necessary for the purposes for which it was collected:

  • Order data, invoices and accounting documents: for the period required by accounting and tax legislation (as a rule, up to 10 years for accounting documents).
  • Account data: for as long as you keep an active account, plus a reasonable period afterwards.
  • Marketing data (newsletter): until you withdraw your consent.
  • Technical and analytics data: for the period stated in the Cookie Policy.
  • Correspondence: for a reasonable period, with a view to customer service and possible disputes.

8. Data security

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration or disclosure, including encryption of the connection (SSL/TLS), restricted access to data and working only with providers that offer sufficient security guarantees.

9. Your rights

Under the GDPR, you have the following rights: access to your data; rectification of inaccurate data; erasure ("right to be forgotten"); restriction of processing; portability of your data; objection to processing based on legitimate interest or for direct marketing; and the right to withdraw your consent at any time.

To exercise these rights, write to us at info@mealup.eu. We reply within one month. You have the right to lodge a complaint with the supervisory authority: the Commission for Personal Data Protection (CPDP), Sofia, 2 Prof. Tsvetan Lazarov Blvd., cpdp.bg.

10. Automated decision-making and profiling

We do not take decisions that produce legal effects for you based solely on automated processing. If you have consented to marketing, we may use basic order and behavior data to show you more relevant messages and ads; you can object to this at any time.

11. Children's data

Our site and products are not directed at persons under 18, and we do not knowingly collect data from children. If you believe that we have received a child's data without consent, contact us and we will delete it.

12. Cookies

We use cookies and similar technologies:

  • Necessary (technical) cookies for the basic functioning of the site and the cart. These do not require consent.
  • Analytics cookies (e.g. Google Analytics), to understand how the site is used.
  • Marketing/advertising cookies and pixels (e.g. Meta Pixel) to measure and personalize ads.

Analytics and marketing cookies and advertising pixels are loaded only after your explicit consent through the consent banner. You can change or withdraw your choice at any time via "Cookie settings" in the site footer or through your browser settings.

13. Changes to this policy

We may update this Policy from time to time. The current version, with the date of the last update, is always published on this page.

14. Contact

For any questions about your personal data and this Policy: MEALUP OOD, info@mealup.eu, tel. +359 887 690 629.