Privacy policy

PRIVACY POLICY

Last updated: September 29, 2026

This Privacy Policy explains how Hoskay collects, uses, stores and shares Personal Data when you visit or use the Hoskay website and marketplace, create an account, place or manage an Order, apply to become a Seller, submit verification information, contact Hoskay, or otherwise interact with the Platform.

The Platform is operated by:

Hendex Ltd.
Company registration number: 208780173
VAT number: BG208780173
Registered address: 6 Bratiya Street, Floor 3, 4002 Plovdiv, Bulgaria
Email: office@hoskay.com
Buyer support: support@hoskay.com
Telephone: +359 89 249 6435

For the purposes of applicable data protection law, Hendex Ltd. is the controller of the Personal Data described in this Privacy Policy, except where another party, such as an independent Seller, Shopify, a payment provider or another service provider, determines its own purposes and means of processing and acts as a separate controller.

Hoskay uses Shopify, Webkul and other service providers to operate parts of the Platform.

1. WHO THIS POLICY APPLIES TO

This Privacy Policy applies to:

  • visitors to the Hoskay website;
  • Buyers and registered users;
  • Seller Applicants;
  • approved Sellers;
  • persons acting on behalf of a Seller;
  • persons who contact Hoskay for support or other enquiries.

Where an independent Seller receives Buyer information for the purpose of fulfilling an Order, arranging delivery, issuing sales documents or handling a return, refund or complaint, that Seller may act as a separate data controller for its own processing activities.

2. PERSONAL DATA WE COLLECT

The information we collect depends on how you use the Platform.

2.1 Buyer and account information

We may collect:

  • full name;
  • email address;
  • telephone number;
  • billing address;
  • delivery address;
  • account and login information;
  • Order history;
  • Products viewed, saved, added to cart or purchased;
  • delivery preferences;
  • return, refund and complaint information;
  • communications with Hoskay or Sellers;
  • reviews, ratings, images or other content you submit;
  • marketing and cookie preferences.

2.2 Payment and transaction information

Payments may be processed by Shopify, an authorised payment provider or another payment service.

Hoskay generally does not receive or store complete payment card numbers, card security codes or full online banking credentials.

We may receive limited payment information such as:

  • transaction identifier;
  • payment status;
  • payment method type;
  • payment date and amount;
  • billing details;
  • limited card information made available by the payment provider;
  • information relating to refunds, reversals, chargebacks or disputed transactions.

Payment providers may collect additional information directly from you under their own privacy policies.

2.3 Seller Applicant and Seller information

When a person or business applies to sell through Hoskay, we may collect:

  • full name;
  • legal business name and trading name;
  • company or business registration number;
  • EIK/BULSTAT or equivalent;
  • VAT number, where applicable;
  • registered and business address;
  • email address and telephone number;
  • business activity;
  • information about Products intended to be sold;
  • name and role of the person registering the Seller Account;
  • information about directors, owners, representatives or authorised persons;
  • bank account and Payout information;
  • IBAN and account-holder details;
  • billing, accounting and tax information;
  • website or social media information;
  • licences, permits or professional registrations;
  • Product safety, compliance, authenticity or origin information;
  • correspondence relating to the Seller application or Seller Account;
  • information concerning complaints, restrictions, violations or suspended Products.

2.4 Seller verification documents

To verify identity, legal status, authority, eligibility, payment details or compliance, Hoskay may request documents such as:

  • company registration documents;
  • VAT registration documents;
  • proof of business address;
  • proof of bank account ownership or authorised use;
  • identity documents of a director, owner, sole trader, representative or authorised person;
  • documents proving authority to represent a business;
  • licences, permits, certificates or registrations;
  • Product safety or compliance documents;
  • invoices or supply-chain documentation;
  • documents relating to Product authenticity or origin;
  • other documents reasonably necessary for verification, fraud prevention or legal compliance.

We request only information reasonably necessary for the relevant purpose.

Where possible, Seller Applicants should conceal information that has not been requested and is not necessary for verification.

2.5 Information collected automatically

When you use the Platform, Hoskay and its service providers may automatically collect:

  • IP address;
  • browser type and version;
  • device type;
  • operating system;
  • language and regional settings;
  • device or browser identifiers;
  • referring website or source;
  • pages and Products viewed;
  • links and buttons selected;
  • date and time of access;
  • session information;
  • cart activity;
  • login activity;
  • error logs and diagnostic information;
  • approximate location derived from IP address;
  • cookie and consent preferences.

This information may be collected through cookies, pixels, log files and similar technologies.

2.6 Communications and support information

When you contact Hoskay, we may collect:

  • your contact details;
  • the content of your communication;
  • attachments or supporting documents;
  • information about an Order, Product or Seller;
  • return, refund, complaint or dispute details;
  • records of actions taken in response.

2.7 Information received from third parties

We may receive information from:

  • Shopify;
  • Webkul;
  • payment providers;
  • Sellers;
  • couriers and logistics providers;
  • analytics and security providers;
  • advertising and marketing platforms, where permitted;
  • business or identity verification providers;
  • public registers;
  • competent authorities;
  • persons reporting fraud, illegal Products or policy violations.

3. HOW WE USE PERSONAL DATA

We process Personal Data only where we have a valid legal basis under applicable law.

3.1 Providing and operating the Platform

We may use Personal Data to:

  • create and manage accounts;
  • provide Platform features;
  • display account and Order information;
  • process and route Orders;
  • facilitate payments;
  • connect Buyers with Sellers;
  • support returns, refunds and complaints;
  • provide customer support;
  • maintain Platform functionality.

The legal basis may include performance of a contract, taking steps at your request before entering into a contract and our legitimate interests in operating the Platform.

3.2 Orders and fulfilment

We may use and share Buyer information to:

  • send an Order to the relevant Seller;
  • process or confirm payment;
  • arrange or support delivery;
  • provide Order updates;
  • coordinate cancellation, return or refund requests;
  • investigate complaints or disputes.

Relevant Sellers process information necessary to fulfil their own Sales Contracts with Buyers.

3.3 Seller verification and administration

We may process Seller information and documents to:

  • verify identity and business registration;
  • confirm a person’s authority to act for a business;
  • assess Seller eligibility;
  • verify bank and Payout details;
  • prevent fraud and impersonation;
  • protect Buyers, Sellers and Hoskay;
  • manage Seller Accounts;
  • calculate Commission and Payouts;
  • investigate complaints and policy violations;
  • restrict Products or accounts where necessary;
  • meet legal, tax, Product safety and marketplace obligations.

The legal basis may include pre-contractual steps, performance of the Seller relationship, legal obligations and legitimate interests in maintaining a secure and trustworthy marketplace.

3.4 Accounting, tax and legal compliance

We may process Personal Data to:

  • issue and retain invoices and accounting records;
  • comply with tax and financial reporting obligations;
  • comply with Product safety and Consumer protection requirements;
  • respond to lawful requests from authorities;
  • maintain records required by law.

The legal basis is generally compliance with a legal obligation.

3.5 Security and fraud prevention

We may use Personal Data to:

  • authenticate users;
  • protect accounts;
  • detect suspicious activity;
  • prevent fraudulent Orders or payments;
  • prevent abuse, spam or malicious activity;
  • investigate security incidents;
  • enforce our Terms and policies;
  • establish, exercise or defend legal claims.

The legal basis may include our legitimate interests and legal obligations.

3.6 Customer support and communications

We may process Personal Data to:

  • respond to questions;
  • provide technical support;
  • communicate about Orders, accounts and Seller applications;
  • send important service or security notices;
  • coordinate returns, refunds and complaints.

3.7 Marketing

Where permitted by law, we may send promotional communications where:

  • you have provided consent; or
  • another lawful basis for direct marketing applies.

You can unsubscribe at any time using the unsubscribe option in a marketing message or by contacting us.

We may continue to send non-promotional communications relating to Orders, accounts, security, Seller applications or legal terms.

3.8 Analytics and advertising

Subject to applicable cookie and consent requirements, Hoskay and its partners may use analytics or advertising technologies to:

  • understand how users interact with the Platform;
  • measure performance;
  • identify errors;
  • improve navigation and functionality;
  • measure advertising effectiveness;
  • create advertising audiences;
  • display more relevant advertising.

Non-essential analytics and advertising technologies will be used only after consent where consent is required.

4. HOW WE SHARE PERSONAL DATA

We share Personal Data only where necessary and where a valid legal basis applies.

4.1 Independent Sellers

When a Buyer places an Order, Hoskay may share information necessary for the relevant Seller to fulfil the Order, including:

  • Buyer name;
  • contact details;
  • billing and delivery address;
  • Products ordered;
  • Order value and payment status;
  • delivery instructions;
  • return, refund or complaint information.

The Seller may act as a separate data controller and is responsible for using the information lawfully.

A Seller must not use Buyer information for unrelated marketing unless it has a separate lawful basis to do so.

4.2 Shopify

Shopify provides hosting, checkout, security and other technical services.

Depending on the processing activity, Shopify may act as a processor or as an independent controller.

Shopify may process information in accordance with its own privacy documentation.

4.3 Webkul and marketplace technology providers

Hoskay may share information with Webkul and other technology providers supporting:

  • Seller registration;
  • Seller dashboards;
  • Product Listings;
  • Order allocation;
  • Commission calculations;
  • Payout administration;
  • Seller communications;
  • marketplace administration.

4.4 Payment providers and banks

We may share information with payment processors, banks and financial service providers where necessary to:

  • process payments;
  • verify transactions;
  • issue refunds;
  • prevent fraud;
  • manage chargebacks and disputes;
  • comply with financial obligations.

Some payment providers act as independent controllers.

4.5 Couriers and logistics providers

Information may be shared with couriers and logistics providers where necessary to dispatch, transport, track and deliver an Order.

In many cases, the relevant Seller selects and communicates directly with the courier.

4.6 Professional and technical service providers

We may use service providers for:

  • hosting and infrastructure;
  • cloud storage;
  • email delivery;
  • customer support;
  • accounting;
  • legal services;
  • cybersecurity;
  • fraud prevention;
  • identity or business verification;
  • analytics;
  • cookie consent management;
  • marketing and advertising, where permitted.

4.7 Authorities and legal recipients

We may disclose information where necessary to:

  • comply with law;
  • respond to a court order or lawful authority request;
  • report suspected fraud or illegal activity;
  • comply with tax, Product safety or Consumer protection obligations;
  • protect users or third parties;
  • establish, exercise or defend legal claims.

4.8 Business transfers

If Hendex Ltd. or Hoskay is sold, reorganised, merged or transferred, Personal Data may be disclosed to advisers, prospective purchasers or successor entities subject to appropriate safeguards.

5. COOKIES AND SIMILAR TECHNOLOGIES

Hoskay uses cookies and similar technologies.

These may include:

Strictly necessary technologies

Used for:

  • shopping cart operation;
  • checkout;
  • account login;
  • security;
  • fraud prevention;
  • cookie preference storage.

Analytics technologies

Used to understand Platform usage and improve performance.

Functional technologies

Used to remember preferences and provide enhanced functionality.

Advertising technologies

Used to measure advertising or provide personalised advertising where permitted.

Where required by law, non-essential analytics and advertising technologies are activated only after consent.

You may accept, reject or change your choices through the cookie banner or cookie preference tool available on the Platform.

Further information is available in our Cookie Policy.

6. INTERNATIONAL DATA TRANSFERS

Hoskay is established in Bulgaria.

Some service providers, including Shopify and other technology providers, may process or store Personal Data outside Bulgaria or outside the European Economic Area (“EEA”).

Where Personal Data is transferred outside the EEA, Hoskay will rely on a lawful transfer mechanism where required, such as:

  • an adequacy decision;
  • Standard Contractual Clauses approved by the European Commission;
  • another lawful transfer mechanism.

Additional safeguards may be used where appropriate.

7. DATA RETENTION

We retain Personal Data only for as long as reasonably necessary for the purposes described in this Privacy Policy and to comply with legal, accounting, security and dispute-resolution obligations.

Retention periods depend on the type of information.

Buyer accounts

Account information may be retained while the account is active and for an appropriate period after closure.

Orders, payments and accounting records

Order, payment, invoice and accounting information is retained for the period required under applicable tax, accounting and commercial law.

Seller Accounts

Seller account, transaction and marketplace information may be retained during the Seller relationship and for an appropriate period afterwards.

Unsuccessful or withdrawn Seller applications

Unless longer retention is necessary for legal compliance, fraud prevention, an investigation or legal claims, information submitted as part of an unsuccessful or withdrawn Seller application will generally be deleted or anonymised within 6 months after the final decision or withdrawal.

Seller verification documents

Copies of identity, registration, bank-account, licence or other verification documents will generally be retained for the duration of the Seller relationship and for up to 6 months after termination, unless longer retention is required by law, an authority, fraud-prevention needs, an ongoing investigation or legal claims.

Where the full document is no longer required, Hoskay may retain a limited verification record.

Support communications

Support communications are retained for as long as necessary to resolve the matter and for a reasonable period afterwards.

Marketing information

Marketing preferences may be retained until you withdraw consent or object.

Limited suppression information may be retained after an unsubscribe request to prevent future marketing.

Security logs

Technical and security logs are retained for a limited period appropriate to security and fraud-prevention needs.

8. SECURITY

Hoskay uses reasonable technical and organisational measures designed to protect Personal Data against:

  • unauthorised access;
  • unlawful processing;
  • accidental loss;
  • destruction;
  • alteration;
  • unauthorised disclosure.

Measures may include:

  • access controls;
  • password protections;
  • encrypted connections;
  • restricted access to Seller verification documents;
  • service-provider security requirements;
  • account and activity monitoring;
  • internal procedures for security incidents.

No electronic system can be guaranteed to be completely secure.

Users are responsible for keeping their account credentials confidential.

9. AUTOMATED PROCESSING

Hoskay or its service providers may use automated tools to assist with:

  • fraud detection;
  • payment security;
  • account security;
  • suspicious activity identification;
  • analytics or advertising personalisation, where permitted.

These tools may flag a transaction or account for further review.

Unless Hoskay informs you otherwise, Hoskay does not make decisions based solely on automated processing that produce legal effects or similarly significant effects on you.

Payment providers, Shopify or other service providers may carry out their own automated assessments under their own privacy policies.

10. CHILDREN

The Platform is not intended to allow children who are not legally capable of entering into the relevant transaction to make purchases independently or register as Sellers.

Where Hoskay becomes aware that Personal Data has been collected from a child without an appropriate legal basis or required parental authorisation, reasonable steps will be taken to delete it.

11. YOUR DATA PROTECTION RIGHTS

Subject to applicable law, you may have the right to:

Access

Request confirmation that Hoskay processes your Personal Data and obtain access to it.

Correction

Request correction of inaccurate or incomplete Personal Data.

Erasure

Request deletion of Personal Data where there is no lawful reason to retain it.

Restriction

Request restriction of processing in certain circumstances.

Data portability

Receive Personal Data you provided in a structured, commonly used and machine-readable format where legally applicable.

Objection

Object to processing based on legitimate interests.

Direct marketing objection

Object to direct marketing at any time.

Withdrawal of consent

Withdraw consent at any time where processing is based on consent.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

To exercise your rights, contact:

office@hoskay.com

We may request reasonable evidence of identity before responding.

We will respond within the period required by applicable law.

12. COMPLAINTS

If you have a concern about how Hoskay handles Personal Data, you may contact:

Hendex Ltd.
Email: office@hoskay.com
Telephone: +359 89 249 6435
Address: 6 Bratiya Street, Floor 3, 4002 Plovdiv, Bulgaria

You also have the right to submit a complaint to the Bulgarian supervisory authority:

Commission for Personal Data Protection
2 Prof. Tsvetan Lazarov Blvd.
1592 Sofia
Bulgaria

You may also have the right to complain to the supervisory authority in another EEA country where you live, work or believe an infringement occurred.

13. THIRD-PARTY WEBSITES

The Platform may contain links to websites or services operated by Sellers or other third parties.

Hoskay does not control the privacy practices of independent third parties.

You should review the applicable privacy policy before providing Personal Data through a third-party service.

14. CHANGES TO THIS PRIVACY POLICY

Hoskay may update this Privacy Policy to reflect changes to:

  • the Platform;
  • service providers or technologies;
  • Seller verification processes;
  • legal or regulatory requirements;
  • data-processing practices.

The current version will be published with an updated revision date.

Where required by law, additional notice of material changes will be provided.

15. CONTACT

For privacy questions or requests, contact:

Hendex Ltd.
Trading name: Hoskay
Company registration number: 208780173
VAT number: BG208780173
Registered address: 6 Bratiya Street, Floor 3, 4002 Plovdiv, Bulgaria
Email: office@hoskay.com
Telephone: +359 89 249 6435

Hendex Ltd. is the controller for the processing activities described in this Privacy Policy except where another party, such as an independent Seller, Shopify or a payment provider, independently determines the purposes and means of processing.

In the event of any discrepancy between the Bulgarian and English versions of this Privacy Policy, the Bulgarian version shall prevail.