PRIVACY POLICY

Last updated: July 16, 2026

1. ABOUT THIS PRIVACY POLICY

This Privacy Policy explains how Hoskay collects, uses, stores and shares personal information when you:

• visit or use the Hoskay website and online marketplace;

• create a Buyer or Seller account;

• place, receive or manage an Order;

• apply to become a Seller;

• submit documents for Seller verification;

• communicate with Hoskay or another user through the Platform;

• subscribe to marketing communications;

• otherwise interact with our services.

The Hoskay online marketplace, website, accounts, features, tools and related services are collectively referred to in this Privacy Policy as the “Platform”.

For the purposes of applicable data protection law, the operator of the Platform and the data controller is:

Hendex LTD
Company registration number: 208780173
Registered address: 6 Bratiya Street, Plovdiv, Bulgaria
Email: office@hoskay.com
Telephone: +359 89 249 6435

In this Privacy Policy, “Hoskay”, “we”, “us” and “our” refer to Hendex LTD.

The Platform is hosted and technically supported by Shopify. We also use Webkul and may use payment providers, delivery providers and other service providers to operate the Platform.

This Privacy Policy applies to Buyers, visitors, registered users, prospective Sellers, approved Sellers and persons acting on behalf of business Sellers.

Where an independent Seller receives personal information for the purpose of fulfilling an Order, arranging delivery, issuing an invoice or handling a return or complaint, that Seller may act as a separate data controller for its own processing activities.

2. DEFINITIONS

For the purposes of this Privacy Policy:

“Buyer” means a person who browses the Platform or purchases a Product through it.

“Seller” means an independent person or business that applies to offer or offers Products through the Platform.

“Seller Applicant” means a person or business that has applied to become a Seller but has not yet been approved.

“Product” means any item offered for sale by a Seller through the Platform.

“Order” means an order placed through the Platform.

“Personal Information” or “Personal Data” means information relating to an identified or identifiable individual.

3. PERSONAL INFORMATION WE COLLECT

The information we collect depends on how you interact with the Platform.

3.1 Information provided by Buyers

We may collect:

• full name;

• email address;

• telephone number;

• billing address;

• delivery address;

• account username and encrypted password information;

• Products viewed, saved, added to a cart or purchased;

• Order history;

• delivery preferences;

• return, refund and complaint information;

• communications with Hoskay or a Seller;

• reviews, ratings, images or other content submitted through the Platform;

• marketing preferences;

• information necessary to prevent fraud or verify a transaction.

3.2 Payment and transaction information

Payments may be processed by Shopify or an authorised payment service provider.

Hoskay generally does not receive or store complete payment card numbers, card security codes or full online banking credentials.

We may receive limited information relating to a payment, including:

• payment status;

• transaction identifier;

• payment method type;

• payment date and amount;

• billing details;

• limited card information, such as the last digits of the card, where provided by the payment processor;

• information relating to refunds, reversals, chargebacks or disputed transactions.

The payment provider may collect additional information directly from you in accordance with its own privacy policy.

3.3 Information provided by Seller Applicants and Sellers

When a person or business applies to become a Seller, we may collect:

• full name;

• business name and trading name;

• company registration number;

• VAT registration number, where applicable;

• registered office and business address;

• email address and telephone number;

• details of directors, owners, representatives or authorised contact persons;

• bank account and payout information;

• billing, accounting and tax information;

• Seller profile information;

• information about Products and business activities;

• information about licences, registrations, permits or professional qualifications;

• correspondence relating to the application or Seller account;

• information concerning complaints, violations, suspended Products or account restrictions.

3.4 Seller verification documents

To verify the identity, legal status, authority, reliability or eligibility of a Seller Applicant or Seller, we may request documents such as:

• company registration documents;

• documents showing the company’s current legal status;

• VAT registration documents;

• proof of business address;

• proof of bank account ownership;

• identity documents of a sole trader, company representative, director, owner or authorised person;

• documents proving a person’s authority to represent a business;

• licences, permits, certificates or registrations required for particular Products or activities;

• documents relating to product authenticity, origin, safety or regulatory compliance;

• other documents reasonably necessary to comply with legal obligations, prevent fraud, protect users or verify the information submitted in a Seller application.

We will only request documents that we reasonably consider necessary for the relevant verification purpose.

Where possible, Seller Applicants should conceal information that has not been requested and is not necessary for the verification process.

Identity and verification documents may contain sensitive identifiers. Access to such documents is restricted to authorised persons and service providers who require access for verification, compliance, fraud prevention or legal purposes.

Submission of the requested information may be necessary to enter into or maintain a Seller relationship with Hoskay. If a Seller Applicant does not provide the required information, we may be unable to assess or approve the application.

3.5 Information collected automatically

When you visit or use the Platform, we and our service providers may automatically collect:

• IP address;

• browser type and version;

• device type;

• operating system;

• language and regional settings;

• device or browser identifiers;

• referring website or source;

• pages and Products viewed;

• links and buttons selected;

• date and time of access;

• session information;

• shopping cart activity;

• account login activity;

• error logs and diagnostic information;

• approximate location derived from an IP address;

• cookie and consent preferences.

We collect this information through cookies, pixels, log files, software development kits and similar technologies.

More information is available in our Cookie Policy and through the cookie preference tool displayed on the Platform.

3.6 Communications and support information

When you contact us, we may collect:

• your contact details;

• the content of your communication;

• attachments or supporting documents;

• information about an Order, Seller or Product;

• complaint and dispute details;

• records of the actions taken in response.

Messages sent through the Platform may be processed by Hoskay to deliver the message, provide support, prevent abuse, resolve disputes and enforce our Terms.

3.7 Information received from third parties

We may receive information from:

• Shopify;

• Webkul;

• payment service providers;

• delivery and logistics providers;

• Sellers;

• identity or business verification providers;

• analytics and security providers;

• marketing platforms, where permitted;

• public registers and competent authorities;

• persons reporting fraud, illegal Products or violations of our policies.

We use information received from third parties only where we have a valid legal basis to do so.

4. HOW WE USE PERSONAL INFORMATION AND OUR LEGAL BASES

We process Personal Information only where we have a valid legal basis.

4.1 Providing and operating the Platform

We use Personal Information to:

• create and manage accounts;

• provide access to Platform features;

• display account and Order information;

• process and route Orders;

• facilitate payments;

• connect Buyers with Sellers;

• support returns, refunds and complaints;

• provide customer support;

• maintain Platform functionality.

The principal legal basis is the performance of a contract or taking steps at your request before entering into a contract.

We may also rely on our legitimate interests in operating and improving the Platform.

4.2 Processing and fulfilling Orders

We use and disclose Buyer information to:

• send the Order to the relevant Seller;

• process or confirm payment;

• arrange or support delivery;

• provide Order updates;

• facilitate cancellation, return or refund requests;

• respond to complaints or disputes.

The principal legal basis is the performance of the contract relating to the Platform and taking steps necessary to facilitate the sales contract between the Buyer and the Seller.

Relevant Sellers process the information necessary to fulfil their own sales contracts with Buyers.

4.3 Assessing and verifying Seller applications

We process information and documents submitted by Seller Applicants to:

• confirm identity;

• verify business registration and legal status;

• verify that a representative is authorised to act for a business;

• assess the eligibility and suitability of an applicant;

• verify payout and bank account information;

• prevent fraud and impersonation;

• protect Buyers and other Sellers;

• comply with legal, tax, product safety and marketplace obligations;

• maintain records of approval, refusal or restriction decisions.

Depending on the circumstances, the legal basis is:

• taking steps at the applicant’s request before entering into a contract;

• performance of the Seller agreement;

• compliance with a legal obligation;

• our legitimate interests in maintaining a trustworthy and secure marketplace and preventing fraud.

Where a particular document is required by law, we will process it on the basis of the relevant legal obligation.

4.4 Seller account and marketplace administration

We process Seller information to:

• operate and manage Seller accounts;

• publish Seller identification information where legally required;

• calculate commissions and payouts;

• process payments and refunds;

• provide Seller support;

• manage Product listings;

• investigate complaints and policy violations;

• suspend or restrict Products or accounts;

• manage termination of the Seller relationship.

The legal basis is performance of the Seller agreement, compliance with legal obligations and our legitimate interests in managing the Platform.

4.5 Accounting, tax and regulatory compliance

We process information to:

• issue or retain invoices and accounting records;

• comply with tax and financial reporting obligations;

• respond to lawful requests from authorities;

• maintain records required by applicable law;

• comply with product safety, consumer protection and marketplace obligations.

The legal basis is compliance with a legal obligation.

4.6 Security and fraud prevention

We process information to:

• authenticate users;

• protect accounts;

• detect suspicious activity;

• prevent fraudulent Orders and payments;

• prevent abuse, spam and malicious activity;

• investigate security incidents;

• enforce our Terms and policies;

• protect the rights, property and safety of Hoskay, Buyers, Sellers and others.

The legal basis is our legitimate interest in protecting the Platform, our business and our users.

In some circumstances, the processing may also be necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.

4.7 Communications and customer support

We process information to:

• respond to questions;

• provide technical support;

• communicate about accounts, applications and Orders;

• provide important service and security notices;

• assist with disputes between Buyers and Sellers.

The legal basis may be performance of a contract, compliance with a legal obligation or our legitimate interest in providing support and resolving problems.

4.8 Marketing communications

We may send newsletters, offers and promotional communications where:

• you have provided consent; or

• another lawful basis for direct marketing applies.

You may withdraw your consent or unsubscribe at any time by using the unsubscribe link in an email or contacting us.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

We may continue to send non-promotional communications concerning your account, Orders, Seller application, security or changes to our legal terms.

4.9 Analytics and improvement

Subject to applicable cookie and consent rules, we may use information to:

• understand how users interact with the Platform;

• measure performance;

• identify errors;

• improve navigation and features;

• analyse general marketplace trends;

• develop new services.

The legal basis may be your consent or our legitimate interests, depending on the technology and applicable legal requirements.

Non-essential analytics technologies will be used only after obtaining consent where consent is required.

4.10 Personalised advertising

Where you have provided the required consent, we and our partners may use cookies or similar technologies to:

• measure advertising effectiveness;

• display advertising based on your interests;

• remember Products you viewed;

• create advertising audiences;

• limit repeated advertisements.

You may change your choices through the cookie preference tool.

We will not use non-essential advertising technologies before obtaining consent where consent is required.

4.11 Legal claims and disputes

We may process and retain information to:

• establish, exercise or defend legal claims;

• investigate complaints;

• respond to chargebacks and payment disputes;

• enforce contracts;

• cooperate with courts, regulators and competent authorities.

The legal basis is our legitimate interest in protecting our legal rights or compliance with a legal obligation.

5. HOW WE SHARE PERSONAL INFORMATION

We share Personal Information only where necessary and where there is a valid legal basis.

5.1 Independent Sellers

When a Buyer places an Order, we share the information necessary for the relevant Seller to fulfil the Order, which may include:

• Buyer name;

• email address;

• telephone number;

• billing and delivery address;

• Products ordered;

• Order value and payment status;

• delivery instructions;

• return, refund or complaint information.

The Seller must use this information only for lawful purposes relating to the transaction, legal compliance, accounting, customer support and the establishment or defence of claims.

The Seller may act as a separate data controller for this processing and is responsible for providing any privacy information required by law.

A Seller must not use Buyer information for its own unrelated marketing unless the Seller has a separate valid legal basis and has provided the required information to the Buyer.

5.2 Shopify

The Platform is hosted and supported by Shopify.

Shopify processes information necessary to provide hosting, checkout, security, analytics, account, payment and other Platform services.

Depending on the specific processing activity, Shopify may act as our processor or as an independent controller.

Shopify may also process information relating to your interactions with the Platform and other Shopify-supported services, as explained in Shopify’s own privacy documentation.

5.3 Webkul and marketplace technology providers

We may share information with Webkul or other marketplace technology providers that support:

• Seller registration;

• Seller dashboards;

• Product listings;

• Order allocation;

• commissions;

• Seller communications;

• payouts;

• marketplace administration.

These providers may process information on our behalf under applicable contractual and data protection requirements.

5.4 Payment providers

We share information with payment processors, banks and financial service providers where necessary to:

• process payments;

• verify transactions;

• issue refunds;

• prevent fraud;

• manage disputes and chargebacks;

• comply with financial obligations.

Payment providers may act as independent data controllers for some of their activities.

5.5 Delivery and logistics providers

Information may be shared with delivery providers, couriers and logistics partners where necessary to dispatch, transport, track and deliver an Order.

In many cases, the relevant Seller selects and communicates directly with the delivery provider.

5.6 Professional and technical service providers

We may use providers for:

• website hosting and infrastructure;

• cloud storage;

• email delivery;

• customer support;

• accounting;

• legal advice;

• cybersecurity;

• identity and business verification;

• fraud prevention;

• analytics;

• cookie consent management;

• marketing, where permitted.

Providers acting on our behalf are authorised to process Personal Information only for the agreed purposes and subject to appropriate contractual safeguards.

5.7 Authorities and legal recipients

We may disclose information where reasonably necessary to:

• comply with law;

• respond to a court order or lawful authority request;

• report suspected fraud or illegal activity;

• comply with tax, consumer protection or product safety requirements;

• protect the rights and safety of users or third parties;

• establish, exercise or defend legal claims.

5.8 Business transfers

If all or part of Hoskay or Hendex LTD is sold, reorganised, merged or transferred, Personal Information may be disclosed to advisers, prospective purchasers or successor entities, subject to appropriate confidentiality and legal safeguards.

6. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies to operate and secure the Platform.

These technologies may include:

Strictly necessary technologies

These are required for functions such as:

• shopping cart operation;

• checkout;

• account login;

• security;

• fraud prevention;

• cookie preference storage.

These technologies cannot generally be disabled through our consent tool because the Platform cannot operate properly without them.

Analytics technologies

These help us understand Platform usage, identify errors and improve performance.

Where required by law, analytics technologies are activated only after you provide consent.

Functional technologies

These may remember preferences and provide enhanced Platform functionality.

Advertising technologies

These may be used to measure advertisements or display personalised advertising.

Where required by law, advertising technologies are activated only after you provide consent.

You may accept, reject or change your choices through the cookie banner or cookie preference tool available on the Platform.

Rejecting non-essential cookies will not prevent you from using the basic functions of the Platform, although some optional features may be unavailable.

Further information about the cookies and technologies currently used is available in our Cookie Policy.

7. SHOPIFY NETWORKED AND ENHANCED SERVICES

We may enable Shopify services that use information relating to interactions with our Platform and other merchants using Shopify.

Depending on the enabled Shopify services and your location, Shopify may use information to provide services such as:

• fraud prevention;

• analytics;

• accelerated checkout;

• personalised shopping features;

• advertising measurement or personalisation.

Where Shopify determines the purposes and means of such processing, Shopify may act as an independent data controller and will be responsible for handling relevant data protection requests relating to that processing.

Further information is available in Shopify’s Consumer Privacy Policy and privacy portal.

Where consent is legally required for a Shopify advertising or tracking feature, we will seek that consent through the Platform’s privacy controls.

8. INTERNATIONAL TRANSFERS

Hoskay is established in Bulgaria and primarily processes information within the European Economic Area.

Some service providers, including Shopify and other technology providers, may process or store information outside Bulgaria or outside the European Economic Area.

Where Personal Information is transferred to a country outside the European Economic Area, we will ensure that a lawful transfer mechanism applies, such as:

• a European Commission adequacy decision;

• the European Commission’s Standard Contractual Clauses;

• another transfer mechanism permitted by applicable data protection law.

Additional technical, contractual or organisational safeguards may be applied where necessary.

You may contact us for more information about the safeguards relevant to a particular transfer.

9. RETENTION OF PERSONAL INFORMATION

We retain Personal Information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including legal, accounting, security and dispute-resolution purposes.

The applicable retention period depends on the type of information and the reason for processing it.

Buyer accounts

Account information is generally retained while the account remains active and for a reasonable period after closure where necessary to handle disputes, enforce agreements, prevent fraud or comply with legal obligations.

Orders and accounting information

Order, payment, invoice and accounting records are retained for the period required under applicable tax, accounting and commercial laws.

Seller accounts

Seller account, transaction and marketplace administration information is retained for the duration of the Seller relationship and for an appropriate period afterwards to comply with legal obligations, manage disputes and protect the Platform.

Seller application information

Information submitted as part of an approved Seller application may be retained throughout the Seller relationship and afterwards where required for legal, contractual, fraud prevention or dispute-resolution purposes.

Unless a longer period is required for legal compliance, fraud prevention, a regulatory investigation or the establishment, exercise or defence of legal claims, information and documents submitted as part of an unsuccessful or withdrawn Seller application will be deleted or anonymised within 6 months after the final decision or withdrawal.

Seller verification documents

Copies of identity, registration, bank account, licence and other Seller verification documents will generally be retained for the duration of the Seller relationship and for 6 months after its termination.

After that period, the copies will be securely deleted or anonymised, unless longer retention is required by applicable law, a competent authority, an ongoing investigation, fraud prevention needs or the establishment, exercise or defence of legal claims.

Where it is no longer necessary to retain the complete document, Hoskay may retain a limited verification record, such as:

• the type of document reviewed;

• the date of verification;

• the person who was verified;

• the result of the verification;

• limited reference information;

• records of the decision made.

Support communications

Support requests and correspondence are retained for as long as necessary to resolve the matter and for a reasonable period afterwards to manage follow-up questions or legal claims.

Marketing information

Marketing preferences are retained until you withdraw consent or object to marketing.

We may retain limited suppression information after an unsubscribe request to ensure that no further marketing is sent.

Security logs

Technical and security logs are retained for a limited period appropriate to detecting incidents, preventing fraud and protecting the Platform.

Legal disputes

Where information is relevant to a complaint, investigation or legal dispute, it may be retained until the matter is finally resolved and the applicable limitation periods have expired.

At the end of the applicable retention period, information is deleted, anonymised or securely restricted unless further processing is required by law.

10. SECURITY

We use reasonable technical and organisational measures designed to protect Personal Information against:

• unauthorised access;

• unlawful processing;

• accidental loss;

• destruction;

• alteration;

• unauthorised disclosure.

These measures may include:

• access controls;

• password protections;

• encrypted connections;

• restricted access to Seller verification documents;

• service provider security requirements;

• account and activity monitoring;

• backups;

• internal procedures for security incidents.

Access to Seller identity and verification documents is limited to authorised persons who need the information for verification, compliance, fraud prevention or legal purposes.

No method of electronic transmission or storage is completely secure. We therefore cannot guarantee absolute security.

You are responsible for keeping your account credentials confidential and should contact us promptly if you suspect unauthorised access.

11. CHILDREN’S PERSONAL INFORMATION

The Platform is not intended for use by children who are not legally capable of entering into the relevant transaction.

We do not knowingly collect Personal Information directly from children for the purpose of allowing them to independently purchase Products or register as Sellers.

Where we become aware that Personal Information has been collected from a child without an appropriate legal basis or required parental authorisation, we will take reasonable steps to delete it.

A parent or legal guardian may contact us if they believe that a child has provided Personal Information unlawfully.

12. AUTOMATED DECISION-MAKING

We may use automated tools to assist with:

• fraud detection;

• payment security;

• account security;

• suspicious activity identification;

• advertising personalisation, where consent has been provided.

These tools may flag a transaction or account for further review.

Unless we inform you otherwise, Hoskay does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you.

Payment providers, Shopify or other service providers may carry out their own automated risk assessments in accordance with their privacy policies.

13. YOUR DATA PROTECTION RIGHTS

Subject to the conditions and limitations of applicable law, you may have the right to:

Access

Request confirmation of whether we process your Personal Information and obtain access to it.

Correction

Request correction of inaccurate or incomplete Personal Information.

Erasure

Request deletion of Personal Information where there is no longer a lawful reason to retain it.

The right to deletion does not apply where retention is required by law or necessary for legal claims.

Restriction

Request that processing be restricted in certain circumstances.

Data portability

Receive Personal Information that you provided to us in a structured, commonly used and machine-readable format, and request its transfer to another controller where legally applicable.

Objection

Object to processing based on our legitimate interests.

We will stop the relevant processing unless we demonstrate compelling legitimate grounds or the processing is necessary for legal claims.

Direct marketing objection

Object to direct marketing at any time.

Where you object, we will stop using your Personal Information for that marketing purpose.

Withdrawal of consent

Withdraw consent at any time where processing is based on consent.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Automated decisions

Request information and exercise applicable rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.

Complaint to a supervisory authority

Submit a complaint to the competent data protection supervisory authority.

To exercise a right, contact us at office@hoskay.com.

Please describe your request clearly and provide sufficient information for us to identify the relevant account or information.

We may request reasonable evidence of identity before responding. We will not request more information than necessary for verification.

We will respond within the period required by applicable law.

14. COMPLAINTS

We encourage you to contact us first if you have a concern about our handling of Personal Information.

You may contact:

Hendex LTD
Email: office@hoskay.com
Telephone: +359 89 249 6435
Address: 6 Bratiya Street, Plovdiv, Bulgaria

You also have the right to submit a complaint to the Bulgarian supervisory authority:

Commission for Personal Data Protection
2 Prof. Tsvetan Lazarov Blvd.
1592 Sofia
Bulgaria

You may also submit a complaint to the supervisory authority in the European Economic Area country in which you live or work, or where you believe an infringement occurred.

15. THIRD-PARTY WEBSITES

The Platform may contain links to websites or services operated by Sellers or other third parties.

Hoskay does not control the privacy practices of independent third parties.

Before providing information through a third-party service, you should review its privacy policy and terms.

The presence of a link on the Platform does not mean that Hoskay endorses or controls the third party’s privacy practices.

16. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect:

• changes to the Platform;

• new service providers or technologies;

• changes to our Seller verification process;

• changes to legal or regulatory requirements;

• changes to our data processing practices.

The updated version will be published on this page with a revised “Last updated” date.

Where required by law, we will provide additional notice of material changes.

17. CONTACT INFORMATION

For questions about this Privacy Policy, our privacy practices or your rights, contact:

Hendex LTD
Company registration number: 208780173
Registered address: 6 Bratiya Street, Plovdiv, Bulgaria
Email: office@hoskay.com
Telephone: +359 89 249 6435

Hendex LTD is the data controller for the processing activities described in this Privacy Policy, except where another party, such as an independent Seller, Shopify or a payment provider, determines its own purposes and means of processing and acts as a separate data controller.