This policy explains how FunFex LTD ("FunFex", "we", "us", "our") collects, uses, stores and protects your personal data when you use funfex.com (the "Site"), buy our digital products, or hire us for development, cybersecurity or related professional services.

We process personal data in accordance with Regulation (EU) 2016/679 ("GDPR") and applicable Bulgarian data protection law, including the Personal Data Protection Act (Закон за защита на личните данни).

1. Data controller

For the purposes of the GDPR, FunFex LTD is the data controller for personal data collected through the Site and through direct business communication with us.

  • Company: FunFex LTD
  • Country of registration: Bulgaria
  • Registration number (UIC/EIK): [to be provided]
  • Contact email: This email address is being protected from spambots. You need JavaScript enabled to view it.

2. What information we collect

Account information

When you register on the Site, we collect your name and email address.

  • Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).
  • Purpose: Manage your account, authenticate downloads, and send transactional emails (purchase confirmations, renewal reminders, password resets, support replies).

Payment information

Payments are processed by third-party providers (e.g. Stripe, Paddle, Freemius). We do not see or store your card number, expiry date, or CVV. We receive a customer ID, subscription ID, and the amount paid, which we store to manage your subscription.

  • Legal basis: Performance of a contract (Art. 6(1)(b)) and compliance with legal tax/accounting obligations (Art. 6(1)(c)).
  • Purpose: Process payments, manage subscriptions, issue invoices that comply with Bulgarian and EU VAT rules.
  • See Stripe's privacy practices at stripe.com/privacy where applicable. Where Paddle is used as Merchant of Record, Paddle acts as an independent data controller for tax and payment purposes.

Business and project information

If you request a proposal, consultation, support, custom development, cybersecurity assessment, penetration test, AI integration, SEO service, or another professional service, we may process:

  • your company or organisation;

  • project requirements and business goals;

  • website or application details;

  • technical systems, infrastructure, hosting, security, or software environment information that you choose to share with us.

  • Legal basis: Pre-contractual measures and performance of a contract (Art. 6(1)(b)).

  • Purpose: Understand your request, prepare a proposal, deliver services, and communicate about the project.

For penetration testing and security assessments, additional contractual safeguards (NDA, scope authorisation, rules of engagement) apply, and we handle any sensitive findings in strict confidence.

Download logs

When you download an extension or plugin, we log your user ID, the product and release downloaded, the date and time, and your IP address.

  • Legal basis: Legitimate interests (Art. 6(1)(f)).
  • Purpose: Provide download statistics, enforce licence terms, detect abuse and software piracy.

Licence keys

We store a cryptographic hash of your licence key (not the key itself). The plain-text key is shown once at purchase and emailed to you; we do not retain it after that.

Support tickets

When you submit a support request, we collect your name, email address, and the content of your message, including any attachments, environment details, or error logs you provide.

  • Legal basis: Performance of a contract or legitimate interests in resolving customer queries.
  • Purpose: Respond to your enquiry and provide technical assistance.

Newsletter and marketing (optional)

If you opt in to our newsletter, your name and email address are processed by our email marketing provider to deliver communications about new releases, updates, and offers.

  • Legal basis: Consent (Art. 6(1)(a)). You may withdraw consent at any time via the unsubscribe link in any email or by contacting This email address is being protected from spambots. You need JavaScript enabled to view it., without affecting the lawfulness of prior processing.

Website usage data

When you visit the Site, we collect standard technical data: IP address, browser type and version, device information, operating system, pages visited, referring URL, date and time of access, and server logs.

  • Legal basis: Legitimate interests (Art. 6(1)(f)).
  • Purpose: Security, diagnostics, performance monitoring, fraud prevention, and understanding how visitors use the Site. We do not link this data to individual accounts for marketing purposes.

3. Legal bases summarised

Under the GDPR, we rely on:

  • Contractual necessity (Art. 6(1)(b)): account management, purchases, licence delivery, support, and service performance.
  • Legal obligation (Art. 6(1)(c)): VAT, invoicing, accounting under Bulgarian and EU law.
  • Legitimate interest (Art. 6(1)(f)): security, fraud prevention, licence enforcement, product improvement.
  • Consent (Art. 6(1)(a)): newsletter and marketing emails; non-essential cookies. You can withdraw consent at any time.

We do not engage in automated decision-making or profiling that produces legal effects concerning you.

4. How we use your personal data

  • Respond to enquiries and messages.
  • Provide consultations, proposals, and quotes.
  • Deliver software, AI integration, cybersecurity, SEO, hosting, support, and related services.
  • Manage client relationships and project communication.
  • Process payments and issue invoices compliant with EU VAT rules.
  • Send transactional emails (purchase confirmations, renewal reminders, password resets, security notices).
  • Send newsletter emails, if you have opted in.
  • Maintain, secure, and improve the Site and our products.
  • Detect and prevent fraud, abuse, or breach of licence terms.
  • Comply with legal, accounting, tax, and regulatory obligations.
  • Establish, exercise, or defend legal claims.

We do not sell, rent, or trade personal data to third parties for their own marketing purposes.

5. Who we share personal data with

We share personal data only with the following categories of recipients, strictly as necessary:

  • Payment processors (e.g. Stripe, Paddle, Freemius): payment processing, subscription management, tax compliance.
  • Email service providers: transactional and (with consent) marketing emails.
  • Hosting and infrastructure providers: storing and serving the Site and customer data, within the EU/EEA wherever possible.
  • CRM, project management, and analytics tools: managing client relationships and understanding Site usage.
  • Accounting, legal, and professional advisors: bound by professional confidentiality.
  • Cybersecurity, monitoring, and infrastructure providers: protecting the Site and our services.
  • Public authorities, courts, or regulators: only where required by law or to protect our legal rights.

Where third-party providers process personal data on our behalf, they do so only on our instructions and under appropriate data protection agreements.

A current list of sub-processors is available on request at This email address is being protected from spambots. You need JavaScript enabled to view it..

6. International data transfers

Where personal data is transferred outside the European Economic Area (for example, to a US-based payment processor), we rely on appropriate safeguards under Chapter V of the GDPR, including:

  • EU Standard Contractual Clauses (SCCs);
  • An adequacy decision from the European Commission;
  • The EU-US Data Privacy Framework, where the recipient is certified.

7. Data retention

  • Account and subscription data: for as long as your account is active, and up to 10 years after closure to comply with Bulgarian accounting and tax law.
  • Invoices and payment records: 10 years, as required by Bulgarian law.
  • Download logs: up to 3 years.
  • Support tickets: up to 3 years after the last interaction.
  • Newsletter data: until you unsubscribe or withdraw consent.
  • Server logs: up to 12 months.
  • Project and proposal correspondence: for the duration of the business relationship and a reasonable period afterwards for legal and accounting purposes.

You may request earlier deletion of data not subject to legal retention obligations (see Section 9).

8. Cookies

The Site uses:

  • Strictly necessary cookies: login, session management, and form security (CSRF tokens). These do not require consent under the ePrivacy Directive.
  • Functional cookies: language and display preferences.
  • Analytics cookies: only with your consent, to understand how the Site is used. You may accept or reject these via the cookie banner shown on first visit.

We do not use third-party advertising cookies. You can manage cookies at any time through your browser settings or via our cookie preferences page. Disabling cookies may affect some Site functionality.

9. Your rights under the GDPR

Subject to applicable conditions and limitations, you have the right to:

  • Access: obtain confirmation of whether we process your personal data and receive a copy of it.
  • Rectification: request correction of inaccurate or incomplete data.
  • Erasure ("right to be forgotten"): request deletion of your data, subject to legal retention obligations.
  • Restriction: request that we limit processing in certain circumstances.
  • Data portability: receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.
  • Object: object to processing based on legitimate interests or for direct marketing.
  • Withdraw consent: at any time, where processing is based on consent.
  • Lodge a complaint: with a supervisory authority (see Section 10).

To exercise any of these rights, contact us at This email address is being protected from spambots. You need JavaScript enabled to view it.. We will respond within 30 days, as required by Article 12(3) of the GDPR. We may need to verify your identity before responding.

10. Complaints

If you believe that your personal data has been processed unlawfully or that your data protection rights have been violated, please contact us first at This email address is being protected from spambots. You need JavaScript enabled to view it..

You also have the right to lodge a complaint with the Bulgarian supervisory authority:

Commission for Personal Data Protection (Комисия за защита на личните данни, КЗЛД) 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, Bulgaria Website: cpdp.bg

EU residents may also lodge a complaint with the supervisory authority in their country of residence.

11. Data security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, or destruction:

  • HTTPS/TLS encryption for all traffic.
  • Hashed and salted storage of credentials and licence keys.
  • Access controls and least-privilege principles for administrative access.
  • Regular security updates and vulnerability monitoring.
  • Encrypted backups stored within the EU/EEA.
  • Internal security procedures and limited access to personal data.

No method of transmission over the internet is completely secure; we cannot guarantee absolute security. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Commission for Personal Data Protection within 72 hours and, where required, inform affected users without undue delay (Articles 33 and 34 GDPR).

12. Children's privacy

The Site and our services are not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us at This email address is being protected from spambots. You need JavaScript enabled to view it. and we will delete it.

13. Links to third-party websites

The Site may contain links to third-party websites, tools, platforms, or services. We are not responsible for the privacy practices, content, or security of third-party websites. You should review their privacy policies before providing personal data to them.

14. Changes to this policy

We may update this Privacy Policy from time to time. The date at the end of this page indicates when the policy was last updated. We will notify registered users of material changes by email at least 14 days before they take effect, or through a prominent notice on the Site.

Continued use of the Site after changes are published means that you acknowledge the updated Privacy Policy.

15. Contact

For any privacy-related queries, requests, or complaints, contact us at:

FunFex LTD Bulgaria Registration number (UIC/EIK): [to be provided] Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

Updated: 20 May 2026