Last updated: July 2026

1. About This Privacy Policy

This Privacy Policy explains how SMART SOFTWARE PLATFORM SOLUTION LTD, operating under the brand Wish & Dream (“Wish & Dream”, “we”, “us” or “our”), collects, uses, stores, shares and protects personal data when you visit www.wishanddream.com, place an order, upload personalization materials, contact us or otherwise use our services.

Wish & Dream provides personalized digital products, including personalized Tooth Fairy and Santa Claus videos. Some products are created for children, but all orders must be placed by an adult parent, legal guardian or another adult who has lawful authority to provide the child’s information.

We process personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), the Bulgarian Personal Data Protection Act and other applicable Bulgarian and European data-protection legislation.

2. Data Controller and Contact Details

The data controller responsible for processing personal data through the Website is:

SMART SOFTWARE PLATFORM SOLUTION LTD
UIC/EIK: 205387811
Registered address: 47 Pirinski Prohod Street, Entrance G, Floor 1, Unit G2, Krasno Selo District, 1680 Sofia, Bulgaria
VAT number: BG205387811
Email: info@wishanddream.com
Website: www.wishanddream.com

For questions concerning this Privacy Policy, the use of personal data or the exercise of your data-protection rights, contact us at info@wishanddream.com.

3. Whose Personal Data We Process

We may process personal data relating to:

  • visitors to the Website;
  • customers who place an order;
  • persons who create or use a customer account, where this functionality is available;
  • parents, legal guardians or other adults who provide personalization information;
  • children who are recipients of personalized products;
  • persons who contact us or submit a customer-support request;
  • newsletter subscribers, where a newsletter service is available.

4. Personal Data We Collect

4.1 Customer and Order Information

We may collect:

  • first and last name;
  • email address;
  • telephone number, where requested;
  • billing address and invoice information, where applicable;
  • order number;
  • selected product and personalization options;
  • price, currency and payment status;
  • transaction reference;
  • customer-support and complaint correspondence.

4.2 Child and Personalization Information

Depending on the selected product, we may process:

  • the child’s first name or nickname;
  • the child’s age or age range, where required for personalization;
  • pronouns or gender selection, where needed for correct wording;
  • uploaded photographs;
  • interests, achievements, wishes, messages or other details voluntarily provided by the adult customer;
  • generated text, audio, image, video and production files necessary to create and deliver the personalized product.

Please provide only information that is reasonably necessary for creating the ordered product.

Do not upload photographs containing unrelated children or other persons unless you have lawful permission to provide and use those photographs.

4.3 Payment Information

Payments are processed by the payment providers displayed during checkout.

Wish & Dream does not normally receive or store complete credit or debit card numbers, card security codes or online-banking credentials.

We may receive limited payment information, including:

  • payment status;
  • transaction identifier;
  • payment method;
  • currency and amount;
  • limited card information supplied by the payment provider, such as the last digits of the card.

4.4 Technical and Usage Information

When you visit or use the Website, we may process:

  • IP address;
  • browser type;
  • device type;
  • operating system;
  • date and time of access;
  • pages viewed;
  • Website interactions;
  • session information;
  • error and security logs;
  • fraud-prevention information;
  • cookie identifiers;
  • cookie-consent preferences;
  • analytics or advertising information, only where the relevant technology is active and the required consent has been provided.

5. How We Collect Personal Data

We collect personal data:

  • directly from you when you place an order;
  • when you provide personalization information;
  • when you upload photographs;
  • when you complete a form;
  • when you create an account;
  • when you contact customer support;
  • automatically through necessary Website technologies, cookies and server logs;
  • from payment, hosting, email, security and production service providers where necessary to operate the Website and fulfil your order.

6. Purposes and Legal Bases for Processing

6.1 Processing and Delivering an Order

We process customer, order and payment information to accept, manage and deliver the purchased product.

Legal basis: performance of a contract under Article 6(1)(b) GDPR.

6.2 Processing a Child’s Personalization Information

We process a child’s name, photographs and other personalization information solely to create, deliver and support the ordered personalized product.

Legal basis: consent provided by the parent or legal guardian under Article 6(1)(a) GDPR.

Where required, we may take reasonable steps to confirm that the person providing the information has parental responsibility or lawful permission.

6.3 Processing Payments

We process the information necessary to confirm payment, prevent duplicate transactions and manage the order.

Legal basis: performance of a contract under Article 6(1)(b) GDPR and compliance with applicable legal obligations under Article 6(1)(c) GDPR.

6.4 Providing Customer Support

We process information to answer questions, resolve technical problems, handle complaints and provide support relating to an order.

Legal basis: performance of a contract under Article 6(1)(b) GDPR or our legitimate interests under Article 6(1)(f) GDPR.

6.5 Website Security and Fraud Prevention

We process technical and security information to protect the Website, prevent misuse, detect fraud and investigate security incidents.

Legal basis: our legitimate interests under Article 6(1)(f) GDPR.

6.6 Legal, Accounting and Tax Obligations

We retain and process information where required by accounting, tax, court, regulatory or other legal obligations.

Legal basis: Article 6(1)(c) GDPR.

6.7 Analytics and Advertising

Optional analytics and advertising technologies are used only where they are active and where the required consent has been provided.

Legal basis: consent under Article 6(1)(a) GDPR, where required.

6.8 Marketing Communications

We may send newsletters or promotional communications only where we have an appropriate legal basis, such as consent.

You may unsubscribe at any time by using the unsubscribe link in the message or by contacting us.

7. Artificial Intelligence and Automated Production

Wish & Dream may use automated software or artificial-intelligence-assisted tools to create personalized scripts, audio, images or video content using information submitted with an order.

These tools may process:

  • the child’s first name or nickname;
  • selected personalization details;
  • uploaded photographs;
  • text instructions;
  • audio, image or video production materials.

We provide service providers only with the information reasonably necessary to create and deliver the ordered product.

We do not use a child’s personal data to make automated decisions that produce legal or similarly significant effects.

We do not use children’s personal data for unrelated profiling, facial recognition or targeted advertising directed at the child.

Where third-party production providers are used, they are required to process the information only for the purposes necessary to create, deliver or support the ordered product and subject to appropriate confidentiality and data-protection arrangements.

8. Children’s Privacy and Parental Authority

Wish & Dream products may be intended for children, but the Website, checkout process and ordering services are intended for adults.

By submitting a child’s name, photograph or other personalization information, the customer confirms that:

  • they are at least 18 years old;
  • they are the child’s parent or legal guardian, or have lawful permission from the child’s parent or legal guardian;
  • they have the right to upload and use the submitted photographs and information;
  • they consent to the information being used to create, deliver and support the ordered personalized product.

We do not knowingly accept orders directly from children.

We do not:

  • sell children’s personal data;
  • use uploaded child photographs for facial recognition;
  • create advertising profiles about children;
  • publish uploaded child photographs;
  • use uploaded photographs in public advertising without separate and specific permission;
  • use children’s information for purposes unrelated to the ordered product.

9. Sharing Personal Data

We may share only the minimum personal data reasonably necessary with trusted service providers, including:

  • Website hosting and cloud-storage providers;
  • payment processors;
  • email and digital-delivery providers;
  • technology providers used to generate or process personalized scripts, audio, images or videos;
  • Website security, anti-spam, anti-bot and fraud-prevention providers;
  • analytics or advertising providers, only where those services are active and the required consent has been provided;
  • accountants, lawyers and insurers;
  • courts, regulators or public authorities where disclosure is legally required.

We do not sell personal data.

Service providers may process personal data only for the agreed purpose and must apply appropriate confidentiality, security and data-protection safeguards.

10. International Data Transfers

Some technology or production service providers may process personal data outside the European Economic Area.

Where an international transfer takes place, we use an applicable legal safeguard, including:

  • an adequacy decision adopted by the European Commission;
  • Standard Contractual Clauses approved by the European Commission;
  • another lawful transfer mechanism permitted under applicable data-protection law.

Further information about the safeguards used for an international transfer may be requested by contacting us at info@wishanddream.com.

11. Data Retention

We retain personal data only for as long as reasonably necessary for the relevant purpose.

11.1 Uploaded Photographs and Personalization Files

Uploaded child photographs and personalization files are deleted within 30 days after delivery of the personalized product, unless temporary retention is necessary to:

  • correct or regenerate the product;
  • resolve a customer-support request;
  • investigate a payment dispute;
  • investigate fraud or a security incident;
  • establish, exercise or defend a legal claim;
  • comply with a legal obligation.

11.2 Generated Personalized Videos

Generated personalized videos and production files are retained only for the period necessary to deliver the order and provide customer support.

After that period, they may be permanently deleted.

Customers should download and securely store their video after receiving it.

11.3 Order and Accounting Information

Order, invoice, transaction and accounting information is retained for the period required by applicable Bulgarian accounting and tax legislation.

11.4 Customer-Support Correspondence

Customer-support and complaint correspondence is normally retained for up to 12 months after the issue is resolved, unless a longer period is required for a legal claim or statutory obligation.

11.5 Marketing Information

Marketing subscription information is retained until you withdraw your consent or unsubscribe.

11.6 Technical and Security Information

Technical, error and security logs are retained for a reasonable security and troubleshooting period.

11.7 Cookie Information

Cookie information is retained according to the Cookie Policy and the settings displayed in the cookie-consent panel.

After the applicable retention period expires, personal data is securely deleted, anonymised or restricted where continued storage is required by law.

12. Cookies and Similar Technologies

The Website may use:

  • strictly necessary cookies;
  • functional and preference cookies;
  • analytics cookies;
  • marketing cookies;
  • similar technologies such as pixels, local storage, tags or scripts.

Strictly necessary cookies may be required for:

  • shopping-cart operation;
  • checkout;
  • payment security;
  • fraud prevention;
  • language and session preferences;
  • cookie-consent preferences.

Optional analytics and marketing technologies are activated only after consent where consent is required.

Detailed information about the cookies and similar technologies used by the Website is available in our separate Cookie Policy and cookie settings panel.

13. Data Security

We apply reasonable technical and organisational measures designed to protect personal data against:

  • unauthorised access;
  • loss;
  • alteration;
  • misuse;
  • destruction;
  • accidental disclosure.

These measures may include:

  • HTTPS encryption;
  • access restrictions;
  • role-based permissions;
  • secure hosting;
  • backups;
  • security monitoring;
  • data minimisation;
  • secure deletion procedures;
  • restricted access to personalization files.

No online service can guarantee absolute security.

Customers should protect access to their email accounts and should not publicly share private delivery links.

14. Your Data-Protection Rights

Subject to the conditions and limitations established by the GDPR, you may have the right to:

  • be informed about how your personal data is used;
  • request access to personal data held about you;
  • receive a copy of your personal data;
  • request correction of inaccurate or incomplete information;
  • request deletion of personal data;
  • request restriction of processing;
  • receive certain information in a structured, commonly used and machine-readable format;
  • object to processing based on legitimate interests;
  • object to direct marketing;
  • withdraw consent at any time;
  • request information about safeguards used for international transfers;
  • not be subject to certain decisions based solely on automated processing.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

To exercise your rights, contact info@wishanddream.com.

Please include enough information to identify the relevant account or order.

We may request reasonable proof of identity or parental authority before disclosing, correcting or deleting personal data.

We will respond to valid data-protection requests without undue delay and, in principle, within one month, subject to any extension permitted under the GDPR.

15. Complaints

If you believe that your personal data has been processed unlawfully, please contact us first at info@wishanddream.com.

We will review your request and attempt to resolve the issue.

You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection:

Commission for Personal Data Protection
2 Prof. Tsvetan Lazarov Blvd.
1592 Sofia
Bulgaria
Email: kzld@cpdp.bg
Website: www.cpdp.bg

16. Third-Party Links

The Website may contain links to third-party websites or services.

Their collection and use of personal data are governed by their own privacy policies.

Wish & Dream is not responsible for the content, security or privacy practices of third-party websites that we do not control.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in:

  • our services;
  • technology providers;
  • Website functionality;
  • data-processing activities;
  • applicable legislation.

The latest version will be published on this page together with the updated “Last updated” date.

Where consent is legally required for a new processing activity, continued use of the Website does not replace the required consent.