Privacy Policy (GDPR)

Last updated: June 2026

1. General

This Privacy Policy aims to inform users of this website about how personal data is collected, used, stored and protected, in accordance with Regulation (EU) 2016/679 (GDPR).

Data Controller: Stanimir Yasenov Koruev, trading as UpZora
Email: [email protected]

2. Data We Collect

Depending on how you use the site, we may collect the following data:

First and last name (if provided voluntarily);
email address;
phone number (if provided);
content of messages sent via contact forms;
booking data: selected service, date, time and notes;
IP address;
technical data (browser, device, operating system).

3. Purposes of Processing

Collected personal data is used to:

respond to enquiries;
manage bookings and provide services;
improve the website;
technical support and security;
statistical and analytical purposes (aggregated data only).

4. Legal Basis

Processing is carried out on the following legal bases:

consent of the user;
performance of a contract or pre-contractual steps;
legitimate interest (e.g. security and functionality of the site);
legal obligation, where applicable.

5. Retention

Personal data is kept only for as long as necessary to fulfil the purposes for which it was collected. Booking data is retained for up to 24 months after the booking date. Registration data is retained until deletion is requested or 12 months of inactivity have elapsed.

6. Data Sharing

Personal data is not sold, rented or shared with third parties, except in the following cases:

where necessary for the operation of the site (hosting, technical providers);
where required by law (e.g. by court or prosecutorial order);
when using trusted sub-processors.

All such third parties are required to comply with GDPR.

7. Cookies

We use cookies for:

maintaining your session when logged in (PHPSESSID - deleted when the browser is closed);
remembering your acceptance of the GDPR banner (valid for 365 days);
remembering language preference.

We do not use analytics, marketing or third-party cookies. You can control or delete cookies through your browser settings.

8. Data Security

We apply appropriate technical and organisational measures to protect personal data against:

unauthorised access;
loss or alteration;
misuse.

We use encrypted HTTPS connections, hashed passwords and restricted access to the production database. However, 100% security of data transmission over the internet cannot be guaranteed.

9. Your Rights

Every user has the right to:

obtain information about the data held about them;
request correction of inaccurate data;
request erasure ("right to be forgotten");
restrict processing;
receive their data in a machine-readable format (right to portability);
object to processing based on legitimate interest;
lodge a complaint with a supervisory authority.

To exercise any of the above rights, send an email to [email protected]. We will respond within 30 days.

You have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP): www.cpdp.bg, 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia.

10. Contact

Questions or requests regarding your personal data?

Write to us at [email protected] - we respond within 30 days.

11. Changes to This Policy

This policy may be updated periodically. Changes will be published on this page with a new date.