Privacy Policy (GDPR)

1. General

This Privacy Policy aims to inform users of this website about how personal data is collected, used, stored and protected, in accordance with Regulation (EU) 2016/679 (GDPR).

2. Data We Collect

Depending on how you use the site, we may collect the following data:

• First and last name (if provided voluntarily);
• email address;
• phone number (if provided);
• content of messages sent via contact forms;
• booking data: selected service, date, time and notes;
• type of business, where given in an enquiry or a request;
• when taking part in a promotion: the prize received and the code issued;
• IP address;
• technical data (browser, device, operating system);
• visit data during ad campaigns: traffic source and UTM parameters.

3. Purposes of Processing

Collected personal data is used to:

• respond to enquiries;
• manage bookings and provide services;
• improve the website;
• technical support and security;
• statistical and analytical purposes (aggregated data only).

4. Legal Basis

Processing is carried out on the following legal bases:

• consent of the user;
• performance of a contract or pre-contractual steps;
• legitimate interest (e.g. security and functionality of the site);
• legal obligation, where applicable.

5. Retention

Personal data is kept only for as long as necessary to fulfil the purposes for which it was collected. Booking data is retained for up to 24 months after the booking date. Registration data is retained until deletion is requested or 12 months of inactivity have elapsed.

6. Data Sharing

Personal data is never sold or rented. We share data only with the providers the site needs in order to run, and where the law requires it (e.g. by court or prosecutorial order). The processors we use are:

• Hetzner Online GmbH - server hosting. Data is stored on a server inside the European Union.
• Cloudflare - network protection and content delivery; processes the IP address and technical request data.
• Brevo - sending email (confirmations and notifications).
• Google - Google Analytics, aggregated visit statistics.
• Meta Platforms - measuring the results of our Facebook and Instagram ads. See section 7 for exactly what is sent.

All of them act as data processors and are bound by GDPR. Google and Meta are established outside the EEA - transfers are made on the basis of the European Commission's adequacy decision (EU-US Data Privacy Framework) and standard contractual clauses.

7. Cookies and tracking

7.1 Strictly necessary

• PHPSESSID - keeps your session; deleted when the browser is closed;
• lang - remembers the language you picked;
• uz_remember and uz_staff - keep you signed in to the portal for up to 30 days;
• uz_pv - during a promotion, remembers which prize you were already shown so it cannot change (1 year);
• uz_push_asked - remembers that we already asked about notifications, so we do not ask again;
• in browser storage (localStorage) - your acknowledgement of the cookie notice.

7.2 Analytics

Google Analytics (_ga, _ga_* cookies) - aggregated statistics on how many people visit the site and which pages they read. The script loads with a delay and is not used for advertising.

7.3 Marketing

Meta Pixel (_fbp, _fbc cookies) runs on pages that take part in our ad campaigns. Its purpose is to tell us which ads lead to real enquiries.

When you submit a request from such a page, Meta is told that a request was made, together with your email address and phone number in hashed form (an irreversible SHA-256 fingerprint), so that Meta can match the request to the ad you were shown. The same is also sent from our server. Your email and phone are never transmitted in readable form, and Meta does not receive the content of your message.

The legal basis for analytics and marketing cookies is consent, which you give through the cookie notice. If you do not want this tracking:

• block third-party cookies in your browser settings;
• manage your ad preferences at Meta: facebook.com/adpreferences;
• opt out of Google Analytics with the official add-on: tools.google.com/dlpage/gaoptout.

Declining these cookies does not limit your use of the site.

8. Data Security

We apply appropriate technical and organisational measures to protect personal data against:

• unauthorised access;
• loss or alteration;
• misuse.

We use encrypted HTTPS connections, hashed passwords and restricted access to the production database. However, 100% security of data transmission over the internet cannot be guaranteed.

9. Your Rights

Every user has the right to:

• obtain information about the data held about them;
• request correction of inaccurate data;
• request erasure ("right to be forgotten");
• restrict processing;
• receive their data in a machine-readable format (right to portability);
• object to processing based on legitimate interest;
• lodge a complaint with a supervisory authority.

You have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP): www.cpdp.bg, 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia.

10. Contact

11. Changes to This Policy

This policy may be updated periodically. Changes will be published on this page with a new date.