Legal

Privacy Policy

Last updated: 2026-09-20

Data controller

[SALON LEGAL NAME], EIC [ЕИК], 3 Parizhka Komuna St., Varna, Bulgaria. Contact for all privacy matters: [PRIVACY EMAIL]. Hosting: Digital Ocean, Netherlands (EU).

What data we collect and why

When you book online or create a portal account we store: your name, phone number, email address (optional), booking history, protocol formulas and photos added during your visits, gift-certificate codes, and registration details (date, time and IP address of account creation). When you join the waitlist we store your contact details and preferred services. Payment card data never touches our systems — deposits are processed by myPOS; we store only the payment status and a processor reference. Admin staff keep audit logs of changes to client records (who changed what and when).

Why we process it (legal bases)

Fulfilling your booking and managing your visits — performance of a contract (GDPR Art. 6(1)(b)). Marketing emails and analytics cookies — your consent (Art. 6(1)(a)), withdrawable at any time. Accounting records — legal obligation (Art. 6(1)(c)). Service improvement statistics in aggregate form — our legitimate interest (Art. 6(1)(f)).

How long we keep it

Booking and visit records: while your account is active, plus the period required by Bulgarian accounting and tax law after that (typically 5 years for financial documents). Marketing consents: until you unsubscribe or withdraw them. Registration and consent metadata (incl. IP): for the limitation periods of possible legal claims. Analytics data: per the retention of each tool (see Cookie Policy). Audit logs: 1 year.

Who receives data

Processors under contract (data-processing agreements, EU/EEA): hosting — Digital Ocean (Netherlands); payments — myPOS; notifications (booking confirmations, reminders) — our messaging provider; analytics (only with consent) — Google Analytics 4, Microsoft Clarity, Meta Pixel. We never sell personal data.

Your rights

Under the GDPR you have the right to: (1) be informed (this policy); (2) access your data and receive a copy — much of it is available in your portal account at any time; (3) correct inaccurate data — editable in the portal; (4) have data erased where a ground applies; (5) restrict processing; (6) be notified of third parties regarding corrections or erasure; (7) data portability in a structured, machine-readable format; (8) not be subject to decisions based solely on automated processing — we do not use such technologies; (9) withdraw consent at any time, without affecting the lawfulness of processing before withdrawal. Email [PRIVACY EMAIL] — we respond within 30 days. You may also complain to the Bulgarian CPDP (cpdp.bg) or your local authority.

Client portal

In your portal account settings you can view and correct your profile data at any time. To delete your account and visit history, contact [PRIVACY EMAIL]; deletion removes personal data unless we must keep accounting records by law.

Children

The site and booking are not directed at children under 16. We do not knowingly collect their data.