Privacy and Data Protection Policy

IIntroduction

BODY AESTHETICS Ltd, managed by Valentina Tracheva, Kamelia Petrova-Ivanova and Georgi Ivanov, registered office at Plovdiv, Trakiya residential estate, Block 203 B, address of the Body Aesthetics Laser Centre: Sofia, Orehova Gora Street No. 2, contact telephone number 003598 7773 7772, email: info.bodyaesthetics@gmail.com – respects the privacy of its customers and guarantees the highest possible level of protection for their personal data.

This Privacy Policy governs the processing of personal data relating to individuals or representatives of legal entities who are our customers or potential customers, as well as users of our website www.bodyaesthetics.bg, in connection with the services we provide.

This Policy sets out the rules we will follow when processing personal data that we collect from you or about you, or that you provide to us. It does not affect, restrict or override your rights under the Personal Data Protection Act („PDPA“) or any other relevant legislation.

Please read this Policy carefully before using the Website or providing your personal data. The provision of personal data is voluntary, for the purpose of using certain services. In some cases, we will not be able to provide you with the service or sell you the goods if you do not provide us with the necessary information.

IIWho processes your personal data and is responsible for it?

BODY AESTHETICS LTD („Body Aesthetics“, „Body Aesthetics“, „the beauty salon“, „we“) is a commercial company registered in the Commercial Register at the Registry Agency under UIC 205983257, which collects, processes and stores your personal data in accordance with the terms of this Policy.

IIICategories of personal data processed

1. Body Aesthetics may process publicly available personal data and/or personal data provided by you. The main categories are:

• Personal identification information (name, email address, language of communication and other details);
• Contact details (email address, telephone number for you or a contact person you have specified);
• Financial information (bank account and other details);
• Information regarding a representative (legal representative or authorised representative) of one of our corporate clients;
• Data from a profile on the Website (name, postal and email addresses, telephone number, date of birth, etc.);
• Data relating to the conclusion of contracts for sale, dealerships, wholesale, deferred payment, etc.

2. Body Aesthetics may process data compiled and generated in the course of providing its services:

• information about the end device used, its type, operating system, IP address and location;
• information about the goods and services you prefer;
• data from our communications with you, your habits, preferences and satisfaction;
• information regarding visits to and use of the Website, including transactions and browsing history;
• data obtained in the course of fulfilling regulatory obligations (enquiries, regulations, investigating authorities, notaries, tax authorities, courts, bailiffs);
• video footage taken during visits to the shops or the head office;
• a video recording or photograph when taking part in games and/or promotional campaigns.

3. In order to ensure the proper provision of its services, Body Aesthetics is entitled to process information available in public registers, as well as information received from third parties in connection with the fulfilment of legal obligations.

4. Body Aesthetics has the right and the obligation to verify the accuracy of personal data; to this end, it may ask you to verify the data and, where necessary, to correct it.

5. Different types of personal data may be processed either individually or in combination with one another.

IVPurposes and legal grounds for processing

1. For the purpose of entering into or performing contracts with us

• Identification of a customer when concluding, amending or performing a contract;
• Preparation of proposals, pre-contractual information and a draft contract;
• Fulfilment of obligations and exercise of rights under contracts;
• Handling customer complaints/enquiries/claims, refunds and returns, and exchanges;
• Technical support for accessing the Website;
• Identification and verification of the statutory age;
• Payment of debts, payment plans, management of debt recovery;
• Management and administration of activities and payments.

2. To comply with legal obligations

• Issuing invoices;
• Tax and social security audits by the competent authorities;
• Compliance with obligations under the Consumer Protection Act;
• Provision of information to the Commission for Personal Data Protection (Personal Data Protection Act, Regulation (EU) 2016/679);
• Obligations under the Accounting Act and the Tax and Social Security Procedure Code.

3. On the basis of your explicit consent

• Direct marketing of products and services;
• Taking part in and managing surveys, prize draws and promotional campaigns.

4. For the purposes of Body Aesthetics’ legitimate interests

• Security and protection of property, interests and safety through CCTV;
• Assessment of satisfaction and the effectiveness of advertising;
• Analysis of purchase history, preferences and behaviour;
• Ensuring quality of service;
• Information on ongoing procedures and results, booking appointments;
• Protecting customers’ health from allergies or other health problems.

VThird parties with access to your data

• Transport/courier companies and postal operators;
• Persons who maintain data-processing equipment and software;
• Debt collection agencies, a notary, a solicitor or a bailiff in the event of a breach of contractual obligation;
• Banks handling payments;
• Persons to whom the performance of part of the activities relating to a service has been delegated;
• Consultants – solicitors, accountants, marketing agencies, etc.;
• Authorities and institutions to which we are legally obliged to provide data;
• Licensed security firms that process video recordings from premises/offices.

VIShelf life

1. Data relating to the conclusion/amendment and performance of a contract – for the duration of the contract and until the financial obligations have been fully settled; in the event of a dispute – until the dispute has been finally resolved by a decision that has become final.

2. Records relating to accounting/financial documents (invoices, notices, minutes, contracts) – for at least 11 years after the expiry of the limitation period for the settlement of the public claim, unless the law provides for a longer period.

3. Direct marketing data – until consent is expressly withdrawn or an objection is received.

4. Data from security camera footage – up to 60 days from the date the recording was made.

VIIYour rights

1. General rights

You have the right to request the following from Body Aesthetics:

• a copy of your personal data and access to it at any time;
• correction, without undue delay, of inaccurate or out-of-date data;
• data portability to another controller;
• erasure of data without undue delay where there is a legal basis for doing so;
• restriction of data processing;
• withdrawal of consent at any time;
• objection to processing and to automated processing, including profiling.

2. Right to lodge a complaint with the supervisory authority

The competent authority is the Personal Data Protection Commission, Sofia 1592, 2 Prof. Tsvetan Lazarov Boulevard (www.cpdp.bg).

3. Automated processing and profiling

When you visit the Website, we use automated processing to tailor our products and services to your needs.

4. Objection to direct marketing

You can send an email requesting that we stop using your data for direct marketing to: info.bodyaesthetics@gmail.com

5. Refusal to provide data

Failure to provide the data required for identification, contact and payment will prevent us from entering into a contract with you or from delivering the goods/services you have ordered.

VIIIHow we protect your data

Body Aesthetics implements organisational, physical, IT and other measures to ensure the security of your personal data:

• internal procedures for processing, recording and storage, compliance with which is monitored on an ongoing basis;
• restricted access by staff to personal data in accordance with their duties;
• confidentiality obligations for staff;
• restricted access to office equipment and computers;
• implementation of the measures set out in the Personal Data Protection Act and best practices based on international standards;
• additional security measures – encryption, pseudonymisation, etc.

IXLinks to other websites and information about children

This website may contain links to other websites which we do not operate and whose content we do not endorse. We advise you to review their privacy policies. Body Aesthetics accepts no responsibility for their policies or content.

We do not knowingly collect personal information from children under the age of 16. If we discover that we have collected such information, we will take steps to delete it as soon as possible or to obtain the consent of the person with parental responsibility.

Amendments: We may update this Policy from time to time. Should any changes be made, a notice and the updated version will be published on the website; the updated version will take effect only upon publication.