Privacy policy

1. Data controller

The Skin Revive studio is the trading name of the controller of your personal data:

Controller

НБ Трейдинг ЕООД

Company ID / VAT number

BG205664053

Registered seat

Sofia 1799, Triaditsa district, 108 Knyaz Boris St., shop 10

Email

[email protected]

Phone

0882 06 44 05

2. What data we collect

We collect only the data needed for the purposes below:

• Contact and booking data: name, email, phone, chosen service, time slot and any message you send us.
• Procedure declaration and health information: for every procedure except facial cleansing you complete a declaration. In it and during the consultation you may share information about your health and any contraindications. This is a special category of data; we use it only to judge safely whether and how to perform the procedure.
• Before and after photos: we take and publish photos only with your written consent.
• Reviews: if you leave a review of the studio, we process its content and the name you sign it with.
• Technical data: the website uses cookieless, anonymous statistics (see section 5) and does not track you as an individual visitor.

3. Purposes and legal bases

• Booking and providing the service: we process your data to reserve your appointment and serve you (performance of a contract or steps taken at your request before entering into one, Art. 6(1)(b) GDPR).
• Answering enquiries: we reply to your messages based on your consent or our legitimate interest in handling your request (Art. 6(1)(a) or (f) GDPR).
• Health information: processed with your explicit consent given through the declaration (Art. 9(2)(a) GDPR).
• Marketing: we send news and offers only if you have explicitly opted in (a tick box in the declaration or another clear choice). You can withdraw consent at any time.
• Before and after photos: published only with separate written client consent (Art. 6(1)(a) GDPR). Results are individual and vary from client to client.
• Legal obligations: we keep the documents that accounting and tax law require (Art. 6(1)(c) GDPR).

4. Processors and hosting

To run the website and bookings we use the following providers, which process data on our behalf:

• Cloudflare PagesCloudflare Pages (Cloudflare, Inc.) — hosting and delivery of the website through a network that also serves from the EU, and cookieless anonymous statistics.
• Cal.comCal.com — online booking system: processes your name, email, chosen service and time, and sends confirmations and reminders by email.
• GoogleGoogle — calendar synchronisation (Google Calendar), contact email (Gmail) and the studio's Google profile (Google Business Profile), including the reviews there.

These providers process data only on our documented instructions and under a contract requiring appropriate protection. Where data is transferred outside the European Economic Area, this is done under GDPR safeguards such as standard contractual clauses. We do not sell personal data.

Studio24 is a separate booking channel that runs in parallel. If you book through Studio24, your data is also processed under Studio24's own privacy policy, which is separate from this one.

5. Cookies

This website uses cookieless, anonymous statistics (Cloudflare Web Analytics). It sets no cookies or other identifiers on your device and does not track you across visits. For that reason we do not show a cookie consent banner. If we ever add tracking or marketing cookies, we will ask for your consent first and update this policy.

6. Retention

We keep data only as long as needed for the purpose it was collected for, or as long as the law requires:

• Booking and contact data: [period — to be confirmed by the owner].
• Declarations and health information: [period — to be confirmed by the owner].
• Accounting and tax documents: for the period set by law [period — to be confirmed by the owner].
• Marketing consent: until you withdraw it.
• Before and after photos: until consent is withdrawn or for the period stated in the written consent.

7. Your rights

You have the right to:

• access your personal data and obtain a copy;
• have inaccurate data rectified;
• have your data erased (“right to be forgotten”) where we have no ground to keep it;
• restrict the processing;
• data portability;
• object to processing based on legitimate interest or used for marketing;
• withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise a right, email us at the address in the “Contact” section. We will reply within one month.

If you believe your rights have been infringed, you can lodge a complaint with the Commission for Personal Data Protection (КЗЛД / CPDP), Bulgaria: www.cpdp.bg

8. Contact

For any question about your personal data, contact us:

[email protected] · 0882 06 44 05