Privacy Policy

1. Data Controller

ARETI-TOMOS Ltd. (EOOD), UIC: 200309385, VAT: BG200309385, registered address: 63 Krum Popov St., fl. 3, apt. 6, 1421 Sofia, Bulgaria.

Email: info@areti.bg | Phone: +359 878 521 660

The company has not appointed a Data Protection Officer (DPO). For all data-related inquiries, contact: info@areti.bg.

2. Data We Collect

Personal data you provide: name, phone, email address, wedding date, and notes when booking a fitting appointment.

Automatically collected data: IP address, browser type, operating system, pages visited, visit duration — via cookies and Google Analytics.

Visit source: when you book an appointment we record which channel brought you to the site (e.g. an ad, search engine, social network or direct), using UTM parameters and referrer data. This helps us judge which marketing channels work. It is stored alongside the request and is not used for individual profiling.

We do not collect sensitive personal data (health, biometric, genetic).

3. Purpose of Processing

Organizing and managing fitting appointment reservations at our salon.

Communicating with you regarding your reservation or inquiry.

Improving our website and user experience through traffic analysis.

Sending marketing communications (only with your explicit consent). Newsletter subscription uses double opt-in confirmation.

4. Legal Basis

We process your data based on: (a) your consent — when booking or subscribing to our newsletter; (b) contract performance — when providing our services; (c) legitimate interest — for improving our site and services.

5. Third-Party Sharing

We do not sell your personal data. We may share it with: Google (Analytics), Brevo (email marketing), Facebook (advertising pixels) — only when you have consented to cookies.

All third parties are obligated to comply with GDPR and process your data solely for the stated purposes. We have concluded data processing agreements (DPAs) with all processors in accordance with Art. 28 GDPR.

5a. International Data Transfers

Some of our service providers (Google LLC, Meta Platforms Inc.) may transfer data to the United States. These transfers are based on the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) approved by the European Commission.

6. Data Retention

Reservation data is stored for up to 12 months after the appointment date. Newsletter data — until unsubscription. Analytics data — up to 26 months (Google Analytics).

7. Your Rights

Under GDPR you have the right to: access your data; rectify inaccuracies; erasure ("right to be forgotten"); restrict processing; data portability; object to processing.

You have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7(3) GDPR).

To exercise your rights, send a request to info@areti.bg. We will respond within 30 days.

8. Cookies

We use cookies for site functionality, traffic analysis, and marketing. You can manage your preferences via the cookie banner or our cookie policy page.

9. Security

We apply appropriate technical and organizational measures to protect your data — encrypted connection (HTTPS), restricted access, regular software updates.

10. Complaints

If you believe your rights have been violated, you may file a complaint with the Commission for Personal Data Protection (CPDP): 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, cpdp.bg.