Privacy Policy

1. Data Controller

Company name: BAIA EOOD
UIC (EIK): 200722428
Managing Director: Ivan Keskinov
Address: Sofia, Lyulin district, bl. 422, apt. 28
Country: Bulgaria
Phone: +359 888 46 78 48
E-mail: ivan_keskinov@abv.bg

2. Location of activities

Training takes place in the waters of the Nestinarka Surf School water base, Nestinarka Beach, Tsarevo Municipality, approved by the Bulgarian Maritime Administration Executive Agency under No. 2523. The water base is operated by Nestinarka Surf School, BAIA EOOD, UIC: 200722428.

3. What data we collect

Through the forms on our website, we collect the following personal data provided voluntarily by you:

• First and last name
• Email address
• Phone number
• Delivery address (when ordering a voucher)
• Free-text message (when submitting a request)

4. Purposes of processing

Your personal data is processed for the following purposes:

• Processing activity booking requests
• Processing gift voucher orders
• Communication regarding submitted requests

5. Legal basis

The processing of your personal data is carried out on the basis of your consent (Art. 6(1)(a) GDPR) and for the performance of a contract or in order to take steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR).

6. Retention period

Your personal data is retained for the period necessary to fulfill the purposes for which it was collected, but no longer than 2 (two) years after your last activity, unless legislation requires a longer period.

7. Your rights

Under the GDPR, you have the following rights:

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure (right to be forgotten)
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time

To exercise your rights, please contact us by phone at +359 888 46 78 48.

8. Disclosure of data to third parties

We do not share your personal data with third parties unless it is necessary for the performance of the service or required by law.

9. Data protection

We apply appropriate technical and organizational measures to protect your personal data from unauthorized access, loss, or destruction.

10. Complaints

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP) at: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., or at www.cpdp.bg.