Privacy policy

This policy covers visits to mariyaboycheva.eu, contact-form enquiries, shop orders and access to customer and administrator accounts.

Who processes your data

The controller is MIRACLE BODY EOOD, company registration number 206292928, 25B Konstantin Petkanov Street, entrance D, floor 3, apartment 105, Lozenets district, Sofia 1700, Bulgaria. For personal data questions and requests, email mbody.office@gmail.com.

When you contact us

We receive the name and email address you provide, your message and any other information you choose to share. An email address is needed to reply through the form. Please include only information necessary for the conversation.

When requesting a quotation or proposing a contract on your own behalf, your data is used to take the requested pre-contractual steps (Article 6(1)(b) of the General Data Protection Regulation). For general enquiries or when you represent an organisation, the basis is our legitimate interest in answering correspondence and discussing business proposals (Article 6(1)(f)). We use your address for that conversation. The form emails our business inbox and does not create a separate enquiry archive in the website database.

We retain correspondence while dealing with the enquiry. If it becomes part of a contract, dispute or document we must retain, the necessary part is kept until the matter ends and the applicable statutory period expires.

Orders, accounts and delivery

When you order, we process your name, email, selected products, prices and quantities, payment information and order status. Physical delivery also requires the recipient’s details, phone, town or city and address or selected courier office. We use the data to accept and fulfil the contract and notify you about it (Article 6(1)(b)). Guest orders are accessed through a private link, which can reveal purchase details. Keep it safe and do not publish it.

For registration, we process your email and a protected password verification value to provide the requested customer account and purchase history. Account data is kept while you use the account or until you request closure. Deleting an account does not override statutory duties to retain purchase documents.

For each order, we retain details of the purchase and price at confirmation. For the digital guide, we use the order email to send the PDF and provide backup access through the private link. We keep necessary records of the request for early delivery, your acknowledgement and order fulfilment. For withdrawal or complaints, we keep the statement, date, contact details and related correspondence. The bases are performance of the contract and obligations under consumer and accounting legislation (Article 6(1)(b) and (c)). In a dispute, necessary information may be retained to establish or defend legal claims (Article 6(1)(f)). Each document’s retention period depends on its type, the applicable accounting or tax reporting period and any proceedings or dispute.

Technical data and administrator access

When a page loads, the server receives an IP address, time, requested address and technical browser information. The hosting provider may include this in access and error logs. We use technical data to protect forms, diagnose problems and investigate attempted misuse. The basis is our legitimate interest in operating a reliable website and limiting unauthorised access. Log retention depends on the hosting provider’s rotation schedule and any need to investigate a specific incident.

Administrator access involves a business email, protected password verification value and temporary identifiers for sessions, remembered sign-ins or access recovery. These are processed while the account is needed; temporary identifiers have limited validity.

Analytics and advertising

Optional tools load after consent for the relevant purpose (Article 6(1)(a)). Depending on the permitted services, an external provider may receive the visited page’s address, IP address, device data and browser identifier. Available integrations are described in the cookie policy. You may withdraw consent using “Cookie settings” at the bottom of the site. Withdrawal applies to future processing.

Who receives access

The team handling correspondence receives your enquiry. Hosting, email and technical support providers process data necessary for their service. The selected courier receives recipient and parcel details and, for cash on delivery, the amount due. Banks process bank-transfer information. If you choose card payment, card details are entered with payment provider myPOS; the shop receives payment identification and status information. Accounting staff receive necessary reporting documents. External tools you activate also provide data to their providers. Competent authorities may receive data where a legal basis applies. If a provider processes data outside the European Economic Area, you may request information about the country, applicable transfer basis and a copy of the relevant safeguards.

Your rights

You may request access, correction, erasure or restriction of processing. Where processing is automated and based on contract or consent, you may request portability of the data you provided. Where legitimate interests are the basis, you may object on grounds relating to your particular situation.

Describe your request to mbody.office@gmail.com. If identity verification is necessary, we will request only the information needed. We respond within one month of receipt. For complex or numerous requests, this may be extended by up to two months; we will notify you within the first month. You may lodge a complaint with the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592, Bulgaria.