Privacy
Privacy Policy
Effective from 13 September 2026
This policy describes how Devine 27 EOOD processes the personal data of visitors to the website hifubg.com and of representatives of the beauty studios and salons it works with, in accordance with Regulation (EU) 2016/679 and the Personal Data Protection Act. This English version is provided for convenience; if it differs from the Bulgarian version, the Bulgarian version prevails.
1. General provisions
Art. 1. (1) This Privacy Policy (hereinafter the "Policy") sets out the purposes, grounds and procedure for the processing of personal data by Devine 27 EOOD in connection with the use of the website hifubg.com (hereinafter the "Website") and with the offering of devices, training, warranty and after-sales service to beauty studios and salons under the trade mark HIFU by Denny Divine.
(2) This Policy has been drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter the "Regulation"), the Personal Data Protection Act and the Electronic Communications Act.
Art. 2. For the purposes of this Policy:
- "Controller" means Devine 27 EOOD, whose details are set out in Art. 3;
- "Data subject" or "User" means any natural person whose personal data are processed, including a visitor to the Website, a person who has submitted an enquiry, and a contact person or employee of a Partner;
- "Partner" means a beauty studio, salon or other person with whom the Controller has concluded, or is negotiating, a contract;
- "Personal data" means any information relating to an identified or identifiable natural person.
2. Controller
Art. 3. The controller of personal data is Devine 27 EOOD, UIC 204293645, with its registered office and address of management at 70A Sveti Naum Blvd, Lozenets, 1421 Sofia, represented by Denica Voynova. Demonstrations and training sessions take place at the showroom at 70A Sveti Naum Blvd, 1421 Sofia.
Controller contact details
Devine 27 EOOD
UIC 204293645
Registered office and address of management: 70A Sveti Naum Blvd, Lozenets, 1421 Sofia
Phone: +359 88 899 8556 (Denny Divine Aesthetic Center), +359 88 887 6997 (The Temple of Beauty by Denny Divine)
Email: info@hifubg.com
Art. 4. Requests and questions concerning the processing of personal data shall be sent to the Controller by email at info@hifubg.com or in writing to the address of management, marked "Personal data".
3. Principles of Processing
Art. 5. The Controller processes personal data in compliance with the principles set out in Art. 5 of the Regulation: lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; accountability.
Art. 6. (1) The provision of personal data is voluntary.
(2) If the data on the legal entity and the contact person are not provided, the Controller cannot prepare a quotation, issue an invoice, certificate or warranty card, or conclude and perform the contract.
4. Categories of Personal Data and Sources
Art. 7. The Controller processes the following categories of personal data:
- contact person data: name, position, phone number and email address;
- legal entity data: name, UIC, address and billing details;
- data contained in an enquiry: the device or subject of the enquiry and the content of the free-text field;
- contract data: the device supplied, delivery date, serial number and warranty period;
- training data: the persons trained and the date of the training, needed to issue and verify a certificate;
- data on service requests and the work carried out under them;
- video recordings from the video surveillance system;
- technical data collected when visiting the Website: IP address, date and time of access, page requested and browser type.
Art. 8. Personal data are collected directly from the data subject or from the Partner they represent: when visiting the Website, when sending an enquiry, during a phone call, when concluding and performing a contract, and when visiting the showroom.
5. Processing When Using the Website
Art. 9. (1) The Website is hosted by SuperHosting.BG EOOD, UIC 131449987, with its registered office and address of management at 5 Nikola Tesla St, 4th floor, Sofia. On each visit the server automatically records technical data (IP address, date and time of access, page requested and browser type) in a system log, which is used to keep the Website secure and working properly. The Controller does not use these data to identify visitors.
(2) The Website's fonts are loaded from Google Fonts, and parts of the program code from cdn.jsdelivr.net and unpkg.com. To deliver these files, the providers receive the visitor's IP address; they do not set cookies.
(3) Cookies and similar technologies that are not strictly necessary are used only with the User's explicit consent. The terms are set out in the Cookie Policy.
Art. 10. (1) The enquiry form sends the data entered to the Controller's e-mail via the Website's server. The data is not stored in a database on the Website.
(2) The following data is provided through the form: name, telephone number, e-mail address, the device or subject of the enquiry, and free text.
(3) The form can be submitted only after ticking a checkbox by which the User confirms that they have read this Policy and consents to the Controller contacting them using the contact details provided. The date and time of the consent are included in the message received.
6. Showroom visits and video surveillance
Art. 11. (1) Demonstrations and training sessions take place in the Controller's showroom. The purpose of a demonstration is to show how the device works, and no file on the visitor is created as a result.
(2) Video surveillance is carried out at the entrance and in the common areas of the showroom for the protection of persons and property. Persons are informed of the video surveillance by an information sign at the entrance.
(3) Recordings are kept for up to 30 days and are reviewed only in the event of an incident. The legal basis for the processing is the Controller's legitimate interest under Art. 6(1)(f) of the Regulation.
7. Purposes and legal bases
Art. 12. The Controller processes personal data for the following purposes and on the following legal bases:
| Purpose | Data | Legal basis |
|---|---|---|
| Responding to a request for a quote or demonstration | Contact details, content of the enquiry | Taking steps at the request of the data subject prior to entering into a contract, Art. 6(1)(b) of the Regulation |
| Conclusion and performance of a contract, delivery and installation | Data on the legal entity and the contact person | Performance of a contract, Art. 6(1)(b) |
| Training and issuing certificates | Data on the persons trained | Performance of a contract, Art. 6(1)(b) |
| Warranty and service support | Contract and service request data | Performance of a contract and legal obligation, Art. 6(1)(b) and (c) |
| Handling requests and complaints, defense in disputes | The data necessary for the purpose | Legitimate interest, Art. 6(1)(f) |
| Accounting and tax obligations | Data in accounting documents | Legal obligation, Art. 6(1)(c) |
| Protection of persons and property | Video recordings | Legitimate interest, Art. 6(1)(f) |
| Statistics and advertising through cookies | Cookie data | Consent, Art. 6(1)(a), in conjunction with Art. 4a of the Electronic Communications Act |
| Building advertising audiences | Telephone number and e-mail address, converted into a hash | Consent, Art. 6(1)(a) |
8. Retention periods
Art. 13. Personal data is retained for the following periods:
| Data | Period |
|---|---|
| Enquiry that did not lead to a contract | Up to 12 months from the last correspondence |
| Data relating to the contract, delivery, warranty and service | Up to 5 years after the warranty period expires |
| Training and certificate data | For the period of validity of the certificate and 5 years thereafter |
| Accounting documents | In accordance with the Accountancy Act, as a rule 10 years |
| Video recordings | Up to 30 days |
| Cookie choices | Up to 12 months |
Art. 14. After the periods under the preceding Article expire, the data is erased or anonymized in a way that does not allow the data subject to be identified.
9. Recipients of personal data
Art. 15. (1) The Controller's employees have access to personal data to the extent necessary to perform their duties. Employees are bound by an obligation of confidentiality.
(2) The Controller may disclose personal data to the following processors and recipients:
- SuperHosting.BG EOOD, UIC 131449987, with registered office and address of management at 5 Nikola Tesla St, fl. 4, Sofia, as the provider of hosting, domain and e-mail services;
- providers of software and of maintenance for the Controller's information systems;
- undertakings providing electronic communications services;
- an accountant with whom the Controller has a contract;
- courier companies and persons carrying out installation when a device is delivered;
- the advertising platforms listed in the section "Advertising and advertising audiences".
(3) Personal data is disclosed to public authorities, courts and auditors where this is provided for by law or is necessary for the establishment, exercise or defense of the Controller's legal claims.
(4) The Controller does not sell personal data or disclose it to third parties for payment.
10. Advertising and advertising audiences
Art. 16. (1) The Controller advertises its services through the platforms of Meta Platforms (Facebook and Instagram), Google and OpenAI (ChatGPT Ads).
(2) The advertising pixels on the Website are activated only after the User consents to advertising cookies. They are described in the Cookie Policy.
Art. 17. (1) The Controller may disclose the e-mail addresses and telephone numbers of partners' contact persons and of persons who have made an enquiry to the advertising platforms for the purpose of building advertising audiences (Custom Audiences in Meta, Customer Match in Google and list-based audiences in ChatGPT Ads), in order to show relevant advertising or to exclude them from advertising.
(2) Before disclosure, the data is converted into an irreversible cryptographic fingerprint (hash). The platform compares fingerprints and does not receive the data in readable form.
(3) The processing under para. 1 is based on consent requested when the contact details are collected. Consent may be withdrawn at any time by a message to info@hifubg.com, and the data is removed from the advertising audiences within 30 days.
11. Transfers of data outside the European Union
Art. 18. (1) Google, Meta Platforms and OpenAI are companies established in the United States of America; therefore, personal data may be transferred outside the European Union when their services are used.
(2) Transfers are based on the European Commission's adequacy decision under the EU-U.S. Data Privacy Framework and, where that decision does not apply, on standard contractual clauses adopted by the European Commission. The data subject may request a copy of the applicable safeguards.
(3) The Website's hosting and the Controller's e-mail are provided by a company registered in the Republic of Bulgaria.
12. Security measures
Art. 19. The Controller implements appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. Only persons who need the data to perform their duties and who are bound by an obligation of confidentiality have access to it. Processors act on the basis of a written contract with the Controller. The measures are reviewed and updated periodically.
13. Rights of data subjects
Art. 20. (1) The data subject has the following rights:
- the right of access to their personal data (Art. 15 of the Regulation);
- the right to rectification of inaccurate or incomplete data (Art. 16);
- the right to erasure ("right to be forgotten") (Art. 17);
- the right to restriction of processing (Art. 18);
- the right to data portability (Art. 20);
- the right to object to processing based on legitimate interest, including profiling for direct marketing purposes (Art. 21);
- the right to withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal (Art. 7(3)).
(2) The rights are exercised by a request to the Controller in accordance with the procedure under Art. 4.
(3) The Controller responds to the request free of charge within one month of receiving it. Taking into account the complexity and number of requests, this period may be extended by two further months, and the data subject is informed of this within the first month.
Art. 21. The data subject has the right to lodge a complaint with the supervisory authority:
Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia
Phone: 02 915 3518
E-mail: kzld@cpdp.bg
Website: www.cpdp.bg
14. Final provisions
Art. 22. (1) The Controller may amend this Policy. The current version is published on the Website, stating the date from which it is effective.
(2) In the event of a material change, including the introduction of a new type of processing based on consent, the Controller requests new consent from the data subjects.
Art. 23. This Policy is effective from 13 September 2026.