Effective: 17 October 2026
Privacy Policy
Your privacy matters. This policy explains what personal data we collect, on what legal basis we process it, how long we keep it and what rights you have under Regulation (EU) 2016/679 ("GDPR").
1. Data controller
Exsolvo smash & splash Ltd, VAT BG208493198, registered office: Sofia 1233, Serdika district, Fondovi Zhilishta complex, Bulgaria, is the data controller for the purposes of the GDPR and the Bulgarian Personal Data Protection Act. Privacy contact: exsolvoss2025@gmail.com, +359 876 288 818.
2. What personal data we collect
When you book via exolvo.bg or on premises, we collect: full name, email address, phone number, chosen package, booking date and time, payment status and (for online payments) the Stripe Checkout session identifier. When you book online we also record that you ticked the box confirming you have read and agree to the safety rules and the declaration. At the studio every participant also signs a paper safety declaration (see section 3). When you load the site we receive your IP address and standard network metadata via Cloudflare Workers; these are used for routing and security and are not retained in our databases beyond Cloudflare's transient request logs. We do not collect sensitive personal data (health, ethnic origin, political opinions, etc.).
3. Safety declaration signed at the studio
Before each session every participant fills in and signs a paper safety declaration at the studio in Bozhurishte (the form is published on our Safety Rules page). It records your full name, your personal identification number (EGN, or LNCh for foreign nationals), mobile phone number, email address and the date and time of your session. For a participant under 18, the accompanying parent or guardian also enters the minor's full name and age, and signs to consent to their participation and to take responsibility for them on the premises. The declaration also asks two separate yes/no questions: whether you consent to the processing of your personal data for the booking and for safety purposes, and whether you consent to being photographed or filmed during the activity and to the material being published on the studio's social media for advertising. We use the declaration to document that each participant has read and accepted the safety rules, to know who is responsible for a minor, and to establish, exercise or defend legal claims connected with the session (Article 6(1)(f) GDPR, our legitimate interest in the safety of participants and in the defence of claims); the EGN/LNCh is used only to identify the signatory unambiguously. Photos and video are taken and published only if you answer yes (consent, Article 6(1)(a) GDPR); answering no does not affect your session, and you may withdraw your consent at any time by writing to exsolvoss2025@gmail.com. Signed declarations are kept on paper at the studio, accessible only to authorised staff, for as long as these purposes and the applicable limitation periods require, and are then destroyed.
4. Legal basis for processing
Booking PII is processed under Article 6(1)(b) GDPR — performance of a contract to which you are a party (providing the service you booked). The safety declaration is covered in section 3. Anti-bot protection via Cloudflare Turnstile and aggregate analytics via Google Tag Manager are processed under Article 6(1)(f) — our legitimate interest in preventing abuse and maintaining/improving the site. For analytics you may object at any time via the cookie banner (see section 6).
5. Cloudflare Turnstile (mandatory anti-bot check)
Every submission of the public booking form is required to pass a Cloudflare Turnstile check. This check is a technical precondition for accepting a booking — without a valid Turnstile token, the request is rejected with the message "Security check failed". Cloudflare, Inc. (based in the United States) acts as a data processor and is certified under the EU/US Data Privacy Framework. Cloudflare's own privacy disclosures are available at https://www.cloudflare.com/privacypolicy/. The widget operates in invisible mode: it validates that you are human in the background — using signals such as your interaction patterns and browser/device characteristics — without presenting a visible challenge in most cases. As a condition of using invisible mode, Cloudflare requires us to reference its Turnstile Privacy Addendum, which describes this specific processing; it is available at https://www.cloudflare.com/turnstile-privacy-policy/. The Turnstile check cannot be disabled — opting out is equivalent to declining the online-booking channel; you may book by phone or in person instead.
6. Google Tag Manager & analytics (opt-out model)
Every page of exolvo.bg loads Google Tag Manager, which — when consent is granted — activates Google Analytics 4 and similar tools that measure traffic, page views and successful bookings. We operate an opt-out model: on your first visit the analytics_storage state is "granted" and analytics is active. The "Decline" button in the cookie banner at the bottom of the screen lets you disable analytics at any time — your choice is stored in the cookie_consent cookie for up to 12 months, and a consent update command with the value "denied" is sent to GTM, stopping all analytics measurement on subsequent page loads. The "Accept All" button preserves the current granted state. Google Tag Manager and Google Analytics 4 are provided by Google Ireland Limited (Ireland); the data may also be transferred to Google LLC (USA), which is certified under the EU/US Data Privacy Framework. Google Analytics 4 does not log or store your IP address.
7. Google Maps (embedded map)
The Locations page shows the studio on an embedded Google Maps map. The map loads from Google's servers when you open that page, so your browser sends Google Ireland Limited (Ireland) and Google LLC (USA) its IP address and technical information about your browser and device; Google may also set its own cookies. Google processes this data as an independent controller under its own privacy policy (https://policies.google.com/privacy), and Google LLC is certified under the EU/US Data Privacy Framework. The legal basis is our legitimate interest in showing how to reach the studio (Article 6(1)(f) GDPR). The studio address is also written out on that page, so you can find it without the map.
8. Transactional email
After a successful booking we send two transactional emails: a confirmation to you and an operational alert to studio staff. Delivery is handled by Resend (Resend, Inc., USA) as a data processor. We do not use your email for marketing communications without separate, explicit consent.
9. Retention period
Your name, email address and phone number are erased from the booking record automatically 12 months after the booking date. The rest of the record (package, date and time, payment status and the Stripe payment reference) no longer contains your contact details and is retained for 5 (five) years after the year of the completed session or the last payment, in line with the Bulgarian Accountancy Act. Signed safety declarations are kept as described in section 3. The cookie_consent cookie is kept for up to 12 months, the theme cookie for up to 12 months. The admin_session cookie (staff only) expires after 7 days.
10. Your rights
As a data subject you have the following GDPR rights: access; rectification of inaccurate data; erasure ("right to be forgotten") where the legal basis for processing no longer applies; restriction of processing; data portability in a machine-readable format; objection to processing carried out on the basis of legitimate interest (e.g. analytics opt-out — exercised via the cookie banner); and the right to lodge a complaint with the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd, Sofia, https://www.cpdp.bg. To exercise your rights, write to exsolvoss2025@gmail.com — we respond within one month.
11. Cookies
The site uses the following cookies: `theme` (functional — stores your light/dark theme choice); `cookie_consent` (functional — records your analytics choice); `admin_session` (functional, /admin area only — authenticates staff); and the Google Analytics 4 cookies `_ga` and `_ga_VQQVZHKLF7` (analytics, kept for up to 2 years — subject to opt-out via the banner). On the Locations page, the embedded Google Maps map may also set Google's own cookies (see section 7). We do not set advertising or marketing cookies from third parties. You may delete all cookies via your browser settings at any time — doing so also clears your banner choice, and the banner will reappear on your next visit.
You can revisit your choice at any time: