Privacy Policy
DOCUMENT INFORMATION:
| Name | Privacy Policy |
| Document Version | 1.0 |
| Effective Date | 01.07.2026 |
| Revision History |
ABOUT THIS PRIVACY NOTICE
The website https://dermique.bg/ (hereinafter referred to as the “Website”) is a general presentation of the activities of the “Dermique Group” (hereinafter referred to as the “Group”, “We”, “Dermique”), which includes and relates to the services offered by the following commercial companies:
“Dermique” OOD, UIC: 208569169, with headquarters and registered address: Sofia, 1463, Triaditsa district, 89D Vitosha Blvd., fl. 15, apt. 11a (“Dermique” OOD) – a beauty salon performing non-invasive cosmetic and aesthetic procedures for face and body, as well as other standard cosmetic services related to skin maintenance and aesthetic appearance.
“Medical center Dermique” OOD, UIC: 208744394, with headquarters and registered address: Sofia, 1463, Triaditsa district, 89D Vitosha Blvd., fl. 15, apt. 11A – a medical institution providing outpatient medical care.
This Privacy Policy (hereinafter referred to as the “Policy for Processing and Protection of Personal Data”, the “Policy”) applies to users visiting the Website, regardless of which company offers or intends to offer services to the user visiting the Website. This Policy governs how We process personal data in our capacity as a Controller. This Policy for processing and protection of personal data aims to provide detailed legal information regarding the processing of personal data provided in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as “GDPR”).
When the processing of your personal data is carried out jointly by the two commercial companies of the Group (for example, in the case of shared administrative functions), the respective companies act as joint controllers within the meaning of Art. 26 of the GDPR. In these cases, you will be able to obtain additional information about the distribution of responsibilities between them.
BASIC CONCEPTS
“Personal Data” (within the meaning of the GDPR) means any information relating to an identified or identifiable natural person (information that allows someone to identify you directly or indirectly);
“Processing of personal data” (within the meaning of the GDPR) means any operation such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment or combination, restriction, erasure or destruction;
“Data Controller” (within the meaning of the GDPR) means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
“Consent of the data subject” (within the meaning of the GDPR) means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
“Special categories of personal data” (within the meaning of the GDPR) are data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health, data concerning a natural person’s sex life or sexual orientation.
CATEGORIES OF DATA SUBJECTS
We process the personal data of the following categories of data subjects:
Website users – individuals who visit this Website via technical data or cookies;
Individuals making inquiries – individuals making inquiries through the contact form on the Website;
Individuals booking an appointment – individuals booking an appointment for procedures and/or consultations through the appointment booking form on the Website;
Newsletter subscribers – individuals who have provided their name and email address to receive a newsletter.
CATEGORIES OF PERSONAL DATA WE PROCESS, LEGAL BASES AND PURPOSES OF THEIR PROCESSING
We process the following categories of personal data, based on the defined legal bases and for the purposes specified below:
| Category of personal data | Legal basis | Purpose of processing | Source from which the personal data originates |
|---|---|---|---|
| Identification data – name, email address, phone, information provided to us through the “message” field | Legitimate interest of the Controller (Art. 6, para. 1, letter “f”, GDPR) | Processing inquiries received through the contact form on the Website; providing comprehensive feedback regarding your inquiry; evaluation of the services provided | From the data subject providing personal data through the contact form on the Website |
| Name and email address | Consent (Art. 6, para. 1, letter “a”, GDPR) | Sending a newsletter with news about current promotions, new medical services, information about specialists, new partnerships, new initiatives, recommendations, expert content from specialists | From the data subject through the newsletter subscription form on the Website |
| Identification data – name, email address, phone, preferred date and time for consultation, topic of consultation, information provided to us through the “desired procedure” field, information provided to us through the “message” field | Consent (Art. 9, para. 2, letter “a”, in conjunction with Art. 6, para. 1, letter “a”, GDPR) | Providing assistance to book an appointment for cosmetic services (procedures), medical consultations and examinations or other health services | From the data subject through the appointment booking form on the Website |
| IP address, browser type and version, operating system, date, time and duration of the visit, visited pages, traffic source | Necessary (functional) cookies — legitimate interest (Art. 6, para. 1, letter “f”, GDPR); Analytical cookies — consent (Art. 6, para. 1, letter “a”, GDPR); Marketing cookies – consent (Art. 6, para. 1, letter “a”, GDPR) |
Ensuring the technical functionality and security of the Website; Analysis of traffic and user behavior for statistical purposes; Creating user profiles to send advertisements or to track the user on a specific website or across several websites for similar marketing purposes |
Automatically upon visiting the site – via cookies and server logs; From the data subject |
| Cookie preference (accept/reject), newsletter subscription status | Legitimate interest (Art. 6, para. 1, letter “f”) | Remembering the user’s choice; preventing the subscription pop-up window from reappearing | Automatically — via cookies |
DATA RETENTION PERIODS
Personal data is stored only as long as necessary to achieve the purpose for which it is processed. A complete list of the purposes for which we process personal data can be found above.
Personal data is stored until the expiration of all legally applicable retention periods.
Retention periods according to the different categories of personal data we process:
The data provided to us through the contact form on the Website is stored for up to 12 months from the last contact;
The name and email address provided to us through the newsletter subscription form on the Website are stored until consent is withdrawn;
For marketing communications purposes, personal data is stored until the given consent is withdrawn or upon the expiration of 3 years during which there has been no activity in the person’s profile;
For the purpose of reservations, booking appointments for examinations, and responding to inquiries, logs and cookies are stored for up to 12 months;
Personal data may be stored for a longer period when necessary for the establishment, exercise or defense of legal claims, with the period not exceeding the applicable limitation periods according to current legislation.
After the expiration of the respective retention periods, We delete your personal data.
SHARING OF PERSONAL DATA
We protect the confidentiality of your personal data. Subject to legal requirements, it is possible that we provide access to your personal data to the following categories of data recipients:
IT service providers, software companies responsible for the maintenance of the Website;
Cloud service and data storage providers;
State supervisory and control bodies, judicial and investigative authorities, including external auditors;
Regional health inspectorates and other non-financial institutions.
RIGHTS OF DATA SUBJECTS
As a data subject, you have the following rights:
| Right to information | You have the right to be informed about the personal data we process about you and how we process it. You can obtain information through: • This Policy; • The information we provide you when using our Services; • By sending an inquiry to our contact email. See how to contact us here. |
| Right of access | You have the right to request to review or access the personal data we process about you. To access your personal data, you can contact us. See how to contact us here. |
| Right to rectification | You have the right to request the correction or update of the data we process about you when it is inaccurate or incomplete. You can request the correction of your personal data by contacting us. |
| Right to erasure | You have the right to request the erasure of your personal data when: • The personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed; • You withdraw your consent on which the processing is based and there is no other legal ground for the processing; • You object to the processing and there are no overriding legitimate grounds for the processing; • The personal data has been unlawfully processed; • The personal data has to be erased for compliance with a legal obligation in Union or Member State law to which We are subject; • The personal data has been collected in relation to the offer of information society services directly to a child under Art. 8, para. 1, GDPR. Sometimes it is possible that we refuse the erasure of your personal data. For example, when: • The personal data is necessary for exercising the right of freedom of expression and information; • It is still necessary to process the data for the purpose for which we collected it; • We have a legitimate interest to process it that overrides your interest in erasure. For example, to protect against fraud. • There is a legal obligation for Us to retain the data. • The data is necessary for us to establish, exercise or defend legal claims. To delete your personal data, you can contact Us. You can see more about the retention periods in the “DATA RETENTION PERIODS” section. |
| Right to restriction | You have the right to request that we restrict the processing of your personal data under one of the following conditions: • You contest the accuracy of the personal data. In this case, the restriction of processing is for a period enabling us to verify the accuracy of the personal data; • The processing is unlawful but you oppose the erasure of the personal data and request the restriction of its use instead; • We no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims; • You object to processing pending the verification whether Our legitimate grounds override your interests, rights and freedoms or are necessary for the establishment, exercise or defense of legal claims. You can request restriction of the processing of your personal data by contacting Us. |
| Right to object | You have the right to object to the processing of your personal data when: • We process your personal data on the basis of legitimate interest, or • We process your personal data for the purposes of personalized advertising (direct marketing). You can object to the processing of your personal data by contacting Us. |
| Right to portability | You have the right to receive your personal data in a structured, commonly used and machine-readable format and have the right to transmit those data to another Controller without hindrance from Us, where the processing is based on consent or on a contractual obligation and the processing is carried out by automated means. You can exercise your right to portability by contacting Us. |
| Right not to be subject to an automated decision | You have the right not to be subject to a decision based solely on automated processing (decisions taken without human intervention), including profiling, which produces legal effects concerning you or similarly significantly affects you. We do not carry out automated decision-making. |
| Withdrawal of consent | You have the right to withdraw the given consent for the processing of your personal data when the legal basis for the processing is consent within the meaning of the GDPR. The withdrawal of your consent shall not affect the lawfulness of processing your personal data by Us based on consent before its withdrawal. Consent can be withdrawn in a manner similar to how it was given. For example, by unsubscribing from an email newsletter or by contacting Us. |
| Right to lodge a complaint | You have the right to lodge a complaint with a competent supervisory authority if you believe that your rights have been violated. You can find the contact details of the competent supervisory authority here. |
COOKIES
The site uses necessary (functional) cookies, analytical cookies (Google Analytics) and marketing cookies (Google Ads, Meta Pixel). You can manage your preferences from the consent banner or your browser settings.
If you have given marketing consent, the contact details you enter in the booking form (email and phone, in hashed form using SHA-256) and technical identifiers (such as IP address, browser type and ad click IDs) are sent to Meta so we can measure the results of our ads.
DATA PROTECTION
We take the privacy and security of your personal data seriously, including information considered sensitive. Our cybersecurity team works actively to maintain the integrity, confidentiality, and availability of our Services, and Our policies and protocols are aimed at protecting your personal data. We continuously strive to improve the protection of our systems. However, no method of data transmission over the internet or method of electronic storage is completely secure and We cannot guarantee the security of your personal data. Our security, safety, and privacy features are provided on an “as is” basis. As such, their effectiveness and error-free functioning cannot be guaranteed and we cannot ensure absolute confidentiality, anonymity, or personal safety.
In the event that we are legally required to inform you of unauthorized access to your personal data, we may notify you electronically or in writing in accordance with applicable legislation.
COMPETENT PERSONAL DATA PROTECTION AUTHORITY
Authority: Commission for Personal Data Protection (CPDP)
Website: https://www.cpdp.bg/
Email: [email protected]
Address: Sofia, 1592, 2 Prof. Tsvetan Lazarov Blvd.
You can find a complete list of data protection authorities in the EU here.
HOW TO CONTACT US
We welcome your comments, questions or complaints regarding this Privacy Policy, the use of your personal data, or our response to your requests concerning the processing of your personal data. Please contact Us using the following contact details:
Website: https://dermique.bg
Email: [email protected]
Contact phone: +359 888 79 89 99
CHANGES TO THE PRIVACY POLICY
The most current version of the Policy will govern our use of your personal data. We may revise this Policy periodically. Notifications regarding changes to the Privacy Policy are sent to the data subject via email or provided in writing.