Privacy policy

EVA DAVA LTD EOOD (ЕВА ДАВА ЕООД), 9 Gen. Gurko St., fl. 1, 8000 Burgas, Bulgaria, represented by its managing director Alexander Kuguk. Email: hello@evadava.com.

We have not appointed a data protection officer, as we are not legally required to.

We process personal data only as far as needed to run this website, answer your requests and provide our services. We collect the data directly from you.

This website sets no cookies and uses no analytics, tracking or advertising services. Online booking and online payment are not currently set up.

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit it, Vercel processes technically necessary data (IP address, date and time, page requested, browser information) to deliver the site securely and reliably. Vercel acts as our processor under a data processing agreement.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is secure and reliable operation of the website. Vercel is certified under the EU-US Data Privacy Framework, and the transfer to the USA relies on the related EU adequacy decision (Art. 45 GDPR). Vercel deletes log data after [FILL IN: retention period under the Vercel plan].

When you use the contact form, we process your name, email address and message to reply to you. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before a contract). We can't reply without your name, email address and message.

If your message contains information about your health, we process it only based on your explicit consent (Art. 9(2)(a) GDPR), which you give by ticking the box in the form. Please don't include detailed health information in the form. We'll discuss it in person.

The form data is passed by a server function at Vercel to the bot interface of the Telegram messenger and delivered to our managing director's Telegram account. Telegram is provided by Telegram FZ-LLC, Dubai, United Arab Emirates (UAE). The message is stored on Telegram's servers and is not end-to-end encrypted. Telegram processes the data under its own terms; there is no data processing agreement with Telegram.

There is no EU adequacy decision for the UAE, and no appropriate safeguards under Art. 46 GDPR are in place. This carries risks: the level of data protection may be lower than in the EU, public authorities could access the data, and your rights may be hard to enforce there. The transfer therefore takes place only with your explicit consent under Art. 49(1)(a) GDPR, which you give by ticking the box in the form. If you don't want to consent, simply email us at hello@evadava.com.

Requests that don't lead to a contract are deleted no later than 12 months after our last contact.

If you write to us directly on Telegram (t.me/alex_kuguk) or by email, we process the data you send to handle your request (Art. 6(1)(b) GDPR). Telegram's own privacy policy applies to its processing, as you use it yourself in this case. Messengers are of limited suitability for sensitive health information.

Section 4 applies to retention accordingly.

To provide sessions, we process your contact details, appointments, invoicing and payment data and session notes (Art. 6(1)(b) GDPR). We process health-related information only with your explicit consent, which we obtain separately and in writing before we start working together (Art. 9(2)(a) GDPR).

Online sessions take place via [FILL IN: provider, location and legal basis for any transfer outside the EU]. Sessions are never recorded without your express consent.

Recipients: the video platform provider, our bank [FILL IN: bank or payment service] and our accountant [FILL IN: accountant or tax adviser], each only as far as necessary.

Retention: session notes are kept for [FILL IN: number] years after our work ends and then deleted. Invoices and accounting records are kept for 10 years from 1 January of the following year under Art. 12 of the Bulgarian Accountancy Act (Art. 6(1)(c) GDPR).

Fonts and images are served from our own hosting. No connection is made to Google Fonts or other third parties.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20 GDPR). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR); processing before the withdrawal remains lawful. A short email to hello@evadava.com is enough.

Right to object: where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can lodge a complaint with a data protection authority, in particular in the EU country where you live. Our competent authority is the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, Bulgaria, email: kzld@cpdp.bg, www.cpdp.bg.

We don't use automated decision-making or profiling.

We update this notice when the website or our processes change, for example when online booking or payment is introduced. The version published here applies.