Legal information

Privacy Policy

Last updated: 13.10.2026

This Privacy Policy explains what personal data АШЛИ ШЕЙПС ЕООД (ASHLEY SHAPES EOOD) (hereinafter the “company”, “we”, “us”) collects and processes through the website ashleyshapes.com (hereinafter the “Website”), why we process it, on what legal basis, how long we keep it and what rights you have in relation to it, in accordance with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act.

1. Who processes your data (data controller)

The data controller is:
АШЛИ ШЕЙПС ЕООД (ASHLEY SHAPES EOOD)
Company ID (EIK): 208609440
Registered address: Bulgaria, Sofia (1360), Vrabnitsa district, 42 “Anton Ketskarov” St., floor 4, apt. 18
Email for data-related questions: info@ashleyshapes.com
Phone: +359 888 084 855

2. What personal data we collect

2.1 Data you enter yourself

• When you fill in the enquiry form on the Website: name, email address, phone number (optional), preferred location and the content of your message.
• If you voluntarily share information about your health, injuries or rehabilitation in your message, this information is processed only on the basis of your explicit consent, expressed by submitting it, and solely for the purpose of replying to you appropriately.

2.2 Data collected automatically

• Standard technical data from our hosting provider (IP address, browser type, date and time of visit) — for security and the normal operation of the Website.
• The Website loads fonts from Google Fonts. This provider may receive technical information (e.g. IP address) when the page loads, in accordance with its own privacy policy.
• The Website displays the latest posts from our Instagram profile @ashleyshapes. The posts are retrieved by our server, and the images are loaded from Instagram’s (Meta’s) servers. Meta may therefore receive technical information (e.g. IP address) when the page loads, in accordance with its own privacy policy. We do not share with Meta any personal data you have entered with us.

2.3 Bookings through Reservation.Studio

Sessions are booked through the system of a third party — Reservation.Studio. When you book a session, your data (name, phone, email, selected service) is entered directly into their system and processed by Reservation.Studio as an independent data controller, in accordance with their privacy policy. We do not keep a copy of this data on our own servers.

3. For what purposes and on what legal basis we process your data

• Replying to enquiries — to reply to a message sent through the contact form. Basis: Art. 6(1)(b) GDPR (taking steps at the request of the data subject prior to entering into a contract) and/or point (f) (legitimate interest in answering customer enquiries).
• Health data shared voluntarily — basis: Art. 9(2)(a) GDPR (explicit consent, given by submitting the message).
• Security and technical maintenance of the Website — basis: Art. 6(1)(f) GDPR (legitimate interest in protection against abuse and technical stability).
• Compliance with legal obligations — e.g. accounting or tax requirements, where applicable.

Currently the Website does not use cookies for analytics or advertising and does not carry out profiling. If this changes, this policy will be updated and we will ask for your consent where necessary.

4. Who we share your data with

• Hosting provider — technical storage of the Website and the database of enquiries.
• Reservation.Studio — for the data you enter directly into their booking system (see section 2.3).
• We do not sell or rent your personal data to third parties for marketing purposes.
• Some of our providers (e.g. Google, whose fonts we load) may process technical data on servers outside the European Economic Area, subject to appropriate safeguards under the GDPR (e.g. standard contractual clauses).

5. Retention period

Messages sent through the contact form are kept for up to 12 months from receipt, unless a longer period is required by law or is necessary to resolve a dispute. After this period the data is deleted or anonymised.

6. Your rights

Under the GDPR you have the right to:

• request access to your personal data;
• request correction of inaccurate data;
• request erasure of your data (“right to be forgotten”);
• request restriction of processing;
• object to processing based on legitimate interest;
• request data portability, where applicable;
• withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal;
• lodge a complaint with the supervisory authority.

To exercise these rights, write to us at info@ashleyshapes.com.

7. Supervisory authority

Commission for Personal Data Protection (CPDP)
Address: 2 “Prof. Tsvetan Lazarov” Blvd., Sofia 1592
Phone: +359 2 915 3518
Email: kzld@cpdp.bg
Website: www.cpdp.bg

8. Data security

We apply appropriate technical and organisational measures (encrypted HTTPS connection, restricted access to the database, regular updates) to protect your data against loss, misuse or unauthorised access.

9. Data of minors

The Website is not aimed at persons under 16 years of age. Minors are enrolled in training only with the knowledge and consent of a parent or guardian, who provides the necessary data.

10. Changes to this policy

We may update this policy from time to time to reflect changes in how we process data or in applicable legislation. The current version is always available on this page.

11. Contact

For questions about this policy or the processing of your personal data, contact us at info@ashleyshapes.com or on +359 888 084 855.