Privacy Policy

Last updated: 26.09.2026

1. Introduction

This policy explains how Foxy Aesthetics OOD processes personal data when you use the website https://foxyaesthetics.net, make an online booking, communicate with us, or receive our services. It explains the purposes of processing, data retention periods, and your rights under the General Data Protection Regulation (GDPR).

2. Data Controller

Foxy Aesthetics OOD

UIC: 207904643

Address: 13 Ekzarh Yosif Street, Burgas, Bulgaria
Email for enquiries regarding personal data: [email protected]

3. What Data We Collect

Depending on the services you use, we may process:

  • your name, telephone number, and any email address or comment you provide;
  • information you send us when making an enquiry or in other correspondence;
  • information you send us when making an enquiry or in other correspondence;
  • technical data required for the operation and security of the website, including your IP address and information about requests and your browser;
  • where you have consented to analytics — pages visited, interactions with booking buttons, booking stages reached, referral source, language, device type, and a random session identifier;
  • photos and video materials published on an appropriate legal basis, as well as public reviews and related information about their authors.

Required fields in the online booking form are clearly marked. Without the necessary information, we cannot process your booking.

Please do not enter health information or other sensitive personal data in the free-text fields of the form.

4. Legal Basis for Processing

We process personal data on the following legal bases:

  • for processing an appointment request and providing a service — taking steps at your request prior to entering into a contract and performing a contract;
  • for optional analytics and consent-based publications — your consent;
  • for website security, technical diagnostics, and maintaining the necessary service history for repeat visits — our legitimate interests, taking into account your rights and reasonable expectations;
  • for compliance with applicable legal obligations — the relevant legal basis.

Consent to analytics is separate from the processing of data necessary for your booking.

5. Purposes of Processing

We use the data for:

  • organising and managing bookings;
  • providing services and maintaining a history of procedures;
  • responding to enquiries and sending service-related messages about bookings;
  • improving the website and online booking process through analytics after consent has been given;
  • preventing misuse, resolving technical issues, and restoring the website;
  • complying with legal obligations and establishing, exercising, or defending legal claims.

Data provided for a booking does not, by itself, constitute consent to receive marketing communications.

6. Cookies and Similar Technologies

The website uses necessary technical storage for essential functions, remembering privacy preferences, and securely displaying booking confirmations.

With your consent, we use analytics technologies to understand how visitors use the website and the online booking process.

Analytics does not record the contents of contact fields, SMS codes, or video recordings of visits.

You may refuse optional analytics without affecting your ability to use the website or book an appointment. You can change your choice through the cookie settings.

Details of individual cookies, their purposes, and retention periods are available in the preferences panel.

The website displays an external map and public customer reviews. When external resources are loaded, the relevant providers may receive technical connection data, including your IP address. Public reviews may contain the author’s name, profile image, rating, text, and photos.

7. Data Recipients

Where necessary for the relevant purpose, data may be disclosed to:

  • the hosting and technical infrastructure provider;
  • the provider of the online booking and customer data management system;
  • providers of service notifications and email services;
  • providers of cookie preference management and security services;
  • providers of external maps and public reviews;
  • authorised persons providing technical or accounting services;
  • competent authorities where required by law.

Access is limited to what is necessary for the relevant task.

8. Data Retention and Security

We retain client profiles and treatment history for 3 years after the last visit. Detailed analytics data and technical reports relating to online bookings are retained for up to 90 days, aggregated analytics reports for up to 13 months, and security-related event logs for up to 30 days.

After the applicable retention periods expire, the data is deleted or irreversibly anonymised, unless further retention is necessary to comply with a legal obligation or to establish, exercise, or defend legal claims.

We protect data through restricted access, secure connections, and backups. Backup copies are rotated periodically, with the two most recent weekly versions retained.

9. Your Rights

Subject to the conditions of the GDPR, you have the right to access, rectify, erase, and restrict the processing of your personal data, as well as the right to data portability where applicable.

You have the right to object to processing based on legitimate interests on grounds relating to your particular situation.

Where processing is based on consent, you may withdraw your consent at any time. This does not affect the lawfulness of processing carried out before the withdrawal.

You have the right to lodge a complaint with the Commission for Personal Data Protection: https://cpdp.bg.

10. How to Exercise Your Rights

Send your request to [email protected].

Where necessary, we may request additional information proportionate to the need to verify your identity.

We respond without undue delay, generally within one month of receiving the request.

11. Data Transfers Outside the EU

Meta and Google may process data on servers located outside the EU. Such transfers are carried out using Standard Contractual Clauses (SCCs) approved by the European Commission.

12. Contact Details

Foxy Aesthetics OOD
Email: [email protected]

13. Changes to This Policy

We update this policy when there are changes to our services, data processing activities, or applicable requirements. The date of the latest update is stated at the beginning. Publishing a new version does not replace obtaining consent where consent is required.