Last updated: 6 January 2026
This Privacy Policy explains how [Your Legal Name / Practice Name] (“we”, “us”, “our”) collects, uses, and protects personal data when you visit [your domain] (the “Website”), contact us, book sessions, and receive hypnotherapy services.
We operate from Bulgaria and process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Bulgarian data-protection law.
1) Who we are Salvea
Data Controller: Salvea
Address: Bulgaria, Sofia
Email: [privacy@yourdomain.com]
Phone: [optional]
2) What personal data we collect
A) Information you provide
• Identity & contact data: name, email address, phone number (if provided), country, time zone
• Booking data: appointment date/time, answers to scheduling/intake questions, correspondence
• Payment data (bank transfers): payer name, IBAN/account details shown on the transfer, bank name, transaction reference, amount, date, and any details you include in the payment description
• Messages: emails or form submissions you send us
B) Hypnotherapy-related information (may include special category data)
Hypnotherapy sessions may involve information about wellbeing and health. Under GDPR, data concerning health is generally special category (sensitive) personal data and receives extra protection.
This may include information you voluntarily share during intake or sessions (e.g., stress, sleep, habits, goals). We may also keep encrypted session notes (see Section 7).
C) Information collected automatically
When you use the Website, we may collect:
• IP address, device/browser type, pages viewed, timestamps, and basic security logs
• Cookie information (see Section 10)
We do not use website analytics tools (e.g., Google Analytics) and we do not run advertising trackers.
3) How we use your data
We use your personal data to:
• provide and manage hypnotherapy services (including intake, scheduling, delivering sessions, follow-ups)
• communicate with you about bookings and service-related matters
• process and reconcile bank transfer payments
• secure and operate the Website (security, abuse prevention, troubleshooting)
• comply with legal obligations (e.g., accounting/tax) and handle disputes if necessary
4) Legal bases for processing (GDPR)
We process personal data on the following bases:
• Contract: to provide the services you book and manage appointments
• Legal obligation: accounting/tax and other legal compliance
• Legitimate interests: running and securing our Website and communications (balanced against your rights)
• Consent: where required (e.g., certain cookie choices; and typically for special category data as described below)
Special category (health-related) data:
Where we process special category data, we generally rely on your explicit consent and apply additional safeguards.
You can withdraw consent at any time (see Section 11). This does not affect processing already carried out.
5) Online sessions (Google Meet and Zoom)
We offer online sessions via Google Meet and Zoom. When you join a session, these providers may process technical and usage data (e.g., device details, IP address, meeting metadata such as join/leave time) under their own terms and privacy policies.
• Recordings: We do not record sessions by default. If recording is ever requested, we will ask for your explicit consent in advance.
• We use reasonable privacy settings (e.g., private meeting links and access controls).
6) Bookings (Calendly embedded on our Website)
We use Calendly for scheduling, and it is embedded on our Website. When you book, Calendly processes the information you enter (e.g., name, email, appointment time, and any responses to booking questions).
Calendly may use cookies and similar technologies to provide its scheduling functionality and may display its own cookie banner depending on configuration.
7) Session notes (encrypted)
We keep encrypted session notes for continuity of care and professional record-keeping. Notes may include topics discussed, goals, and agreed actions, and may contain special category data depending on what you share.
Access is restricted to Antoaneta Miteva on a need-to-know basis.
8) Who we share data with
We do not sell your personal data.
We share personal data only as necessary with:
• Calendly (scheduling)
• Google Meet and Zoom (online session delivery)
• Website hosting / IT and security providers (to run and protect the Website and storage)
• Professional advisers (e.g., accountant) where necessary
• Authorities if legally required
9) International visitors and international data transfers
If you access the Website from outside Bulgaria, your data may be processed in Bulgaria and other countries where our service providers operate.
Some providers may process data outside the EU/EEA. Where international transfers occur, we use appropriate safeguards such as EU adequacy decisions and/or the European Commission’s Standard Contractual Clauses (SCCs).
10) Cookies
Our Website uses only strictly necessary cookies for core functionality and security.
Because Calendly is embedded, Calendly may set cookies or similar technologies needed to deliver scheduling features.
You can manage cookies through your browser settings. Blocking some cookies may affect booking functionality.
11) Your rights (GDPR)
Depending on your circumstances, you may have the right to:
• access your personal data
• correct inaccurate data
• request deletion (erasure)
• restrict processing
• object to processing (in certain cases)
• data portability
• withdraw consent (where processing is based on consent)
To exercise your rights, contact [privacy@yourdomain.com].
Right to complain: You can lodge a complaint with Bulgaria’s supervisory authority, the Commission for Personal Data Protection (CPDP).
12) Data retention
We keep personal data only as long as necessary for the purposes described:
• Bookings and communications: as needed to manage appointments and provide support, plus a reasonable period afterward
• Encrypted session notes: only as long as needed for continuity and professional record-keeping, then securely deleted/anonymized
• Bank transfer/payment records: retained as required by accounting/tax laws and audit requirements
13) Security
We use appropriate technical and organizational measures designed to protect personal data, including encryption for session notes, access controls, and secure storage practices. No method of transmission or storage is fully secure, but we take reasonable steps to reduce risk.
14) Children
Our Website and services are not intended for minors, and we do not knowingly provide services to or collect personal data from children.
15) Third-party links
The Website may contain links to third-party sites. We are not responsible for their privacy practices. Please review their policies.
16) Changes to this policy
We may update this Privacy Policy from time to time. Updates will be posted on this page and the “Last updated” date will change accordingly.