Privacy Policy

Who processes your data?

The data controller is:

For questions regarding your personal data and exercising your rights, you can use the email address provided or the „Account and Privacy“ section in My BARDARO.

What Data Do We Process?

Depending on how you use BARDARO, we may process:

• Profile and Account: first name, last name, email, preferred language, login and security information.
• Digital Business Card: photo, job title, company, phone numbers, email addresses, websites, social media profiles, address, BG/EN profile, selected theme, and the information you choose to publish.
• Customer service, visits, and tailoring: measurements and sizing information, including height, weight, and usual clothing size, when necessary for preparing for the initial consultation; fit preferences, orders, items, fabrics, details, service history, number of clients at the appointment, date and time of the visit, selected appointment method, verified address, address details, and access instructions, when necessary for the requested service. An appointment request may be submitted even without a My BARDARO account. If a person requests a joint visit for another customer, the limited data provided by the requester regarding that participant may also be processed for the purpose of preparing and organizing the appointment.
• NFC and Digital Identity: internal card identifiers, activation status, permanent BARDARO Identity link, technical data for first-time use, and, if you choose, a Wallet Pass ID.
• Communication and Concierge: Private Client Concierge requests, preferred method and time for contact, associated model, desired date, your notes, and the back-and-forth correspondence between you and BARDARO regarding the request.
• Rights, Privacy, and Legal Notices: requests for access, portability, rectification, or erasure, and the history of their processing, as well as a limited audit trail for explicitly accepted Terms and Conditions or confirmation of a public profile—document, version, date and time in UTC, context, and language.
• Technical Specifications: minimal security logs, date and time of actions, browser/device, and information necessary to protect the account and the service. The public visit form uses Cloudflare Turnstile anti-bot protection and request rate limiting; BARDARO does not store the Turnstile token after verification, and application rate limiting retains only one-way HMAC hashes instead of raw IP addresses.

Photos and measurements are used to provide the selected service. BARDARO does not use profile photos for biometric recognition.

Why and on what basis do we process data?

As of the date of this policy, we do not use analytical cookies for profiling or advertising. Should we enable limited analytics in the future, we will update this information and implement the necessary opt-out mechanism.

My BARDARO and Digital Business Card

My BARDARO is a private area for your profile. The public digital business card is a separate feature and is displayed only when you publish it. You can choose the fields, the default language, and the visual theme. The public version can be accessed via a link, QR code, NFC card, or Wallet pass.

The contact information you post is visible to anyone to whom you provide the public link or physical card. Do not post information that you do not want to share.

When you submit a request to close and delete your profile, it will be hidden while the request is being reviewed.

Recipients and Services

Only individuals and vendors who need it are granted access to data. Depending on the service, this may include hosting and technical support, email infrastructure, manufacturing and logistics partners, map and address validation providers (such as the Google Maps Platform when scheduling a visit), a provider of anti-bot protection for public forms (Cloudflare Turnstile), as well as providers of digital wallet services when you choose to use them.

Google Wallet and the future Apple Wallet integration are independent services provided by their respective providers. When you add a pass to such a service, their terms and policies also apply.

When a service provider processes data on our behalf, we require appropriate contractual and organizational safeguards. For transfers outside the European Economic Area, we use the applicable safeguards when necessary.

Storage periods

We retain data only as long as it is necessary for the purpose for which it was collected. Your My BARDARO profile and digital business card are retained as long as your account is active, unless limited retention is required after the account is closed.

Documents and data related to orders, payments, accounting, and tax obligations may be retained for the periods required by applicable law. Data necessary to establish, exercise, or defend legal claims may be retained until such need ceases to exist.

Concierge requests, visits, and related communications are retained for as long as necessary to provide the service and for a reasonable period thereafter to maintain a record of customer service, unless a longer retention period is required by law or to protect rights.

Requests to exercise rights are retained to a limited extent so that we can prove their receipt and fulfillment. Records of acceptance of terms and conditions and of public postings are part of the My BARDARO account, are included in the personal copy of the data, and are deleted along with the Client Hub account upon fulfillment of a request for complete deletion, unless applicable law requires otherwise at that time.

Your Rights

In accordance with applicable law, you may request access to, correction of, or erasure of your personal data; restrict its processing; object to certain processing; receive the applicable data in a portable format; and withdraw your consent.

As a general rule, we will respond without undue delay and within one month; however, in the case of complex or numerous requests, this period may be extended in the instances provided for by law. The right to erasure is not absolute—certain records may be retained when required by law or when necessary to defend legal claims.

You have the right to file a complaint with the Commission for Personal Data Protection (CPDP), Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., cpdp.bg.

Security

We use organizational and technical measures to protect profiles and personal data, including secure access, HTTPS, restricted administrative access, protection of sensitive system identifiers, and mechanisms to prevent misuse. Passwords are not stored in plain text.

No online system can guarantee absolute security. If we detect a security breach, we will take the actions required by applicable law.

Changes and Contact Information

We may update this policy in response to changes in our services, technologies, or legal requirements. The current version is always posted on this page. In the event of a significant change that affects My BARDARO users, we may also provide additional notice.

Questions regarding confidentiality: office@bardaro.eu.