Privacy Policy

Mandatory information on the rights of persons regarding personal data protection

We at Diyana Aesthetic House have a long‑term commitment to respect the privacy of every user and customer with whom we have a relationship, and therefore it is very important for us to be transparent about how we manage your personal data.

Diyana Aesthetic House also processes personal data outside our diyana.com pages, for which a separate privacy notice is required. That is why we clarify:
In connection with the implementation of Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016, Diyana Aesthetic House adopts and implements an updated policy for the protection of your personal data that you have provided to us as a user of our website.

Mandatory information on the rights of persons regarding personal data protection (Privacy notice)

Information about the company that processes your data
Name: “New Derm” EOOD UIC/BULSTAT 207606700
Headquarters and management address: Sofia, qtr. “Hipodruma”, bl. 141, entr. B, fl. 7, apt. 45
Correspondence address: Sofia, Totleben Blvd. № 31, fl. 1, apt. 3
Phone: +359 887 604 641
E‑mail: diyanaaesthetic@gmail.com
Website: www.diyanahouse.bg

Information about the competent supervisory authority for personal data protection
Name: Commission for Personal Data Protection
Headquarters and management address: Sofia 1592, blvd. “Prof. Tsvetan Lazarov” № 2
Correspondence address: Sofia 1592, blvd. “Prof. Tsvetan Lazarov” № 2
Phone: +359 2 915 3 518
Website: www.cpdp.bg

Diyana Aesthetic House (hereinafter referred to as the “Administrator”) carries out its activities in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. This information is intended to inform you about all aspects of the processing of your personal data by the Administrator and the rights you have in relation to this processing.

Basis for collecting, processing and storing your personal data

The Administrator collects and processes your personal data in connection with the use of the Facebook chatbot on the basis of Art. 6 (1) of Regulation (EU) 2016/679 (GDPR), and specifically on the following grounds:

Your explicit consent;
Compliance with a legal obligation applicable to the Administrator;
Legitimate interests pursued by the Administrator or a third party.

Purposes and principles in the collection, processing and storage of your personal data

We collect and process the personal data you provide for the operation of diyana.com, including the following purposes:

Improving content presentation on the platform;
Statistical analysis to enhance newsletters;
Information‑security protection.

When processing your personal data, we observe the following principles:

Lawfulness, fairness and transparency;
Purpose limitation;
Data minimisation relevant and limited to what is necessary;
Accuracy and timeliness of data;
Storage limitation for no longer than is necessary;
Integrity and confidentiality ensuring appropriate security.

What types of personal data we collect, process and store

The Administrator performs the following operations with the personal data you provide through the chatbot platform:

Registration and participation in an event

To participate in events organised by the Administrator, we collect personal data from individuals wishing to attend in order to identify them on the participant list. If you wish, we may send you information about future events that could interest you. Registration is done on site at our office or by e‑mail before the event in accordance with its terms.
Impact‑assessment conclusion: Due to the small number of data subjects and the limited scope of data collected, a DPIA is not required for this operation.

Organising games and sending prizes

For users who win prizes in our games, raffles or contests, we collect and process the data you provide to send your prize (via us, a partner or courier). If you wish, we may retain these data for future deliveries.
Impact‑assessment conclusion: For the same reasons as above, a DPIA is not required for this operation.

Categories, purposes and legal basis

Data: Identifying information (e‑mail, social‑network profile, nickname/username, etc.)
Purpose: To contact you and send information.
Legal basis: Your explicit consent under Art. 6 (1)(a) GDPR at the moment of subscription.

Data we do not collect or process

The Administrator does not collect or process personal data that:

Reveal racial or ethnic origin;
Reveal political, religious or philosophical beliefs, or trade‑union membership;
Constitute genetic or biometric data, data concerning health, or data concerning sex life or sexual orientation.

The Administrator does not perform automated decision‑making or profiling.

Social‑network tracking data

When you interact via our social‑network channels/pages/promotions or blogs (e.g., click “like” or “share”, post comments, submit ratings), your publicly available personal data may be processed. This may include: name, gender, date of birth or age, homepage, profile picture, time zone, postal address, country, interests, comments and content you post/share.

We use these data to understand public opinion about us and our brand, identify opinion leaders, resolve issues and/or improve Diyana Aesthetic House products and services, or engage with you for promotional purposes (based on your questions/requests).
Processing is based on the legitimate interest of Diyana Aesthetic House and is lawful under Art. 6 (f) GDPR.

How do we ensure the security of your personal data?

We apply reasonable organisational, technical and administrative measures to protect personal data within our organisation. However, no transfer or storage system can be 100 % secure. If you believe your interactions with us are no longer secure, please inform us immediately.

Retention period for personal data

We retain your personal data only for as long as necessary or permitted for the purposes for which they were collected.

Transfer of your personal data for processing

The Administrator may, at its discretion, transfer part or all of your personal data to processors for the purposes you have consented to, in compliance with Regulation (EU) 2016/679 (GDPR).

You will be informed before any transfer of your personal data to third countries or international organisations.

Your rights regarding the collection, processing and storage of your personal data

1. Withdraw consent

You may withdraw your consent to processing at any time for some or all purposes by submitting a free‑text request.

2. Right of access

You can view the data stored and processed about you at any time in your account. Upon request, we will provide additional information and a copy of your personal data in electronic or other appropriate form. Access is free, but we reserve the right to charge a reasonable fee for repetitive or excessive requests.

3. Right to erasure (“right to be forgotten”)

You may request deletion of part or all of your personal data, and we shall delete them without undue delay where:

The data are no longer needed for the purposes collected;
You withdraw consent and no other legal basis exists;
You object to processing for direct‑marketing purposes and no overriding legitimate grounds exist;
The data were processed unlawfully;
Deletion is required to comply with a legal obligation under EU or Member‑State law; or
The data were collected in relation to information‑society services.

We are not obliged to erase data where processing is necessary:

For exercising freedom of expression and information;
To comply with a legal obligation or perform a task in the public interest or in the exercise of official authority vested in us;
For reasons of public interest in the area of public health;
For archiving in the public interest, scientific or historical research or statistical purposes;
For the establishment, exercise or defence of legal claims.

In exercising your right to be forgotten, the Administrator will delete all your data except:

Information needed to certify that the request has been fulfilled; and
Technical information necessary for platform functioning, which cannot identify you.

Procedure: Submit a request via your account. A copy of the request will be emailed to you. Once we verify your identity, we will delete your data as above.

4. Right to restriction of processing

You may request restriction when:

You contest the accuracy of the data (for a period allowing verification);
Processing is unlawful, but you oppose erasure and request restriction instead;
We no longer need the data, but you require it for legal claims; or
You have objected to processing pending verification of overriding grounds.

5. Right to data portability

You may request to receive your personal data in a structured, commonly used, machine‑readable format, or to have them transmitted directly to another controller where technically feasible.

6. Right to object

You may object at any time to processing of your personal data, including profiling or direct marketing. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or for legal claims.

7. Rights in the event of a personal‑data breach

If we detect a breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay of the breach and the measures taken or proposed, unless:

Appropriate technical and organisational measures rendered the data unintelligible to unauthorised persons;
Subsequent measures ensured no high risk remains;
Notification would involve disproportionate effort.

Other provisions

The Administrator does not transfer your data to third countries unless duly notified and safeguarded.
If you believe your data‑protection rights have been violated, you may lodge a complaint with the Commission for Personal Data Protection (contact details above).
You can exercise all your rights regarding personal‑data protection by submitting requests in any form containing a statement of your wish and sufficient information to identify you as the data subject.