Privacy Policy & GDPR
Last updated: August 2026
This Privacy Policy governs how "Polimed AI" EOOD, acting as the Data Controller (hereinafter "Controller", "we" or "us"), collects, uses, stores and protects the personal data of Users and Partners (beauty salons and cosmetic centres).
1. Data controller details
Company name
"Polimed AI" EOOD
UIC / BULSTAT
206251634
VAT number
BG206251634
Manager
Mehmed Mashkov
Registered seat and management address
36 Paisiy Hilendarski Str., Madan, Bulgaria
Email for GDPR rights
mehmed.mashkov@gmail.comContact phone
+359 876 600 6672. Categories of data collected
A. End-user data
- Profile data: first name, last name, email address and phone number.
- Geolocation (GPS) data: precise device location only when actively used and with consent.
- Request and vehicle data: brand, model and registration number (optional).
- Behavioural data: order history, confirmed appointments, ratings and no-show incidents.
B. Partner data (salons / cosmetic centres)
- Data about representatives and contact persons of the merchant (name, position, phone, email).
- Commercial and payment data for invoicing (company details, VAT number, payment history via Stripe).
3. Processing matrix
| Purpose of processing | Data categories | Legal basis (GDPR) | Retention period | Data recipients |
|---|---|---|---|---|
| Registration and profile | Name, email, phone | Art. 6(1)(b) Contract | Until account deactivation + 30 days | Google Cloud, Supabase |
| Request fulfilment | Name, phone, details | Art. 6(1)(b) Contract | 12 months after the request | Selected salon |
| GPS localisation | Precise GPS location | Art. 6(1)(a) Consent | Temporarily for the session | Not shared |
| No-show control | Hashed data (phone/email) | Art. 6(1)(f) Legitimate interest | Up to 24 months from the incident | External technical providers |
| Invoicing (B2B) | Company data, payments | Art. 6(1)(c) Legal obligation | 10 years (Accounting Act) | NRA, accounting, Stripe |
4. No-show control system
- After 3 (three) confirmed no-shows without prior cancellation, the User's access to the Platform may be restricted.
- To prevent re-registration of a blocked profile, cryptographically hashed values of the email/phone are stored.
- Right to contest: the User may request a review of the block by emailing mehmed.mashkov@gmail.com.
5. Your rights and complaints
- Every data subject may exercise their rights by sending a request to mehmed.mashkov@gmail.com. Response time: 1 month.
- You have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP) (2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg) within 6 months of learning of the violation, but no later than 2 years from the date it occurred.
- The data subject has the right to appeal the Controller's actions under the Administrative Procedure Act before the court.