1. Who is responsible for your data
inBansko is based in Bansko, Bulgaria. We are the controller of your personal data under the EU General Data Protection Regulation (GDPR). For anything about your data, contact us by email banskoski.bookings@gmail.com.
2. What we collect
When you book a lesson or rent gear
- Your name, email address and phone number.
- Your booking details: dates, start time, number of days and hours, group size, the gear you chose, delivery and anything you write in the notes (for example the ages and levels of your group).
- Payment details: the amount, how you paid and whether the payment succeeded. Your card or wallet details are handled by Stripe (and by Revolut or Satispay if you pay with them); we never see or store your full card number or account details.
- If you report a problem, the fact that you did and anything you tell us about it.
If you are an instructor or a rental shop
- Your account email and password. Passwords are stored securely in encrypted form and we can’t read them.
- Your name, phone number, photo and the listing details you enter: qualifications, years of experience, disciplines, specialties, languages, rates, weekly availability and your bio.
- For instructors: your Stripe account reference and payout status. Stripe collects and checks your identity and bank details itself; we don’t store them.
- For rental shops: the contact and bank details we need to pay you.
Technical data
- Like any website, our hosting provider logs basic technical data such as IP addresses, browser type and the pages requested, for security and to keep the site running.
3. Why we use it, and on what legal basis
- To provide the service (performance of a contract): taking and confirming bookings, processing payments, refunds and payouts, passing your booking to the provider and contacting you about it, and running provider accounts and listings.
- To meet legal obligations: keeping accounting and tax records.
- For our legitimate interests: keeping the site secure, preventing fraud, handling complaints and disputes, and improving the service.
We don’t use your data for advertising, we don’t sell it, and we don’t send marketing emails. If that ever changes, we will ask for your consent first.
4. Who we share it with
- The provider you book: your name, email, phone number and booking details, so they can give you the lesson or prepare your gear.
- Service providers who work for us, under contracts that require them to protect your data: Supabase (database, logins and file storage), Vercel (website hosting) and Resend (sending booking emails).
- Stripe, which processes payments and instructor payouts. Stripe also acts as a separate controller for some data, under its own privacy policy, for example for fraud prevention and legal checks. If you pay with Revolut Pay or Satispay, that company also processes your payment under its own privacy policy.
- Authorities, when the law requires it, and professional advisers such as our accountant.
5. Transfers outside the EU
Some of our service providers are based in, or may access data from, the United States. Where that happens, your data is protected by the EU-US Data Privacy Framework or by the European Commission’s Standard Contractual Clauses.
6. How long we keep it
- Booking and payment records: for as long as needed for the booking and any complaint or dispute, and for as long as Bulgarian accounting and tax law requires (generally up to 10 years for financial records).
- Provider accounts and listings: while your account is open. When you close it, we delete your data except the records we must keep by law.
- Technical logs: for a short period, normally a few weeks.
7. Your rights
You have the right to access your data, correct it, have it deleted, restrict or object to how we use it, and receive it in a portable format. Email us to use any of these rights; we reply within one month.
You can also complain to the Bulgarian data protection authority, the Commission for Personal Data Protection (cpdp.bg), or the authority in the EU country where you live.
8. Cookies
We only use cookies that are strictly necessary. When an instructor, shop or admin logs in, a login cookie keeps them signed in. We don’t use analytics, advertising or tracking cookies, which is why there is no cookie banner.
When you pay, you are taken to Stripe’s secure payment page, which uses its own cookies for security and fraud prevention. See Stripe’s privacy policy at stripe.com/privacy.
9. Children
Bookings are made by adults. If you book a lesson for a child, please share only what the instructor needs, such as the child’s age and level.
10. Security
The site uses encrypted connections (HTTPS), access to personal data is limited to the people who need it, and payments go through Stripe, which meets the card industry’s PCI DSS security standard.
11. Changes
We may update this policy. The date at the top of this page shows when it last changed. See also our Terms of use & booking.
