Privacy Policy

Last updated: October 16, 2026

Дърводелец БГ ЕООД (Darvodelec BG Ltd.) ("the Company", "we", "us") respects the privacy of users of the REZVA platform, available through the website rezva.pro, the specialists' booking pages and the REZVA mobile app. This policy describes what personal data we collect, why, who we share it with and what rights you have. It also explains when we process data on behalf of specialists (section 3.2).

1. Data Controller

2. What Data We Collect

2.1. Data you give us

• At registration: name, email address, phone number, password (stored only in hashed form), language.
• Specialist profile: business name, address, services and prices, photos, working hours, social media links.
• Billing details (specialists): billing country, company name, VAT number or Companies House number, the "I'm buying for my business" declaration with its date, invoices. Card details are entered directly with Stripe.
• Identity verification (optional, Pro and Team plans): through Stripe Identity (an identity document and a live selfie, checked by Stripe; we receive the result) or by uploading photos of the document, which a person at REZVA reviews.
• When booking: service, date and time, notes, contact details, deposit receipts if you upload them.
• Messages, reviews and support requests, including what you type into the support assistant.

2.2. Data collected automatically

• IP address and the country derived from it (through Cloudflare), device type, operating system and browser.
• Visits to specialist profiles (with IP address and browser) and the steps through the specialist sign-up pages (linked to a session identifier), for statistics.
• Security records (sign-ins, admin actions) with IP address.
• Cookies and similar technologies (see the Cookie Policy).

2.3. Data from the mobile app

• Push notifications: a device token for delivering notifications (only with your consent).
• Device identifier: for session security and abuse prevention.
• Camera and photo library: the app may ask for access to your camera or photo library so you can upload photos (profile picture, portfolio, photos in messages). Photos are uploaded to our servers and stored under this policy. Access is given only with your explicit permission and can be withdrawn at any time in your device settings.

The mobile app does not access your contacts, microphone or location unless you explicitly allow it for a specific feature.

2.4. Data we receive from others

• Stripe: payment status, card brand, the last four digits and the country that issued the card.
• EU VIES and HMRC: the name and address registered for a VAT number you enter.
• Google or Apple, if you sign in with them: name and email address.
• Google Calendar, if a specialist connects it: the times and titles of events in that calendar, so those times are blocked. REZVA bookings are written to the same calendar.
• Specialists: when a specialist adds you as a client or books an appointment for you.

3. How We Use Your Data

• Providing and maintaining the Platform
• Processing bookings and payments
• Sending confirmations, reminders and messages
• Invoicing and VAT
• Improving our services with aggregated statistics
• Complying with legal obligations
• Security and preventing fraud and abuse

3.1. Lawful basis for processing

We, Дърводелец БГ ЕООД, are the controller of your personal data and are responsible for protecting it. We process personal data on the following bases under Article 6 of the General Data Protection Regulation (GDPR) and, for users in the United Kingdom, the UK GDPR:

• Contract: registration, profile, bookings, messages, subscriptions and payments.
• Legal obligation: invoicing, accounting and VAT, including checking VAT numbers in the EU VIES system and, for UK customers, with HMRC's VAT number check service, and keeping invoices for the period the law requires.
• Legitimate interests: security, fraud and abuse prevention, and aggregated statistics without personal data.
• Consent: analytics cookies and marketing messages. You can withdraw consent at any time.

Users in the United Kingdom have the rights given by the UK GDPR and can complain to the Information Commissioner's Office (ICO), https://ico.org.uk. Transfers of data between the EU and the United Kingdom rely on adequacy decisions.

3.2. Data we process on behalf of specialists

When a specialist keeps client records, bookings, notes (including health or allergy notes), photos and messages in REZVA, the specialist is the controller of that data and we process it on the specialist's behalf under the Data Processing Agreement. For that data, please contact the specialist first; we help them deal with your request. We remain the controller of your own REZVA account, of the reliability score (section 3.3) and of security data.

3.3. Reliability score

To protect specialists from missed appointments, we keep a reliability score linked to the email address (and the phone number, if given), based on completed appointments, late cancellations and missed appointments with all specialists on REZVA. The basis is the legitimate interest of specialists and of REZVA. A specialist may decide that bookings below a certain score are refused online or need a deposit; you can always contact the specialist directly. You can object to the score, or ask for a recorded late cancellation or missed appointment to be reviewed, at [email protected]: a person reviews it.

3.4. Support assistant

Messages you type into the REZVA support assistant are sent to Google (Gemini API) to produce an answer, and are kept with the conversation so that a person can take over. Please do not type sensitive data there. The assistant does not make decisions about you.

4. Data Sharing

• Specialists: when you book, the specialist receives your name, phone, email, notes and your appointment history with them.
• Our accountant and the tax authorities: invoices and the data needed for tax returns.
• Competent authorities: when the law requires it.
• Service providers that process data on our behalf:

When you open a page, your browser loads fonts (Bunny Fonts, EU), scripts (jsDelivr) and maps (OpenStreetMap), and sends them your IP address in doing so.

We never sell your personal data.

5. Data Security

• Encrypted connections (HTTPS) everywhere
• The database is encrypted at rest
• Passwords are stored only in hashed form
• Identity documents, deposit receipts and client photos are stored separately and shown only to authorised people
• Restricted access to personal data and records of admin actions
• A written procedure for security incidents, including notifying the Commission for Personal Data Protection within 72 hours

6. Your Rights

Under the GDPR and Bulgarian law, you have the right to:

• Access: obtain a copy of your data
• Rectification: correct inaccurate data
• Erasure: ask for your data to be deleted
• Restriction: restrict processing
• Portability: receive your data in a structured format
• Objection: object to processing based on legitimate interests, including the reliability score
• Withdrawal of consent: at any time, without affecting processing already done

You can download your data yourself (clients: Profile, Privacy & your data; specialists: Settings, Export my data) and request deletion there (see Delete your data). For any other request, write to [email protected]. We reply within one month.

You have the right to complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or to the supervisory authority of the country where you live or work.

7. Data Retention

• Account data: for as long as the account exists.
• After a deletion request: the account is deactivated at once, and personal data is deleted or anonymised within 30 days. A specialist with a paid subscription first moves to the Free plan; deletion then follows within 30 days of the end of the paid period.
• Invoices and accounting records: about 10 years. The Bulgarian Accountancy Act requires documents used for tax control to be kept until 5 years after the limitation period for the related tax obligation ends.
• IP address and browser in profile visit statistics and in security records: 90 days.
• Recipient and content of sent notifications (email, SMS, push): 90 days.
• Deposit receipts: 90 days.
• Push notification tokens: deleted after 90 days without use. Sign-in tokens of the mobile app stop working after 60 days without use.
• Bookings and reviews after an account is deleted: stay in the specialist's records with the personal data anonymised (date, service, price, rating).
• Copies in backups are removed as the backups are replaced.

8. Cookies

We use necessary cookies to run the Platform, and analytics cookies only with your consent. Details are in the Cookie Policy.

9. Children

The Platform is not intended for persons under 16. We do not knowingly collect data from children. If we learn that we have collected data from a person under 16, we delete it immediately.

10. Transfers Outside the EU

Your data is stored on servers in Germany (EU). Some providers (Cloudflare, Stripe, Google, Expo, Twilio, Namecheap) may process data in the USA. Such transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses.

11. Account Deletion

You can ask for your account to be deleted at any time from Profile (clients) or Settings (specialists), or by email to [email protected]. The account is deactivated at once, and personal data is deleted or anonymised within 30 days, except data we must keep by law (for example invoices). Details: Delete your data.

12. Policy Changes

We may update this policy. We publish the new version on this page with its date, and we announce significant changes by email or with a notice in the Platform.

13. Contact

For questions about this policy or to exercise your rights: