PRIVACY POLICY

This Privacy Policy explains how Hypnos Foundatino (“we”, “us”, “our”) collects, uses, shares, and protects personal data when you use our website and when you submit a request through the “Make a Request” form. We aim to comply with applicable data protection laws, including the GDPR (Regulation (EU) 2016/679).

1. Data controller

Hypnos Foundation is the controller of the personal data processed through this website for the purposes described below.

2. Personal data we collect

Depending on how you interact with the website, we may collect:

• Request form details: selected date, show type, artists, apparatus, location, time, your name, email address, and phone number.
• Technical data: basic logs generated when you access the site (e.g., IP address, device/browser information), as typically provided by hosting providers.
• Cookie data: if cookies are used, as described in our Cookies Policy.

3. How we use your data

We process personal data to:

• respond to your inquiries and discuss your event request;
• prepare quotes and coordinate availability with artists;
• administer bookings and provide services if you proceed;
• operate, secure, and improve our website;
• comply with legal obligations.

4. Legal bases (GDPR)

Where GDPR applies, we rely on one or more of the following legal bases:

• Contract / pre-contractual steps (Art. 6(1)(b)): to handle your request and prepare an offer.
• Legitimate interests (Art. 6(1)(f)): to operate and secure the website and manage our business communications.
• Consent (Art. 6(1)(a)): when required (e.g., certain cookies or marketing communications).
• Legal obligation (Art. 6(1)(c)): to comply with laws (e.g., accounting, tax, or regulatory requirements).

5. Where your request data is stored

If you submit the request form, your submission may be stored in a Google Sheet and processed via Google services (e.g., Google Apps Script) to help us manage requests efficiently.

6. Data retention

We keep personal data only as long as necessary for the purposes described in this policy:

• Requests / inquiries: retained for a reasonable period to manage follow-ups and business records.
• Bookings: retained for the duration of the relationship and as required by applicable accounting/tax laws.
• Technical logs: retained according to our hosting provider’s standard periods or as needed for security.

7. Sharing data with third parties

We may share personal data only when necessary, for example with:

• Artists / performers, to check availability and coordinate event details (only what is needed).
• Service providers (e.g., website hosting, email, Google services such as Sheets/Apps Script) who help us operate the website and manage requests.
• Authorities, when required by law.

We do not sell your personal data.

8. International transfers

Some providers (such as Google or hosting providers) may process data outside the European Economic Area (EEA). Where required, we rely on appropriate safeguards (e.g., adequacy decisions or Standard Contractual Clauses) to protect your data.

9. Your rights

Depending on your location and applicable law, you may have rights such as:

• access to your personal data;
• rectification of inaccurate data;
• erasure (“right to be forgotten”) in certain situations;
• restriction of processing;
• data portability;
• objection to processing based on legitimate interests;
• withdrawal of consent (where processing is based on consent).

You may also have the right to lodge a complaint with a supervisory authority (for Bulgaria, the Commission for Personal Data Protection).

10. Security

We take reasonable technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure.

11. Changes to this policy

We may update this Privacy Policy from time to time.