Legal / 02
This policy describes the limited personal data that may be processed when you use brainbox.club or move from the website to a connected booking or gift-card service.
Last updated: 27 July 2026Brainbox Club is responsible for personal data processed directly through brainbox.club. Privacy questions and rights requests can be made through the Contact page or sent to the postal address shown there.
A connected reservation, payment, map, or gift-card provider may also act as an independent controller for information collected on its own service. Its notice will apply at the point of collection.
Hosting and security systems may process technical information such as IP address, device and browser details, requested pages, timestamps, and diagnostic logs.
If you send the contact form, Brainbox Club processes your name, email address, selected topic, message, language, and submission time so the team can receive and answer your enquiry. Cloudflare Turnstile also processes technical and security signals to check that the submission is legitimate.
If you use a booking or gift-card service, the information you enter there may include contact details, reservation details, participant information, and payment-related information. Brainbox Club does not ask you to send sensitive personal data through this website.
Data may be used to deliver and secure the website, answer a request, administer a reservation or gift purchase, meet legal obligations, and resolve disputes.
The legal basis depends on the activity: steps requested before a contract, performance of a contract, compliance with law, legitimate interests in security and service operation, or consent where the law requires it.
Contact-form details are sent through the website server to the configured message-delivery provider so the enquiry can reach Brainbox Club. Technical security data is shared with Cloudflare for Turnstile validation. Other data is shared only where needed with providers that support hosting, reservations, payments, maps, or gift cards, and with authorities where the law requires it.
Contact enquiries and copies held by the message-delivery provider are kept only for as long as needed to answer and follow up on the request. Other information is kept only for the relevant purpose, legal record-keeping, security, or the handling of a claim; provider-specific periods are explained by the provider concerned.
Depending on the circumstances, you may request access, correction, deletion, restriction, portability, or object to processing. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.
You may also lodge a complaint with the Bulgarian Commission for Personal Data Protection. We may need reasonable information to verify a request before acting on it.
If non-essential cookies or similar technologies are introduced, the website will explain them and request consent where required. External links are governed by the destination service.
This policy may change when the website, providers, or legal requirements change. The date above identifies the current version.
