Privacy & Cookies

1. Who we are

This website is operated under the UPREFORMER brand by IVELAS Group EOOD (UIC 208036107, VAT BG208036107), the controller of the personal data collected through it. For any privacy question, or to exercise your rights, contact us at the email below.

Joint controllers: for personal data collected through the UPREFORMER digital services · the website, the reservation system and the electronic signing of the Declaration · IVELAS Group EOOD and the relevant franchise studio act as joint controllers within the meaning of Article 26 of Regulation (EU) 2016/679. IVELAS Group EOOD determines and operates the technical means of processing, while each studio determines the purposes connected with providing the on-site service. You may exercise your rights against either joint controller. Point of contact: office@upreformer.com.

2. What we collect

• Information you give us: when you use the contact form or sign up for the newsletter, we collect your name, email address and the content of your message.
• Usage & analytics data: if you accept analytics cookies, we collect anonymous statistics about how you use the site · pages viewed, clicks, device and browser type, and an approximate region derived from your IP address. We use PostHog (EU-hosted) for this. Nothing is collected and no analytics cookies are set until you accept.
• Technical data: like any website, our hosting and security providers process standard request data (e.g. IP address, browser) to deliver and protect the site.

Electronic signing is available for the studios for which this option is enabled on the website. The signed declaration is sent to the studio you select. If a parent chooses to submit the informed parental consent declaration electronically (by scanning the studio's QR code or through the declaration page), we collect additional data to record the parent's consent for their minor child to train, as required by the studio's access rules:

• the signing parent's or guardian's name;
• the parent's ЕГН (Bulgarian national identity number) or an alternative identifier, if the parent does not have an ЕГН;
• the parent's address;
• the child's name and age;
• the health declaration about the child (that the child is in good health with no medical contraindications) · this is a health statement about the child, a special category of personal data under the GDPR, provided by the parent as part of the declaration;
• the parent's hand-drawn signature;
• corroborative metadata recorded in the PDF: a unique submission id, a server timestamp, the document version, the IP address, and the browser user agent of the device used to submit the declaration.

The declaration PDF is generated on our server, emailed to the studio office, and returned to the parent for download right after it is sent. The website does not store it in a database. It still persists in the office mailbox, and our email provider (Resend) retains sent messages and attachments and keeps account metadata and logs outside the EU · see sections 5 and 7 below.

Instead of submitting electronically, you can always print the declaration, sign it by hand, and hand it in at the studio, avoiding electronic transmission of your data entirely · see the declaration page (upreformer.com/en/parental-consent).

3. Cookies & similar technologies

• Strictly necessary: we store your cookie choice in your browser (a small upr-consent value) so we remember it. If your browser is not set to Bulgarian we offer you the English version and store your answer (a small upr-locale value) so we do not ask again. Both are required to honour your decisions and need no consent.
• Analytics cookies: set by PostHog only after you accept. They help us understand usage in aggregate.
• You can change your mind at any time by clearing this site's cookies / site data in your browser · this brings the consent banner back.

4. Why we use your data (legal basis)

• Consent · for analytics cookies and newsletter sign-ups.
• Legitimate interest, or steps taken at your request · to reply to messages you send us and to keep the site secure.
• Explicit consent (Art. 9(2)(a) of Regulation (EU) 2016/679) · for the health statement about the child in the informed consent declaration, given by the parent or guardian when signing, when you choose to submit it electronically.
• Entering into and performing the service contract · for the remaining data in the informed consent declaration, when you choose to submit it electronically.

5. Who we share it with (processors)

We don't sell your data. We use trusted providers who process data on our behalf, each under its own privacy terms:

• PostHog · product analytics (EU-hosted).
• Resend · sending email for the contact form, the newsletter, and an electronically submitted parental consent declaration (including the signed PDF attachment). Resend retains sent messages and attachments and keeps account metadata and logs outside the EU, regardless of the sending region.
• Vercel · website hosting.
• Cloudflare · DNS, security and content delivery.
• Google Maps · studio location maps are rendered by our server; your browser does not contact Google directly for them.

6. Booking & independent studios

Reservations for most studios are made on the Fitsys platform, which IVELAS Group EOOD operates for the UPREFORMER brand. The studio you visit is given access to the data needed for the on-site service. The Mladost · Olimp studio uses Fitness Olymp's own reservation system, which they operate.

7. International transfers

We aim to keep processing within the EU/EEA (our analytics are EU-hosted). Where a provider processes data outside the EEA, it does so under appropriate safeguards (e.g. EU Standard Contractual Clauses). Exception: Resend, our email delivery provider, keeps account metadata and logs outside the EU; it also handles the parental consent declaration when submitted electronically, including the PDF attachment carrying the ЕГН and the child's health declaration.

8. How long we keep it

Contact messages are kept as long as needed to handle your inquiry and for a reasonable period afterwards. Newsletter data is kept until you unsubscribe. Analytics data is retained in aggregate according to our analytics provider's retention settings.

The parental consent declaration (including one submitted electronically) is kept for 6 months from submission and then deleted. Consent for the child's health statement may be withdrawn at any time by contacting us at the email below; withdrawal does not affect the lawfulness of processing before it.

9. Your rights

Under the GDPR you can: access your data; correct it; delete it; restrict or object to processing; receive a copy (portability); and withdraw consent at any time. To exercise any of these, contact us. You also have the right to complain to the Bulgarian Commission for Personal Data Protection (CPDP), www.cpdp.bg.

10. Changes to this policy

We may update this policy as the site evolves. The last-updated date above always reflects the current version.

11. Studio terms

At the studios operated by IVELAS Group EOOD, services, reservations, payments and access for minors are governed by the Terms & Conditions (upreformer.com/en/terms). The on-site services at franchise studios are provided by the respective franchise partner, who may apply their own terms for those services.

Contact

Questions about your privacy? Reach us through the contact form