Privacy Policy
This page explains what happens to your details when you use this website. It is written to be read, not to be survived. If anything here is unclear, ask before you send anything.
- 1. Who is responsible
- 2. What is collected
- 3. Why, and on what legal basis
- 4. Health information
- 5. Who else can see it
- 6. Transfers outside the EU
- 7. How long it is kept
- 8. Cookies and tracking
- 9. Your rights
- 10. Children
- 11. Changes
1. Who is responsible
The controller of your personal data — the person who decides what is done with it — is Marco Krastev, a private individual working as a massage practitioner under the name The WanderBody Alchemist, in Sofia, Bulgaria.
“The WanderBody Alchemist” is a working name, not a company. If you have also seen this practice under another name, it is the same person and the same responsibility — no separate business exists behind either name, and your details are held in exactly one place either way.
- Email for anything in this policy: marco.krastev97@gmail.com
- Address for formal notices: none is published. Notices go by email to the address above.
No data protection officer is appointed. A practice of this size is not required to have one, and appointing one voluntarily would create obligations that do not otherwise apply.
2. What is collected
What you type into the enquiry form
Your name and email address are required. Everything else is optional and only reaches me if you fill it in: phone number, which session type you are asking about, a preferred date, a location, the number of people, an approximate duration, and — for events — the event name, type and dates, the expected number of guests, the massage format you want and what space is available. There is a free-text message box, and whatever you choose to put in it comes too.
What happens when you press send
The form has no server behind it. Pressing send opens your own email program with the details already written into a message, addressed to me. Nothing is transmitted until you send that email yourself, and the website itself never stores a copy. From that point it is an ordinary email in my inbox.
If this ever changes — if the form starts posting to a form service such as Formspree — that service becomes a processor of your data and this section has to be rewritten before the change goes live.
What the booking calendar collects
The Book a massage tab embeds a Google Calendar appointment page. Nothing is requested from Google until you scroll far enough down the page to reach the booking section — if you never get that far, Google is never contacted. If you book through it, you are entering your details into Google's booking form, not mine: Google collects them, sends me the booking, and its own privacy policy governs that step as well as this one.
What is collected automatically
By this website: nothing. There is no analytics, no tracking pixel, no advertising tag and no visitor counter. By the host: this site is served by Cloudflare Pages, which keeps ordinary server logs — typically your IP address, the page requested and the time — to deliver the pages and to block attacks. Cloudflare's handling of that is governed by its own privacy policy.
3. Why, and on what legal basis
- To answer your enquiry and arrange a session. Legal basis: steps taken at your request before entering a contract, and performance of that contract (GDPR Art. 6(1)(b)).
- To keep a record of sessions given and payments due. Legal basis: my legitimate interest in running the practice (Art. 6(1)(f)). There is no accounting obligation here yet, because there is no registration behind it; if that changes, Art. 6(1)(c) applies as well.
There is no third entry here for the website itself. The typefaces are served from this site rather than from Google, so simply reading a page sends your details to nobody and needs no consent from you.
You are never required to give any of this. Not giving it simply means I cannot answer or cannot book you in.
4. Health information
The form does not ask about your health, and you should not put medical details into it. In person, before or during a session, I may ask about injuries, pain, pregnancy, recent surgery or anything else that decides whether a technique is safe. That is special category data under GDPR Art. 9 and is treated accordingly:
- It is used only to decide how, and whether, to work on you safely.
- It is asked for and recorded with your explicit consent (Art. 9(2)(a)). It is asked in conversation and not written down. No intake form is used and no health notes are kept.
- It is never shared, and never used for marketing.
- You can ask me to delete it at any time, and I will, unless a specific legal rule requires me to keep a record.
I am a massage practitioner, not a doctor. Nothing here is a medical record and nothing I say is a diagnosis.
5. Who else can see it
Your details are not sold, rented, or shared for anyone else's marketing. Ever. The only other parties involved are the ones that make the site and the booking work:
- Google — the appointment page, and the calendar the booking lands in. Requested only once you reach the booking section of the page.
- Google, again, as my email provider — enquiries arrive at a Gmail address and stay in that inbox.
- Cloudflare — the host. It serves every page on this site and keeps server logs of the requests, including IP addresses.
There is no accountant and no tax authority in this list, because there is no registered business to invoice through. That line returns the day registration does.
6. Transfers outside the EU
Google is a US company and processing may take place outside the European Economic Area. Those transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework and on standard contractual clauses where it does not apply.
Two parties are involved, and they are not the same in scope:
- Google — the booking calendar, and my email. This one is optional: it applies only if you use the calendar or write to me.
- Cloudflare — the host. This one is not optional. Cloudflare is a US company running a worldwide network, so serving these pages and keeping the server logs described in section 2 may involve processing outside the EEA. It happens on every visit, including this one, and relies on the same transfer mechanisms.
Nothing else on this site goes anywhere. There is no analytics, no advertising and no third-party script beyond the two named above.
7. How long it is kept
- Enquiries that go nowhere: deleted within 12 months.
- Clients I have actually seen: contact details kept for 3 years from our last session, so that I recognise you if you come back. No health notes are kept at all — see section 4.
- Accounting records: none are kept, because there is no registered business generating them.
Both periods above are ceilings, not targets. Ask me to delete your details earlier and I will, without asking why.
8. Cookies and tracking
This site sets no cookies. There is no analytics, no advertising and no profiling of any kind.
There is also no cookie banner, and that is the point of not having one. A banner is only honest when there is something to decide. The typefaces are served from this site, nothing counts your visit, and no script here follows you anywhere — so there is nothing to ask you about, and asking anyway would only train you to click through dialogues without reading them.
One third party can still set its own cookies, and it does not load on its own: the Google Calendar booking page, fetched only once you reach the booking section of the home page. If you never scroll that far, or you book by email instead, it never loads.
If a visitor counter is ever added, a banner with a real Accept and a real Decline comes back with it, and this section is rewritten before that goes live.
9. Your rights
Under the GDPR you can ask me to: give you a copy of what I hold; correct it; delete it; restrict what I do with it; hand it over in a portable form; or object to processing based on legitimate interest. Where processing rests on consent, you can withdraw it at any time, and that does not affect anything done before you withdrew.
Ask by email at marco.krastev97@gmail.com. There is no charge, and you will get an answer within one month.
If you are not satisfied, you can complain to the Bulgarian supervisory authority, the Commission for Personal Data Protection (Комисия за защита на личните данни) — cpdp.bg. If you live in another EU country you may complain to your own authority instead.
10. Children
This site is not aimed at children and I do not knowingly collect their details through it. I do not work with under-18s. If a booking turns out to be for someone under 18, I will not proceed without a parent or guardian booking it and being present for the session.
11. Changes
If this policy changes, the date at the top changes with it. A change that adds anything collecting data about you brings back a banner with a real choice, and asks everyone again, rather than quietly opting you in.