PRIVACY POLICY FOR THE CLICK AND FIT PLATFORM

1. Data Controller and Contact Information

Data Controller: Lighthouse Software Solutions Ltd.

Registered Address: Varna, 3 Vasil Drumev St.

Contact E-mail (GDPR questions): info@lighthouse-software-solutions.com/

Contact Phone: 0885507650

2. Categories of Personal Data, Purposes, and Legal Basis

We collect and process personal data for the following purposes and on the following legal bases:

• Users (for booking and account): Data collected: Name, Phone, E-mail. Legal Basis: Performance of a contract (Art. 6(1)(b)). Purpose: Account management and booking fulfillment.
• Users (optional/additional): Data collected: Date of birth, Gender, or other non-mandatory data. Legal Basis: Consent of the data subject (Art. 6(1)(a)). Purpose: Improving user experience.
• Payments: Data collected: Transaction status, Amount, Date, Subject of payment. Legal Basis: Legal obligation (Art. 6(1)(c)). Purpose: Financial and accounting purposes. (Card details are not stored by us!)
• Instructors/Business Partners: Data collected: Name, E-mail, Phone of the contact person. Legal Basis: Performance of a contract (Art. 6(1)(b)). Purpose: Managing the Instructor's profile and contractual relations.

3. Recipients of Personal Data

Your personal data may be disclosed to the following categories of recipients:

• Instructors (Partners): Data (Name, Phone, E-mail) are provided to the specific Instructor whose activity you have booked, solely for the purpose of fulfilling the reservation. The Instructor acts as an independent Controller regarding this data.
• Payment Service Providers: The payment provider Stripe processes all bank card data. We do not collect or store credit card data.
• State Authorities: When required by law (e.g., NRA, NSSI, judicial authorities).

4. Storage Periods and Security

Storage Periods: Personal data collected for contractual purposes is stored for the term of the contract and up to [3] years after its termination, and for accounting purposes – as required by law (e.g., 5-10 years). Data collected based on consent is stored until consent is withdrawn.

Location: Your personal data is stored on servers located within the European Union (EU).

Security: We implement all necessary technical and organizational measures to protect your data against unauthorized access, loss, destruction, or alteration.

5. Data Subject Rights

In accordance with the GDPR, you have the following rights regarding your personal data. To exercise your rights, please contact us at the contact information provided in section 1:

• Right of access
• Right to rectification (correcting inaccurate data)
• Right to erasure ("Right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent (if processing is based on consent)

We will respond to your request within 30 days.

6. Right to Lodge a Complaint

If you believe that the processing of your personal data violates the GDPR or applicable law, you have the right to lodge a complaint with the supervisory authority:

Commission for Personal Data Protection (CPDP)

Address: Sofia 1592, 2 Tsvetan Lazarov Blvd.

Website: https://www.cpdp.bg

7. Changes to this Policy

This Policy may be updated. Any changes will be published on this page. We recommend that you periodically review this page to stay informed about how we protect your data.