Working draft — this text still needs completion and review.

Privacy Policy and Personal Data Protection

Data Controller: Marta Encheva-Malinova — Certified RTT® Practitioner and Hypnotherapist, operating as an independent individual practitioner.

Contact email: [email protected]

Website: martaencheva.com

1. Introduction and Commitment

Protecting your privacy and respecting the confidentiality of the information you share is a cornerstone of my practice. This Privacy Policy explains what personal data I collect when you visit this website, submit an inquiry, or book a consultation, why and how it is processed, how long it is stored, and your rights under the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679).

I operate as an independent individual practitioner, focusing on direct, confidential, and trust-based communication. I do not engage in mass marketing profiling, commercial tracking, or selling personal data to third parties.

2. Personal Data Collected and Legal Basis

I collect only the minimum personal data strictly necessary to communicate with you and carry out our professional work:

A. When submitting a message via the contact form

• Data collected: Your name, email address, message text, optional phone number, and page language.
• Purpose: To read your inquiry and reply to you directly.
• Legal basis: Your explicit consent (Art. 6(1)(a) GDPR) through submitting the form, as well as taking pre-contractual steps at your request (Art. 6(1)(b) GDPR).
• Important: Please do not submit medical records, formal psychiatric history, or confidential legal documents through public web forms.

B. When booking a free discovery call

• Data collected: Name, email address, time zone, and any brief optional notes you choose to share regarding the topic you wish to discuss.
• Purpose: Scheduling and hosting the online video consultation via Cal.com.
• Legal basis: Steps taken at your request prior to entering into a working agreement (Art. 6(1)(b) GDPR).

C. During individual sessions and 1-on-1 collaboration

• Data collected: Contact details, session preparation notes required to craft your bespoke transformational audio recording, and bank payment confirmation for financial reporting.
• Purpose: Delivering the RTT®/hypnotherapy service, producing your custom audio recording, and fulfilling statutory accounting duties.
• Legal basis: Performance of the agreed service (Art. 6(1)(b) GDPR) and compliance with legal accounting and tax obligations (Art. 6(1)(c) GDPR).

3. No Tracking Cookies or Advertising Scripts

The website is intentionally designed to respect your digital privacy:

• No advertising or behavioral analytics: The site does not use Google Analytics, Meta Pixel, or any third-party behavioral tracking or remarketing cookies.
• Locally served assets: Typography, stylesheets, and photographs are served directly from the website's own infrastructure without connecting to external font or CDN services.
• Session storage: Submitting the contact form creates a brief timestamp indicator (marta-contact-accepted) in your browser's session storage for up to 15 minutes to confirm delivery on the thank-you page. It contains no personal data and is cleared when closing the tab.
• Full details are available on the Cookies page.

4. Third-Party Service Providers (Data Processors)

As an individual practitioner, I rely on a limited number of vetted, secure technological service providers:

• Cal.com — Calendar and booking software for scheduling calls. The embed only initializes when reaching the booking section. Cal.com processes your name and email to coordinate the appointment.
• FormFlow / Email Infrastructure — Secure form relay and spam protection service for inbound contact messages.
• Hosting Provider — Infrastructure provider maintaining website availability.

Your data is never sold, rented, or shared with commercial entities for marketing purposes. Personal information is disclosed to authorities solely when strictly required by law (e.g., tax audits or an emergency threat to human safety).

5. Confidentiality in Individual Practice

Everything shared during private conversations and sessions (emotional experiences, personal memories, concerns, and reflections) is held under strict professional confidentiality.

Notes taken during our sessions are used exclusively to create your personalized transformational audio recording. They are kept securely on encrypted, password-protected hardware with no third-party access.

6. Retention Periods

Personal data is retained only for as long as necessary to fulfill the purposes for which it was gathered:

• General contact inquiries: Stored until the inquiry has been resolved, or up to 6 months following our last communication if we do not proceed to working together.
• Discovery call bookings: Kept in the scheduling tool until the call has taken place and for a brief organizational period thereafter.
• Financial and accounting records: Bank statements and transaction records are retained in compliance with statutory Bulgarian tax and accounting requirements (up to 5 to 10 years).
• Personalized audio recording: Delivered directly to you. I do not publish, distribute, or reuse client audio recordings.

Upon expiration of the applicable retention period, data is deleted securely and permanently.

7. Your Rights Under GDPR

Under the GDPR, you have the following rights regarding your personal data:

1. Right of access: To request confirmation of whether your data is processed and to receive a copy.
2. Right to rectification: To request correction of inaccurate or incomplete information.
3. Right to erasure ("right to be forgotten"): To request deletion of your data when it is no longer required or if you withdraw consent, subject to statutory retention obligations.
4. Right to restriction of processing: To ask for temporary suspension of data processing under certain circumstances.
5. Right to data portability: To receive your personal data in a structured, commonly used format.
6. Right to object: To object to processing based on legitimate interests.
7. Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.

To exercise any of these rights, please contact: [email protected]. Inquiries are handled promptly and at the latest within 30 days.

8. Supervisory Authority

If you believe that the processing of your personal data infringes data protection legislation, you have the right to lodge a complaint with the relevant supervisory authority:

Commission for Personal Data Protection (CPDP)

• Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
• Email: [email protected]
• Website: cpdp.bg

9. Updates to This Policy

This Privacy Policy may be updated periodically to reflect changes in legal standards or operational practices. The current version will always be published on this page with the date of the latest update.

Last updated: October 2026