Privacy Policy

POPOV PROFI EOOD (“we”, “us”, or “our”) acts as the Data Controller under Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation — GDPR) and the Bulgarian Personal Data Protection Act.

• Company Name: POPOV PROFI EOOD
• Company ID (UIC / ЕИК): 207234837
• Registered Address: 22 Anton Chekhov Str., Sofia 1113, Republic of Bulgaria
• Privacy Contact Email: support@popovboxing.com

We collect only the minimum personal data required to provide and administer your course access:

• Account and Contact Data: Your email address, username/password (hashed and stored securely), and unique user identifier.
• Course Progress and Usage Data: Information on completed lessons, viewing timestamps, and platform engagement required to display your course progression.
• Technical and Connection Data: IP address, browser type, device information, and essential logs captured automatically during system operation and security defense.
• Payment Information: We do not process, store, or have access to your credit or debit card details. Payment transactions are executed directly by Stripe. We receive only transaction identifiers, payment status, payment date, and billing country to manage account activation and comply with accounting laws.

We process your personal data under the following legal bases pursuant to Article 6(1) of the GDPR:

• Performance of a Contract (Art. 6(1)(b) GDPR): To register your account, grant you 3-month access to the online video course, authenticate your logins, record your course completion progress, process renewal terms, and provide customer support.
• Compliance with Legal Obligations (Art. 6(1)(c) GDPR): To keep transaction and invoice records in accordance with statutory accounting, tax, and company record-keeping obligations in Bulgaria and the EU.
• Legitimate Interests (Art. 6(1)(f) GDPR): To ensure Platform security, prevent unauthorized account sharing, defend against cyber threats or fraudulent transactions, and maintain technical stability.
• Consent (Art. 6(1)(a) GDPR): Where required by applicable law for specific optional communications, if any. You may withdraw your consent at any time.

We share personal data strictly on a need-to-know basis with trusted third-party service providers (“Processors”) acting under written data processing agreements:

• Supabase Inc.: Database hosting and user authentication management.
• BunnyWay d.o.o. (Bunny.net Stream): Video delivery and content distribution network. Video storage and streaming servers located in Frankfurt, European Union.
• Stripe Inc. / Stripe Payments Europe, Ltd.: Payment gateway services and transaction validation. Processing carried out under standard data protection clauses and certifications.
• Vercel Inc.: Application deployment and frontend hosting infrastructure.
• Cloudflare, Inc.: DNS routing, SSL management, DDoS protection, and web application firewall security services.

Where data is processed outside the European Economic Area (EEA), we ensure adequate safeguards are in place, including European Commission Standard Contractual Clauses (SCCs) or adequacy decisions pursuant to Art. 45/46 GDPR.

Essential Authentication Cookies Only: The Platform utilizes strictly necessary session cookies provided by Supabase solely to authenticate your identity, keep you logged into your member area, and protect access to the course content.

No Analytics or Marketing Trackers: We do not use third-party analytics trackers, behavioral profiling scripts, tracking pixels, or marketing cookies (such as Google Analytics, Meta Pixel, or similar tools). Therefore, no cookie banner for tracking consent is required.

We store your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account and Progress Data: Retained for the duration of your active access period (3 months, plus any subsequent renewals). Following access expiration, account data is retained for a period to be confirmed, to facilitate easy re-enrollment or renewal upon your request, after which it is deleted or permanently anonymized unless dispute prevention requires otherwise.
• Financial and Invoicing Records: Retained as mandated by Bulgarian tax and accounting legislation (Accountancy Act / Закона за счетоводството); exact retention period to be confirmed.
• Technical Server Logs: Retained for system security and audit purposes for a limited period.

As an EU/EEA resident, you have the following rights under the GDPR:

• Right of Access (Art. 15): Request confirmation and a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Request the correction of inaccurate or incomplete personal data.
• Right to Erasure (“Right to be Forgotten”, Art. 17): Request the deletion of your personal data where statutory retention grounds no longer apply.
• Right to Restriction of Processing (Art. 18): Request that we restrict the processing of your data under specific conditions.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21): Object to processing based on our legitimate interests.

To exercise any of these rights, please send an email to support@popovboxing.com. We respond to all legitimate requests within thirty (30) days.

If you consider that our processing of your personal data violates the GDPR or applicable data protection laws, you have the right to lodge a formal complaint with the competent supervisory authority:

Lead Supervisory Authority (Bulgaria):

• Commission for Personal Data Protection (Комисия за защита на личните данни — КЗЛД)
• Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
• Website: cpdp.bg
• Email: kzld@cpdp.bg

You may also contact the national data protection authority in your EU member state of residence.

We may update this policy. The date at the top shows the latest version. Our terms of use are in the Terms of Service.

support@popovboxing.com