Last updated: 25 August 2026

Privacy

1. Controller

The controller is NatuRali LLC (Натурали ООД), UIC 205549204, 21 Koprivshtitsa St, Burgas 8001, Bulgaria, represented by Ralitsa Markova. Contact: book@naturali.bg, +359 883 691 800.

2. Data we process

When you contact us by email, phone or an enquiry form, we process the name and contact details you provide, your chosen format and the content of your enquiry. The astrology form does not ask for birth details at the first enquiry stage.

For the experience interest list, we process your name, email, the type of experience selected and a note if you choose to add one.

When you request a place on a course, we process your full name, phone, email, whether you have practised yoga before, your preferred payment method and a note if you choose to add one. The course form does not ask about health.

When you use book.naturali.bg, data needed for an account, booking, confirmation, payment and, where applicable, a Participation Declaration are processed. Exact fields are shown before submission.

For basic traffic measurement, we use Plausible without cookies, local storage or persistent identifiers. It processes the page visited, referrer, approximate country, device and browser type and predefined events. For a form, a start, a submission attempt and a confirmed enquiry may be recorded. Names, email addresses, telephone numbers, notes and field contents are not sent. The IP address and browser information are used technically to create a temporary daily identifier, but are not stored in raw form and cannot link visits across different days.

If you consent to “Analytics”, we load Google Analytics 4. Google may receive technical device and browser data, the IP address used for the network connection, pages visited, referrer, date and time, cookie identifiers, consent status and predefined events.

If you consent to “Marketing” and a campaign is active, we may load Google Ads conversion measurement and Meta Pixel. They may receive technical visit data, advertising and browser identifiers, advertising click parameters and predefined campaign measurement events.

We never send Google or Meta names, email addresses, telephone numbers, birth details, notes, free text or other form contents. A confirmed enquiry event is recorded only after a genuinely successful submission.

The consent mechanism stores the selected categories, notice version and time of choice in localStorage under the key naturali_consent_v1. This information is not used for tracking.

After consent for Analytics or Advertising measurement, the permitted utm_source, utm_medium, utm_campaign and utm_content parameters may be stored in sessionStorage under the key naturali_campaign_v1. They are used to connect an enquiry with the source of the visit and may be included in the email sent to NatuRali. We do not store gclid, fbclid, search terms or field contents.

Hosting may process an IP address, date and time, requested page, browser and error information in minimal technical logs. To protect the form from automated abuse, the server may keep a one way daily code derived from the network address and submission times for up to 10 minutes. Form contents are not written to that technical record.

3. Purposes and legal bases

• Answering an enquiry and taking requested steps before a contract: Article 6(1)(b) GDPR.
• Entering and performing a contract, including enrolment and participation in a course: Article 6(1)(b) GDPR.
• Sending one notice about the next confirmed experience: consent under Article 6(1)(a) GDPR.
• Meeting accounting, tax and consumer law obligations: Article 6(1)(c) GDPR.
• Security, abuse prevention and establishing or defending legal claims: legitimate interests under Article 6(1)(f) GDPR where necessary and proportionate.
• Aggregated Plausible measurement: legitimate interests under Article 6(1)(f) GDPR to the extent personal data are technically processed.
• Google Analytics 4: consent under Article 6(1)(a) GDPR.
• Google Ads and Meta Pixel campaign measurement: consent under Article 6(1)(a) GDPR.

Optional information is stored on or read from a device only after prior consent under applicable electronic privacy rules. Strictly necessary storage for remembering a choice and maintaining security does not require this consent.

Refusing analytics or marketing technologies does not restrict access to the public pages, forms or services.

An ordinary enquiry or booking does not subscribe you to a newsletter or other marketing. The interest list is used only for the specific notice requested by the person.

4. Health data

NatuRali does not ask for diagnoses, injuries, medication, panic attacks, medical history or other health conditions, in any form on this site, including the course booking form. Please do not send this information by email or in a free text field.

If you have an injury or a limitation your teacher should know about before a practice, tell them in person. There is no need to write it down anywhere and we do not create such a record.

Unsolicited health information is not used for assessment, is not copied to another record and is erased as soon as it is identified. Questions about whether physical practice is suitable for a condition should be addressed to a medical professional.

5. External schedule and Fitsys

The schedule and bookings are provided by Fitsys at book.naturali.bg. External content does not load automatically. A connection is made only when you open the external calendar.

Your browser then sends technical information to Fitsys. When you create an account or book, Fitsys processes the information you enter as the booking system provider for NatuRali.

After a confirmed booking, Fitsys may return the browser to naturali.bg only with an opaque EVENT_HASH value. NatuRali checks the format of the value in the browser, records the event on the dedicated confirmation page and removes EVENT_HASH from the address before Google or Meta are loaded or receive data. EVENT_HASH contains no booking fields and is not sent to Google or Meta.

The naturali.bg consent mechanism does not control Fitsys technologies. NatuRali does not deploy Google or Meta tags on book.naturali.bg, use linking between the domains or send field contents, advertising identifiers or tracking parameters to Fitsys.

6. Recipients and international transfers

Data are disclosed only as necessary to our hosting provider, Plausible Insights OÜ for aggregated statistics, Fitsys, a payment provider where electronic payment is selected, accountants, lawyers or public authorities where a legal basis exists.

Following the relevant consent, recipients may include Google Ireland Limited for Google Analytics 4 and Google Ads and Meta Platforms Ireland Limited for Meta Pixel. Depending on the service and contractual terms, a provider may act as a processor, a joint controller for the initial collection and transmission or an independent controller for subsequent processing.

Google and Meta may use companies and subprocessors outside the European Economic Area. Their stated transfer mechanisms apply, including an adequacy decision or Standard Contractual Clauses where relevant. See the Google Privacy Policy (opens in a new window) and Meta Privacy Policy (opens in a new window).

NatuRali does not sell or rent personal data for marketing. Form contents are not provided to Google or Meta.

7. Retention

An enquiry that does not lead to a booking is deleted after the communication ends unless needed for a legal claim. An interest list request is kept until information about the next confirmed experience is sent or until consent is withdrawn. It is then deleted unless the person explicitly asks to remain for a future notice.

A course request is kept until the end of the course. A request for which no place is confirmed is deleted within two weeks of the course starting.

Booking, payment and accounting data are retained for applicable statutory periods. A Participation Declaration is retained while needed to evidence informed participation and for an applicable claim period. Technical logs are kept for the shortest period needed.

The consent choice is stored in localStorage under the key naturali_consent_v1 for 6 months. The record is then removed and a new choice is requested. Permitted campaign source parameters are kept in sessionStorage only until the browser session ends.

Aggregated Plausible data are retained while the NatuRali account remains active or until deleted earlier. Plausible does not store raw IP addresses or persistent visitor identifiers.

Google Analytics 4 event and user data are retained for 2 months. This setting does not automatically remove aggregated standard reports. Google Analytics cookies may remain for up to 2 years, Google Ads measurement cookies for up to 90 days and standard Meta Pixel cookies for up to 90 days unless deleted earlier or restricted by the browser.

Where Google or Meta determine their own subsequent retention, their policies and settings apply. NatuRali does not upload form contents or customer lists to these platforms.

8. Your rights and withdrawal

You may request access, correction, deletion, restriction, objection and, where applicable, portability.

Consent for “Analytics” and “Marketing” can be changed or withdrawn at any time through the “Privacy settings” link in the footer of every page. Withdrawal applies to future processing and does not affect the lawfulness of processing before it.

When consent is withdrawn, the relevant tags are blocked and optional cookies set by naturali.bg are removed where technically possible. For information already received by Google or Meta, you may exercise your rights through NatuRali or the relevant provider.

Write to book@naturali.bg. You may complain to the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, cpdp.bg (opens in a new window).

9. Automated decisions and advertising limits

NatuRali does not use automated decision making with legal or similarly significant effects.

This configuration does not use Google Signals, Enhanced Conversions, Customer Match, Meta Advanced Matching, customer list audiences, remarketing audiences or similar audiences based on website visits. Birth, health or other sensitive information is not sent to analytics or advertising platforms.

Access is limited to necessary people and providers. Full payment card details are not stored on naturali.bg.

10. Changes

This policy is updated when a purpose, provider, data category, retention period or technology changes. If new processing is not covered by the existing choice, optional tags remain blocked until updated information is provided and fresh consent is requested where required.