Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Peak Care EDPK
UIC/EIK: 208465067
Stragite 08, Apt. 39D
2770 Bansko, Bulgaria
Email: peakcare@peak-care.com
Phone: +359 89 843 6561
Website: peak-care.com

2. General information on data processing

We process the personal data of our users only to the extent necessary to provide a functioning website and our content and services, or where you have given your consent. The legal bases are in particular Art. 6(1)(a) (consent), (b) (contract or pre-contractual measures) and (f) (legitimate interest) GDPR.

3. Hosting & server log files

This website is hosted by Netlify (Netlify, Inc., USA). When you visit the site, technically necessary data is recorded automatically in server log files (including an anonymised/shortened IP address, date and time, the file requested, the amount of data transferred, referrer, browser and operating system information). This serves the secure and stable operation of the website (Art. 6(1)(f) GDPR). A data processing agreement is in place with the provider; any transfer to the USA takes place on the basis of appropriate safeguards (including EU Standard Contractual Clauses).

4. Cookies & consent

We use technically necessary cookies to ensure the operation of the website. Cookies and similar technologies that are not strictly necessary (in particular for reach measurement/analytics) are used only with your express consent via our consent banner (Art. 6(1)(a) GDPR, Section 25(1) TTDSG).

Until you give your consent, analytics storage is denied by default (default setting: “denied” in Google Consent Mode). You can withdraw your consent at any time with effect for the future by deleting the stored choice in your browser (website data/cookies for peak-care.com) and reloading the page — the banner will then appear again.

5. Google Analytics 4

After you consent, we use Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics uses cookies or similar technologies to evaluate the use of the website in anonymised form (e.g. page views, approximate origin, devices used). We use Google Consent Mode v2: without consent, no analytics cookies are set.

The legal basis is your consent (Art. 6(1)(a) GDPR). A transfer of data to Google in the USA cannot be ruled out; it takes place on the basis of the EU Standard Contractual Clauses. You can withdraw your consent at any time (see section 4). Further information: Google Privacy Policy.

6. Fonts

The Inter typeface is provided locally by our website. No connection to Google Fonts servers is established for this font integration.

7. Contact & contact form

If you contact us via the contact form or by email, we process the data you provide (e.g. name, email address, message) in order to handle your enquiry. The form is submitted through a function of our host Netlify; the enquiry is then delivered to us by email via the delivery service Brevo (Brevo SAS, Paris, France), which acts as a processor on our behalf. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or (f) GDPR (handling of enquiries). The data is deleted as soon as it is no longer required to fulfil its purpose and no statutory retention obligations apply.

To protect against spam and automated requests we use Cloudflare Turnstile (Cloudflare, Inc., San Francisco, USA). Technical data such as your IP address and browser characteristics are transmitted to Cloudflare to determine whether the request comes from a human. The legal basis is our legitimate interest in an abuse-free contact form (Art. 6(1)(f) GDPR). Any transfer to the USA takes place on the basis of the EU-US Data Privacy Framework or, alternatively, the EU Standard Contractual Clauses.

7a. Contact via WhatsApp and digital assistant

If you write to us via WhatsApp (+359 89 843 6561), we process your phone number, profile name, messages and the photos you send in order to handle your enquiry (Art. 6(1)(b) GDPR, pre-contractual measures, or (f) GDPR, handling of enquiries). The service is provided by WhatsApp Ireland Limited, Dublin, Ireland (Meta group). A transfer to the USA cannot be ruled out; according to the provider it takes place on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

First replies on WhatsApp may be given by an AI-supported assistant from Meta. It records your request and hands it over to a member of Peak Care staff. Binding statements on services, appointments and costs are made exclusively by a member of staff. Please do not send identity, bank or health data via WhatsApp.

Chats that do not lead to an order are deleted after six months at the latest; otherwise the statutory retention periods apply. Further information: WhatsApp Privacy Policy.

8. Your rights as a data subject

Under the GDPR you have in particular the following rights:

• Access to the data processed about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, an informal message to peakcare@peak-care.com is sufficient.

9. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR (Art. 77 GDPR).

10. Data security

This website uses SSL/TLS encryption (recognisable by “https://” and the lock symbol in the address bar) to protect the transmission of your data.

11. Currentness of this privacy policy

We adapt this privacy policy as soon as changes to the data processing we carry out make this necessary. The current version published on this page applies.