Effective from 03.09.2026
An integral part of the General Terms and Conditions for use of the LIVRA.bg platform.
1. Who processes your personal data
The data controller is „LYUBYA EOOD, entered in the Commercial Register and the Register of Non-Profit Legal Entities with UIC BG208607869, with registered office and management address at: town of Botevgrad, 15 Slaveykov St., floor 3, apartment 5.
Owner and operator of the LIVRA.bg platform, accessible at www.livra.bg.
How to contact us regarding personal data matters:
- Email: info@livra.bg
- Correspondence address: Botevgrad, 15 Slaveykov St, fl. 3, apt. 5
- contact person: Tsvetelina Ralcheva
2. Whom this policy applies to
The policy describes how we process the personal data of:
- trainees - people who search for and book workouts through the platform;
- coaches and sports clubs - individuals and organisations that publish workouts and accept bookings;
- guests without a profile — anyone who browses the website or writes to us via the contact form.
3. When Livra is an administrator and when not
This is important, which is why it comes before everything else.
Livra is an administrator based on the data in your profile, the technical data regarding the use of the platform and the data concerning bookings made through it.
What the coach sees. When you book a workout, the trainer or club organising it sees first name and surname in the list of registered participants. Your email address and telephone number are not provided of the trainer — they remain with Livra and are used only for notifications sent to you by the platform.
Livra is not an administrator of the data that the coach or club processes for their own activity — attendances, health notes, season tickets, receipts, personal notes. If you decide to give the coach additional data about yourself directly, this happens outside the platform and at your discretion. From this moment the coach or the club is an independent controller to these data and is solely responsible for them.
Livra is not a party to the relationship between the trainee and the trainer and does not control what the trainer does with the data outside the platform.
4. What data we collect
4.1. When you create a trainee profile
- first name and surname
- date of birth — to confirm you are 18 or over
- email address — for logging into the profile and for reservation notifications
- telephone number
- password (stored only in encrypted form — we cannot see it)
- profile picture, if you choose to upload one
- preferred sports and favourite activities, if you tick them
4.2. When you create a coach profile
- first name and surname
- email address and telephone number
- city and location
- sports and disciplines that you coach
- short biography
- types of workout that you offer
- profile picture and photos for the workouts, if you upload any
4.3. When you create a sports club profile
- club name
- city and address of the site or venue
- full name of the contact person
- email address and telephone number
- description, logo and photos, if you upload any
4.4. What is public
The coach's and club's profile is public. The name, photo, city, bio, sports and training schedule are visible to any visitor, including unregistered ones.
The trainee's profile not public.
4.5. Data generated while using the platform
- made reservations and cancelled reservations
- waiting list entry
- profiles you've followed via the „Follow me“ button“
- messages exchanged via the chat on the platform
- history of attendance, rejections and no-shows
4.6. Technical data
- IP address
- browser type and version, operating system, device type
- date and time of visits, pages viewed, traffic source
- cookie and similar technology data
The details are in Cookie Policy.
4.7. When you write to us
Via the contact form: name, email, telephone, subject and message content.
4.8. What we do NOT collect
Livra does not collect or process bank card and bank account details in connection with training payments. Training payments are settled directly between you and the coach or club, outside the platform.
5. Why we process your data and on what grounds
| Purpose | Data | Grounds under the ARVI | Deadline |
|---|---|---|---|
| Creation and maintenance of a profile | The data from section 4.1–4.3 | Art. 6(1)(b) – performance of a contract | Whilst the profile is active + 6 months |
| Verification that the user is 18 years of age or older | Date of birth | Art. 6(1)(e) – legitimate interest | While the account is active |
| Reservations, confirmation, modification and reminder notices | Name, email, phone number, booking details | Art. 6(1)(b) – performance of a contract | While the account is active |
| Displaying the public profile of the coach and the club | The data from sections 4.2–4.3 | Art. 6(1)(b) – performance of a contract | While the account is active |
| Communication via the chat in the platform | Message content | Art. 6(1)(b) – performance of a contract | While the account is active |
| Subscriptions, invoices, accounting | Coach or club details, payment details | Art. 6(1)(c) — legal obligation | 10 years in accordance with the Accountancy Act |
| Platform security, abuse prevention | IP address, logs | Art. 6(1)(e) – legitimate interest | 12 months |
| Response to contact form enquiry | Name, email, phone number, message | Art. 6(1)(e) – legitimate interest | 1 hour |
| Traffic analysis and platform enhancement | Technical data, cookie data | Art. 6(1)(a) – consent | See the Cookie Policy |
| Marketing and advertising | Technical data, cookie data | Art. 6(1)(a) – consent | See the Cookie Policy |
6. Automated decision-making
Livra does not make automated decisions, that produce legal effects on you or similarly significantly affect you.
On the home page, we display recommended workouts based on your indicated preferences and favourite sports. This is a content arrangement for convenience and does not lead to legal consequences.
7. Registration and login via Facebook and Google
The platform allows login via Facebook and Google. If you choose this method, we receive your name and email address from the respective service in order to create or access your profile. We do not receive your Facebook or Google password.
The processing of data by Meta and Google is governed by their own policies:
8. Who else sees your data
8.1. Coaches and clubs
See section 3. When booking, your first and last name become visible to the training organiser. Your email and phone number are not provided to them.
8.2. Suppliers who work on our assignment
| Supplier | What for | Where |
|---|---|---|
| Server 1 (server1.bg) | Website and database storage | Bulgaria (EU) |
| Google Ireland Ltd. | Google Analytics 4 — traffic statistics | EU, with transfer to the US |
| Meta Platforms Ireland Ltd. | Meta Pixel — ad measurement | EU, with transfer to the US |
| Microsoft Ireland Operations Ltd. | Microsoft Clarity — session recordings and heatmaps | EU, with transfer to the US |
| Server 1 (server1.bg) | Sending confirmations and reminders | Bulgaria (EU) |
| External accountant | Invoices and reporting | Bulgaria |
Analytics, Pixel and Clarity are triggered only upon your consent in the cookie banner.
8.3. State bodies
We provide data to state authorities only when required by law — for example, to the NRA, the Ministry of Interior, the CPC, or a court, in the exercise of their legal powers.
8.4. What we don't do
We do not sell your personal data or provide it to third parties for their own marketing purposes.
9. Transfers outside the European Economic Area
Google, Meta and Microsoft can transfer data to servers in the US. The transfer takes place on the basis of EU–US Data Privacy Framework (EU–U.S. Data Privacy Framework), under which all three companies are certified, as well as on the basis of the European Commission's standard contractual clauses.
Outside of these cases, we do not transfer data outside the EEA.
10. How long we keep your data
The deadlines are in the table in section 5. In addition to them:
- Following profile closure The data is deleted within a period of up to 6 months, unless the law requires us to keep it longer.
- Reservation data are anonymised after closing the profile and remain only as statistics without any link to a specific person.
- Accounting and tax documents are kept within the statutory time limits, regardless of the closure of the profile.
11. Age
To create a profile in LIVRA, you must be at least 18 years. Upon registration, you provide your date of birth so that we can confirm this.
If the training session is for a child, the profile must be created and the booking made by a parent or guardian, who is responsible for the child's participation.
If we learn that an account has been created by a person under the age of 18, we will close it and delete the data.
12. Your rights
Under the GDPR, you have the right:
- for access - to obtain a copy of the data we process about you;
- for correction — to correct inaccurate or incomplete data; you can change most of these yourself from your profile;
- for deletion — to request that your data be erased when it is no longer necessary or you have withdrawn your consent;
- to restriction processing, whilst we verify an objection or accuracy;
- for portability — to receive your data in a structured, machine-readable format;
- to the objection to object to processing based on legitimate interests;
- withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
How: write in info@livra.bg. We shall respond within one month. If the request is complex, the time limit may be extended by two months, of which we shall notify you.
We may ask for proof of identity before providing access to data – to ensure we don't hand it over to someone else.
Cookie consent withdraw at any time from Cookie Policy.
Complaint you can submit to the Commission for Personal Data Protection: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., cpdp.bg, kzld@cpdp.bg. You also have the right to refer the matter to court.
13. Security
We protect your data with technical and organisational measures: encrypted connection (HTTPS), storing passwords only in hashed form, restricted database access only to persons who need it, and regular platform updates.
We will never ask for your password by email or phone. If you believe that someone has gained access to your account, change your password and contact us immediately.
No method of transmission or storage is absolutely secure. In the event of a security breach that is likely to result in a high risk to you, we will notify you in accordance with Article 34 of the GDPR.
14. Cookies
The use of cookies and similar technologies is described in the separate Cookies Policy.
15. Changes to this policy
We may update the policy in the event of changes to legislation, the platform or the way we process data. The current version is always published on this page with an effective date.
In the event of significant changes, we will notify registered users by email or via a message on the platform.
This policy has been adopted by „LYUBYA“ EOOD and enters into force on 03.09.2026.
Previous version: 19.03.2026.
biscuits.