Privacy Policy
Last updated: 23 October 2026
This policy explains what personal data we process when you visit this website, contact us or take part in one of our sessions, and the rights you have. The controller responsible for processing is:
Crafted Visions Ltd.
22 str. Svilenitsa, 1463 Sofia, Bulgaria
Email: crafted.visions@outlook.com · Phone: on request by email
Hosting
The site is hosted on GitHub Pages (GitHub, Inc., USA). When you visit, your browser transmits technical data (including your IP address, browser type and time of access) to the host, which processes it in server log files to deliver the site securely. Legal basis: our legitimate interest in operating a stable, secure website (Art. 6(1)(f) GDPR).
Fonts
The “Spectral” and “Hanken Grotesk” typefaces are hosted on our own website. Loading them does not connect your browser to Google or any other font provider.
Contact & inquiry forms
When you use the contact or team-building inquiry form, the data you enter (such as name, email, company, and your message) is transmitted through our forms processor Formspree (Formspree, Inc., USA) and delivered to us by email. Our email is hosted by Microsoft (Outlook / Microsoft 365), where all correspondence with us is stored. We use it solely to respond to your request. Legal basis: steps prior to entering a contract and our legitimate interest in answering enquiries (Art. 6(1)(b) and (f) GDPR). We keep enquiry correspondence for as long as needed to handle your request and to meet any legal retention periods.
Newsletter
If you subscribe, your email address is processed by our newsletter provider Mailchimp (Intuit Inc., USA) to send you our updates. Subscription uses a confirmation (double opt-in) step; you can unsubscribe at any time via the link in every email. Legal basis: your consent (Art. 6(1)(a) GDPR).
Bookings & payment
Individual workshop bookings are paid through Stripe (Stripe, Inc. / Stripe Payments Europe Ltd.). Payment and billing details are entered on Stripe’s checkout and processed by Stripe as an independent controller/processor under its own privacy policy. We receive only limited payment information, such as the card type and its last four digits, and never your full card number or security code. Team-buildings are normally paid by bank transfer, or via a secure online card-payment link; for invoicing, we process the client’s billing details (such as company name, address, VAT number and contact person). Invoicing and accounting data are shared with our accountant and, where required by law, with the tax authorities. Legal basis: performance of a contract and our legal obligations under accounting and tax law (Art. 6(1)(b) and (c) GDPR).
Workshops and team-building sessions
To organise and deliver a booked session, we use the details you give us when booking or contacting us, such as your name, email address and, where you use it, your phone number. For team-buildings, we work with the client’s contact person and need only the number of participants, not their names. We do not share participants’ names or contact details with artisans or venues; they receive only the information needed to prepare the session, such as the number of participants. Legal basis: performance of a contract and our legitimate interest in organising the sessions our clients book (Art. 6(1)(b) and (f) GDPR).
Photos and video
We take photos and video during sessions and may use them for reference and marketing purposes, including on our website and social-media channels. Recognisable participants are published only with their written consent, collected on a consent form before the session (Art. 6(1)(a) GDPR); taking part never depends on giving this consent. For participants under 18, consent is given by a parent or guardian. You can withdraw your consent at any time by emailing us: we will then stop using the images in question and remove them from our website and social-media channels, although material already printed or distributed cannot be recalled. Where we engage a photographer, they act on our behalf and under our instructions. For team-buildings, the client’s name and, where agreed, its logo are used as set out in our Terms & Booking Conditions.
Allergies and health information
If you tell us or the artisan before a session about an allergy, sensitivity or other condition relevant to taking part, we use this information only to keep you safe during the session. We do not record it or keep it afterwards. Legal basis: your explicit consent, given by sharing the information with us (Art. 9(2)(a) GDPR).
Social platforms and WhatsApp
Our site links to Instagram and WhatsApp. We do not embed their tracking on our pages; their data practices apply only once you follow a link and interact with those services. If you contact us via WhatsApp, or receive booking details from us that way, your messages are processed by WhatsApp (WhatsApp Ireland Ltd. / Meta) under its own privacy policy.
International transfers
Several providers above (GitHub, Formspree, Mailchimp, Stripe, Microsoft and, where you use it, WhatsApp) are based in, or transfer data to, the USA and other countries outside the EU/EEA. Where that is the case, transfers are safeguarded by appropriate mechanisms such as the EU Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. Because we work with clients and artisans both inside and outside the EU, personal data you share with us may also be processed in Tunisia for the sole purpose of delivering a booked experience.
Retention
We keep personal data only as long as necessary for the purpose it was collected and for any statutory retention periods (for example, accounting records under Bulgarian law). Newsletter data is kept until you unsubscribe. Signed photo and video consent forms are kept for as long as we use the related images, so that we can demonstrate consent.
Your rights
- Access, rectification and erasure of your data
- Restriction of, and objection to, processing
- Data portability
- Withdrawal of consent at any time (e.g. newsletter, photos and video), without affecting prior processing
- To lodge a complaint with a supervisory authority
To exercise any of these, email crafted.visions@outlook.com. You may also lodge a complaint with the Bulgarian supervisory authority, the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria (cpdp.bg), or with the data-protection authority in your country of residence.