Privacy & cookies — Flow Outdoor

1. Controller and contact

Flow Outdoor is operated by „Байдо“ ЕООД (bajdo ltd.), company number 205284510, at 26 Sokolitsa Street, Smolyan, Bulgaria. The company supplies standalone lessons and controls website/enquiry data. VAT status remains to be confirmed.

Privacy questions and requests: info@flowoutdoor.eu · +359 884 870 587. Data protection officer details will be added if one is appointed. This draft covers the website, enquiries, bookings and activity arrangements.

2. Information and sources

An enquiry needs your name, email, chosen service/programme, dates and participant count. A phone number is optional. Arrangements may require age, ability, a parent/representative contact and invoice details. Equipment fitting uses height, weight, shoe size and helmet preference for each participant.

Information usually comes from you. For families, school or corporate groups it may come from a parent or organiser, who must have a basis to share it. Participants receive the applicable Article 14 GDPR notice. A national ID number or ID copy is not needed for an ordinary enquiry.

Website visits may generate server records of IP address, time, browser and errors. WordPress forms for lessons, programmes, private groups and companies store enquiries in administration and send a team notification and customer receipt. Technical data, including IP address, browser and device, is also recorded. Email logs are configured for 14 days; automatic enquiry deletion is not configured. Forms labelled as demos process input only in the browser.

3. Purposes and legal bases

• Enquiries and contracts: steps you request before a contract and its performance, Article 6(1)(b) GDPR. A separate basis is assessed for participants who are not contracting parties.
• Accounts and statutory duties: Article 6(1)(c), where a specific obligation requires the information.
• Security, abuse prevention and legal claims: legitimate interests under Article 6(1)(f), after assessing necessity and people’s rights, particularly children’s rights.
• Newsletters and promotional photographs: separate, specific, voluntary consent if those activities are introduced. Consent is not a booking condition.

Required fields are marked. Without necessary contact and activity details, we may be unable to respond or arrange the requested service. We do not seek blanket “GDPR consent” for every operation.

4. Children, health information and photographs

A parent or authorised representative makes children’s enquiries. Do not enter diagnoses, allergies, medical documents or other health information in the general form. If an activity needs such information, a limited scope, protected channel, access and deletion period must be defined before collection, together with an Article 6 basis and applicable Article 9 exception. Contract performance alone does not authorise health-data processing.

Consent to publish identifiable photographs is separate from enrolment, with specified purposes and channels. Refusal does not prevent participation. For a child, the person entitled to consent and the child’s interests must be established. Withdrawal stops future consent-based use; it does not invalidate earlier lawful use.

5. Recipients, security and transfers

For travel enquiries, necessary information may be passed to Into the Wild BG EOOD (company number 207463615) for the offer, contract and arrangements. The organiser controls processing for its own contractual and statutory duties; specific roles must be confirmed in the agreement between the companies. Necessary information may be shared with instructors/coordinators, technical and email providers, accountants, contracted transport/accommodation partners, insurers and competent authorities. Each recipient’s role is assessed; processors acting for Flow need an Article 28 GDPR agreement.

To confirm: actual providers, processing locations, access/security controls and transfers outside the EEA. Where transfers occur, the applicable adequacy decision or other valid safeguard and access to information about it must be identified. EU-only storage is not claimed without verification.

Automated ChatGPT bookings, payments, profiling and decisions with legal effects are not active in this preview. Any future integration requires assessment of the provider, transmitted data, roles, transfers and human oversight.

6. Retention

Information is not kept indefinitely. Each category needs a period or verifiable criterion reflecting its purpose, legal obligations and any necessary dispute handling.

• Enquiries without a contract: until communication ends and a limited follow-up period approved by Flow [to confirm].
• Contracts and accounting records: applicable statutory and limitation periods, with a schedule confirmed by the accountant and legal adviser.
• Operational fitting/safety information: only as needed for the service, with a separate assessment for incidents or claims.
• Marketing: until withdrawal or an approved inactivity period; a minimal suppression record may remain to respect an opt-out.
• Logs and backups: the actual providers’ schedules [to confirm].

The final version must contain approved retention arrangements. This draft does not certify an implemented automatic deletion process.

Analytics, advertising and cookie choices

Optional analytics and advertising tools are used only after a separate purpose-specific choice, on the basis of consent. We do not send personal form data to them. The choice log retains version, time, categories, language and a random identifier for up to 180 days to demonstrate and respect the choice. It excludes contact details and permanent IP records. Change or withdraw your choice in the footer. Providers, technical data and lifetimes are described in the Cookie policy.

SnowExpo prize draw participation

For the Flow Outdoor game, we use your name, verified email and optional telephone number, together with your confirmation that you are 18 or over, the rules version accepted and the confirmation time. We retain entry status, the voucher issued, its validity and redemption status, and the result of handing messages to the email transport. We do not require national identification numbers or payment details.

Validating entries, conducting the draw, providing and administering vouchers and necessary game messages fulfil the game rules at your request — Article 6(1)(b) GDPR. Necessary technical information is used to prevent abuse on the basis of legitimate interests — Article 6(1)(f), respecting your rights. Where a specific legal reporting obligation applies, processing for it is based on Article 6(1)(c).

Future email offers require separate, voluntary consent — Article 6(1)(a). The checkbox is not preselected and the choice is confirmed after email verification. You can withdraw consent through info@flowoutdoor.eu, without affecting participation or the voucher.

Access is limited to authorised staff and necessary hosting and email providers. The winner’s email and telephone number are not published. Data is kept for as long as needed to run the game, provide and administer vouchers (valid for one year from issue), handle related requests and meet applicable legal obligations. This does not mean indefinite retention; information no longer needed must be deleted. Your rights and the controller contact are explained below.

7. Your rights

Subject to the applicable conditions, you have rights of access, correction, erasure, restriction, portability and objection, and may withdraw consent. Objection to direct marketing is respected without a further balancing test. Erasure is not absolute where law requires retention or information is needed for a legal claim.

Send a request to info@flowoutdoor.eu · +359 884 870 587, using the subject “Personal data”, describing your request and giving enough information to locate the record. Reasonable doubt may require proportionate identity verification; an ID copy is not automatically required.

Requests are answered without undue delay, within one month. Where complexity or volume permits, this can be extended by two further months with reasons given during the first month. Exercising rights is generally free. You may complain to the Bulgarian data protection authority or another competent supervisory authority, and seek judicial relief.

Cookies

1. What the website uses

Cookies are small browser records. Related technologies include pixels, local storage and embedded third-party content. Necessary and functional cookies support the website and remember your language and choices.

From 8 October 2026, Google Analytics 4 is connected and loads only after analytics consent. Meta Pixel is connected and loads only after separate marketing consent. Their current availability is shown in Detailed settings. Adding or changing a provider prompts a new choice. The website and enquiry forms remain available if you refuse.

2. Functional cookies and lifetimes

WordPress sign-in and protected administrative previews can use additional technical sessions. These are not advertising tools and are not required for public browsing.

Forms do not store entered personal data in localStorage or sessionStorage. Submitted enquiries are processed under the privacy policy. Caches hold public files and pages; submitted enquiries and customer confirmations are not cached as public content.

3. Optional analytics and advertising

Analytics — Google Analytics 4. Only with consent for this category, it measures visits, useful pages, contact actions and successfully received enquiries. The _ga and _ga_* identifiers are configured to expire within 180 days without automatic extension. Google code does not load before consent and no analytics signals are sent after refusal. Google Signals, personalisation and Google Ads are disabled in this integration.

Advertising — Meta Pixel. Only with separate advertising consent, it measures visits and enquiries from Facebook/Instagram campaigns and can support advertising audiences. Meta may use _fbp (browser identifier) and _fbc (advertising click identifier, when present), normally for up to 90 days from creation or renewal. Browsers may shorten this lifetime. Meta may also use its own identifiers depending on its settings. Code does not load if advertising is refused. Automatic Advanced Matching and Automatic Events must also be disabled in the Meta account.

We do not send names, emails, telephone numbers, equipment information or free-text form messages to these tools. A successful enquiry is recorded as a lead, not a purchase or confirmed booking. Google receives page addresses without query parameters or fragments; Meta is permitted only on addresses without personal information in parameters.

Google and Meta may process technical data such as IP address, browser, device and their own identifiers. Data is not made anonymous simply by excluding your contact details. Applicable terms and international-transfer safeguards are checked when connecting providers, and the policy is updated before collecting data. Details: Google Privacy Policy and Meta Cookies Policy.

4. Acceptance, refusal and changes

Accept enables all connected optional categories. Reject and Necessary only disable both analytics and advertising; functional cookies remain. Detailed settings lets you choose each category separately. Unconnected tools cannot receive consent in advance.

Open Cookie settings in any Flow page footer to change or withdraw your choice. Withdrawal stops the relevant code, deletes its cookies accessible to the website and reloads the page. It does not undo processing before withdrawal or automatically erase information already received by a provider.

Choices are saved for 180 days. A minimal administrative record contains version, time, categories, language and a random identifier, and is retained for up to 180 days to demonstrate and respect the choice. It does not contain a name, email, telephone number or permanent IP record. A short-lived rate limit protects against abuse. Deleting cookies through your browser displays the panel again.

Scrolling, silence and pre-ticked boxes are not consent. Refusal does not restrict access to content or enquiries. Privacy questions and rights: info@flowoutdoor.eu.

5. Photos, fonts and external links

Programme and homepage photographs, available reviewer portraits and fonts are served from flowoutdoor.eu. Google Maps and original-review links open a separate website with its own policies.

Before adding an embedded map, video or another third-party module, we assess the information shared with the provider and any requirement for prior consent.