Privacy Policy

Last updated: 30 June 2026  ·  banskoclub.com

1. Who we are and what this policy covers

EQISTAY operates the website banskoclub.com (the "Site"), which presents the Bansko Club investment project. This policy explains what personal data we collect when you use the Site, why we collect it, how we use it, and what rights you have under the EU General Data Protection Regulation (GDPR) and Bulgarian data protection law.

We take your privacy seriously. We do not sell your personal data to third parties and we do not use it for any purpose other than those described below.

2. What data we collect and why

A. Investor enquiry form

When you submit the "Request full details" form on the Site, we collect:

• First and last name
• Email address
• Phone number / WhatsApp (optional)
• Country of residence (optional)
• Investment interest (Track A, Track B, or both)
• Any message or question you include
• IP address (collected automatically for security/spam prevention)

Legal basis: Legitimate interests (Art. 6(1)(f) GDPR) — to respond to your enquiry about the investment project — and your consent given by ticking the checkbox and submitting the form.

How we use it: To respond to your enquiry, send you requested information about the Bansko Club investment opportunity, and follow up as appropriate. We will not add you to unrelated mailing lists.

Retention: Enquiry data is retained for up to 3 years from the date of submission, or until you ask us to delete it, whichever comes first.

B. Google Analytics

We use Google Analytics 4 to understand how visitors use the Site — which pages are visited, how long people stay, and where traffic comes from. This involves the use of cookies that collect:

• Pages visited and time spent
• Browser type and device
• Approximate geographic location (country/city level)
• Referring website

Legal basis: Consent (Art. 6(1)(a) GDPR). Analytics cookies are only placed after you accept them via our cookie banner.

Third party: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google servers in the United States under Standard Contractual Clauses. See Google's Privacy Policy.

Retention: Analytics data is retained for 14 months within Google Analytics, after which it is automatically deleted.

You can opt out of Google Analytics at any time using the Google Analytics opt-out browser add-on or by withdrawing cookie consent via the banner on this Site.

3. Cookies

Strictly necessary cookies do not require your consent. Analytics cookies are only set after you accept them. You can change your cookie preferences at any time using the cookie settings link in the footer.

4. How we store and protect your data

Enquiry form submissions are stored in a secured WordPress database hosted on servers located within the European Economic Area. Access is restricted to authorised personnel only. We use industry-standard security measures including HTTPS encryption for all data in transit.

We do not store payment card data. No financial transactions take place on this Site.

5. Who we share your data with

We do not sell, rent, or trade your personal data. We may share it only in the following limited circumstances:

• Google LLC — for analytics purposes as described above
• Hosting provider — your data is stored on servers operated by our web hosting provider, who acts as a data processor under a data processing agreement
• Legal requirement — if required to disclose data by applicable law, court order, or competent Bulgarian or EU authority
• Project co-directors — Holger Mette and authorised team members may access enquiry data solely for the purpose of responding to your investment enquiry

6. International transfers

Google Analytics data may be transferred to and processed in the United States. Google LLC participates in the EU–US Data Privacy Framework and uses Standard Contractual Clauses approved by the European Commission to ensure adequate protection of your data.

All other personal data we collect is processed and stored within the EEA.

7. Your rights under GDPR

As a data subject under the GDPR, you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — ask us to delete your personal data ("right to be forgotten")
• Right to restrict processing — ask us to limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at privacy@banskoclub.com. We will respond within 30 days.

8. Right to lodge a complaint

If you believe we have not handled your personal data in accordance with the GDPR, you have the right to lodge a complaint with the Bulgarian supervisory authority:

You may also lodge a complaint with the supervisory authority in the EU member state where you reside or work.

9. Investment information disclaimer

Personal data submitted through this Site in connection with the Bansko Club investment project is processed solely for the purpose of providing requested information. Nothing on this Site constitutes financial advice, a prospectus, or an offer to sell securities. Submission of your details does not create any contractual obligation on either party.

10. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Material changes will be communicated by a notice on the Site. Continued use of the Site after changes are posted constitutes acceptance of the revised policy.

11. Contact

For any questions about this Privacy Policy or how we handle your data: