Privacy Notice
Who is responsible
Mandala Institute for Holistic Mental Health EOOD (МАНДАЛА ИНСТИТУТ ЗА ХОЛИСТИЧНО МЕНТАЛНО ЗДРАВЕ ЕООД), Sofia Center, Vitosha Blvd 44, 2nd floor, 1000 Sofia, Bulgaria, registered under company number (ЕИК) 206326108 — trading as The Mandala Institute for Holistic Mental Health. Our VAT number is BG206326108. We are the controller for the personal data described below.
For anything in this notice, including any of the rights listed further down, write to mifhmh@gmail.com. We have not appointed a data protection officer; we are not required to.
The short version
This website is built to know as little about you as possible. There are no advertising trackers, no social-media pixels, no analytics, and no cookies — which is also why you will not find a cookie banner here: there is nothing to consent to. Fonts and images are served from our own server rather than from Google or a content network, so reading this site does not report your visit to anyone else. You can read everything here without giving us any personal information.
What we process, and why
| What | Why | Legal basis | How long |
|---|---|---|---|
| Technical logs — IP address, page requested, time, browser type | Delivering the site and keeping it available and secure | Legitimate interest, Art. 6(1)(f) GDPR | 30 days (set by our host) |
| Your email address, if you subscribe to our journal | Sending you The Formation | Consent, Art. 6(1)(a) GDPR | Until you unsubscribe, which you can do from every email |
| Whatever you write to us, if you send us a message | Answering you | Legitimate interest, Art. 6(1)(f); where you are asking about working with us, Art. 6(1)(b) | As long as we need it to deal with your enquiry |
We do not sell or rent personal information, we do not profile visitors, and we do not run advertising. Please do not send personal health information by email — this website is not a care setting, and email is not a secure channel.
Who else is involved
- Our hosting provider, Netlify, Inc., stores the technical logs described above and processes them only on our instructions.
- Substack Inc. hosts our journal The Formation and holds the subscriber list. Subscribing is completed on Substack's own pages under their privacy policy.
- Anyone maintaining this website on our behalf works under a written data processing agreement, which also binds the tools they use. Currently: we maintain the site ourselves.
Data that leaves the European Union
Substack Inc. is based in the United States. If you subscribe to our journal, your email address is transferred there. That transfer rests on Substack’s certification under the EU–U.S. Data Privacy Framework. The technical logs described above are stored by our hosting provider Netlify, Inc., which is likewise certified under the EU–U.S. Data Privacy Framework. Beyond these two, nothing on this site sends your data outside the EU. We serve our own fonts rather than loading them from Google, and the article images in our Journal are routed through our own domain rather than fetched from Substack's servers — both so that simply reading this site does not transfer your IP address abroad.
Your rights
Under the GDPR you can ask us to:
- Show you what personal data we hold about you (Art. 15)
- Correct anything that is wrong (Art. 16)
- Delete it (Art. 17)
- Restrict what we do with it (Art. 18)
- Hand it over to you or another organisation in a portable form (Art. 20)
- Stop processing you object to (Art. 21)
Where we rely on your consent, you can withdraw it at any time (Art. 7(3)); that does not affect anything we did before you withdrew it. Write to mifhmh@gmail.com and we will respond within one month.
If you think we have handled your data badly, you can complain to the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia — or to the supervisory authority where you live.
If you are in Canada
We deliver programmes in Nunavut, Nunavik, Ontario and Manitoba. If you took part in one of them, the rights you hold under Canadian federal and provincial privacy law are not replaced by this notice. Ask us and we will tell you which framework applies to the data we hold about you, and who to approach.
Changes
If this notice changes, we will update it here with a new date. We will never make a change that quietly reduces your privacy.
Accessibility Statement
Mental-health education should be reachable by everyone — including Elders, people using assistive technology, and communities on slow northern connections. Accessibility is a design requirement for this site, not an afterthought.
Where we stand
This site is built to WCAG 2.2 level AA and was checked as it was built: colour contrast, full keyboard operation, reduced-motion support, and layout tested at screen widths from 320 pixels upwards. It has not yet had an independent audit. When one happens, we will publish the result here — including anything that does not conform.
What is already built in
- Text contrast of at least 4.5:1, with all data-visualization palettes machine-validated for colour-vision deficiencies
- Full keyboard operability, including the interactive map and the program explorer
- Reduced-motion support — every animation is disabled when your system requests it
- Text alternatives for visual content, including a list view of the program map
- Lightweight pages built for slow and satellite connections across the North
- Full font support for Inuktitut syllabics (ᐃᓄᒃᑎᑐᑦ)
Known limitations
- French and Inuktitut versions of this site are planned but not yet published.
- Newsletter sign-up is completed on Substack's own pages, whose accessibility we do not control.
- The program map is a stylized illustration; all of its information is always available as plain text on the same page.
Tell us
If anything on this site is hard for you to use, write to mifhmh@gmail.com. Accessibility reports go to the top of our list, and we aim to respond within five business days.
Data & Story Sovereignty
Our work exists because communities share their knowledge, experiences and stories with us. We hold that trust as follows:
- Stories belong to their tellers. Every testimonial, portrait and story we publish rests on informed, written consent given for that specific use, with the right to withdraw at any time — and withdrawal means removal, without question.
- Storytellers approve the final text. Nothing is published in someone's name that they have not seen and approved, and their time is compensated.
- Evaluation data belongs to communities. Findings from our programs are returned to the communities they come from before they are used anywhere else.
- Strength, not spectacle. We tell stories of growth, skill and community capacity — we do not publish trauma for effect.
These commitments apply to this website, our reports and the Inuit Mental Health Model, and all program materials. Questions and concerns are welcome at mifhmh@gmail.com.