Draft — pending legal review
This document is a draft template and is not yet a binding statement. Its content must be reviewed and approved by a legal expert before publication. Bracketed placeholders [да се потвърди / to be confirmed] mark details that are still to be confirmed (data controller, legal name, address, dates, identifiers).
Privacy
Privacy Policy
This policy describes how we process personal data in accordance with applicable data protection law (GDPR). We apply privacy by design: we define purpose, lawful basis, minimum fields, retention, access and deletion before creating any form.
Data controller
Controller: [да се потвърди / to be confirmed]. Contact for data protection matters: [да се потвърди / to be confirmed]. Data Protection Officer (if applicable): [да се потвърди / to be confirmed].
What data we collect and on what basis
We collect only the data needed for a specific purpose, with a clear lawful basis. The contact form collects name, e-mail and message (plus optional organisation and subject) on the basis of consent given via an explicit checkbox. The newsletter collects only an e-mail address, requires a separate consent and becomes active only after e-mail confirmation (double opt-in). Enquiry data is never reused for the newsletter or marketing. We do not infer consent from silence or bundled participation.
Retention
We retain personal data only for as long as necessary for the stated purpose. Contact-form enquiries: deleted automatically 12 months after receipt. Newsletter subscriptions: kept until consent is withdrawn — unsubscribing deletes the record entirely. Unconfirmed subscriptions are never used for sending.
Your rights
We provide correction, export and deletion routes appropriate to the legal basis. You have the right of access, rectification, erasure, restriction, portability and objection under applicable law, and the right to lodge a complaint with a supervisory authority: [да се потвърди / to be confirmed].
Sharing and processors
We do not send form text, question content or sensitive page URLs to advertising or generic analytics platforms. Site statistics are cookieless and fully anonymous — we count only daily aggregated visits, with no IP addresses and no visitor identifiers. A transactional e-mail provider may be used to deliver confirmation e-mails; the full list of processors and transfers: [да се потвърди / to be confirmed].
Pilots and research
For pilot analysis we use pseudonymisation and aggregation and document re-identification risks. We conduct a DPIA where a pilot involves systematic monitoring, sensitive data, vulnerable contexts or consequential profiling.