Privacy Policy

This Privacy Policy explains how CREATIVE WEB SOLUTIONS EOOD (“the Company”, “we”) processes your personal data when you visit projectyordanov.com (“the Website”), send us an enquiry or correspond with us.

We process data in accordance with Regulation (EU) 2016/679 (GDPR), the Bulgarian Personal Data Protection Act and the Bulgarian Electronic Communications Act.

1. Data controller

CREATIVE WEB SOLUTIONS EOOD
Company ID (UIC): 208122150, VAT No. BG208122150
Address: 2 Maria Gabrovska St., Veliko Tarnovo, Bulgaria
Email: hello@projectyordanov.com
Phone: +359 886 386 438

We have not appointed a Data Protection Officer, as our activities do not require one. For any question about your personal data, write to hello@projectyordanov.com.

2. What data we process

2.1. Data from the enquiry form

When you send us an enquiry, we process:

• contact details: name, company (if provided), email and phone;
• project details: the type of enquiry, the address of your current website (if provided), your message and the brief file, if you attached one;
• how you heard about us, if you answered that question;
• the date and time of sending.

The fields marked as required are needed for us to reply. Without them we cannot process the enquiry.

2.2. Technical data sent with an enquiry

With each enquiry we record the IP address it was sent from, the type of browser and device, the language of the Website and the page it was sent from. We use them to recognise automated and malicious submissions and to protect the form from abuse.

2.3. Correspondence and calls

When we exchange emails, we keep the correspondence. When you book an online call, we receive the details you entered when booking (name, email, the chosen time and any note you added).

2.4. Data on how the Website is used

Only if you have given consent through the cookie banner, we collect statistics on how the Website is used: pages visited, the source of the visit, device and browser type, approximate location (country or city) and recordings of interactions with the page (clicks, scrolling). This data is pseudonymised: it does not contain your name or email, but it may be linked to an identifier of your browser.

On every visit, the server hosting the Website and the service protecting it keep technical logs (IP address, date and time, requested page, browser). They are used for the security and proper operation of the Website.

3. Purposes and legal bases

Purpose	Data	Legal basis
Replying to an enquiry, preparing a proposal and entering into a contract	2.1, 2.3	Art. 6(1)(b) GDPR: steps taken at your request before entering into a contract
Performing a contract and corresponding with clients	2.1, 2.3	Art. 6(1)(b) GDPR: performance of a contract
Protecting the form from spam and abuse, Website security	2.2, technical logs	Art. 6(1)(f) GDPR: our legitimate interest in protecting the Website and the data in it
A follow-up email on a proposal we sent	2.1, 2.3	Art. 6(1)(f) GDPR: our legitimate interest in completing a conversation already started
Statistics and improving the Website	2.4	Art. 6(1)(a) GDPR: consent through the cookie banner
Accounting and tax obligations	client data on invoices	Art. 6(1)(c) GDPR: legal obligation

If we have sent you a proposal after a call, we may write to you about it a few more times. If you do not want this, reply to us and we will stop.

We do not use your data for automated decision-making, including profiling, that produces legal effects for you.

4. Recipients of data

We do not sell or rent out your personal data. We share it only with providers who help us operate and who act on our instructions as data processors:

• a hosting and email provider: stores the Website, the database of enquiries and our email;
• Cloudflare, Inc.: protects the Website from attacks and automated spam and delivers its content;
• Cal.com, Inc.: when you book an online call;
• Wistia, Inc.: plays our clients’ video testimonials (the player loads when the video is on screen, in do-not-track mode);
• Google Ireland Ltd. (Google Tag Manager, Google Analytics 4): only after consent to statistics cookies;
• Microsoft Ireland Operations Ltd. (Microsoft Clarity): only after consent to statistics cookies;
• advertising platforms (Google Ads, Meta, LinkedIn): only if we run advertising and only after consent to marketing cookies;
• our accountant and public authorities: where the law requires it.

The Website’s fonts are served from our own server, not from an external service.

5. Transfers outside the EU

Some of the providers in section 4 (or their sub-processors) process data in the United States. Such transfers are based on the European Commission’s decision on the EU-US Data Privacy Framework, where the recipient is certified under it, or on standard contractual clauses approved by the European Commission.

6. Retention periods

• Enquiries that did not lead to a contract, including attached files and correspondence: up to 24 months from our last communication.
• Client data: for the term of the contract and until the limitation periods for possible claims under it expire.
• Accounting documents (invoices and the data in them): 10 years, as required by the Bulgarian Accountancy Act.
• Technical data sent with an enquiry (section 2.2): up to 12 months.
• Statistics: according to the settings of the respective service, and no longer than 14 months in Google Analytics 4.

When the period ends, we delete or anonymise the data.

7. Cookies

Cookies are small files the Website stores in your browser. We use:

• essential cookies, without which the Website does not work properly. They do not require consent. They include py_consent (stores your cookie choice, 6 months) and pll_language (stores the chosen language, 1 year);
• statistics cookies (Google Analytics 4: _ga, _ga_*; Microsoft Clarity: _clck, _clsk): only with your consent;
• marketing cookies: only with your consent and only if we use advertising tools.

The full, current list of cookies, their providers and lifetimes is in “Cookie settings”: the link is at the bottom of every page of the Website. There you can give or withdraw your consent. Withdrawal does not affect the lawfulness of processing before it.

8. Your rights

Under the GDPR you have the right:

• of access: to receive information about and a copy of the data we process about you;
• to rectification: to have inaccurate or incomplete data corrected;
• to erasure: to have your data deleted when we no longer have grounds to keep it;
• to restriction of processing;
• to data portability: to receive the data you provided in a structured, machine-readable format;
• to object to processing based on legitimate interest, including to follow-up emails;
• to withdraw consent to cookies at any time through “Cookie settings”.

How to exercise your rights: write to hello@projectyordanov.com. We will reply without undue delay and within one month at the latest. For complex or numerous requests this period may be extended by two further months, and we will let you know. We may ask you to confirm your identity before providing any data.

Right to lodge a complaint: if you believe your rights have been infringed, you may lodge a complaint with the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg, or with the supervisory authority in the EU country where you live or work.

9. Security

We apply technical and organisational measures to protect your data, including:

• an encrypted connection (HTTPS) across the Website;
• protection against attacks and automated spam;
• restricted, secured access to the admin panel and to enquiries;
• regular updates and backups;
• collecting only the data we need.

10. Persons under 16

The Website and our services are aimed at businesses. We do not knowingly collect data from persons under 16.

11. External websites and social networks

The Website contains links to external websites, such as our LinkedIn and Clutch profiles. We do not use social plugins that send data to these networks when a page loads. Their owners are responsible for how data is processed on those websites.

12. Changes to this Policy

We may update this Policy when the law, our services or the tools we use change. The date of the last change is shown at the top of the page.

13. Contact

For questions about your personal data: hello@projectyordanov.com, +359 886 386 438.