Privacy Policy

This policy explains how we process your personal data when you use the penkovstudio.eu website and when you get in touch with us. It follows Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), the Bulgarian Personal Data Protection Act and the Bulgarian Electronic Communications Act.

1. Data controller

Controller: Tsvetelin Penkov, a natural person trading as "Penkov Studio"
Postal address: 18 Todor Aleksandrov Blvd., Sofia, Bulgaria
Email: support@penkovstudio.eu
Website: penkovstudio.eu

We are not required to appoint a Data Protection Officer. For any question about your personal data, please write to the email address above.

2. What data we process, why, and on what legal basis

2.1. Contact form

Data: your name, email address and message, plus anything else you choose to include in it.
Purpose: to reply to your message.

2.2. Project inquiry form

Data: what you need, your type of business, whether you already have a website and its address (optional), approximate number of pages, languages, required features, available materials (copy, photos, logo), indicative budget, your name, email address, phone number (optional), a project description and anything else you choose to share.
Purpose: to respond to your inquiry, prepare a quote and discuss a potential project with you.
Draft saved in your browser: while you fill in the form, your answers to the steps that do not contain contact details are saved automatically, and only in your own browser's local storage (localStorage, key ps_inquiry_draft), so you do not lose your progress. Your name, email and phone number are never saved in the draft. The draft is not sent to us until you submit the form, and it is deleted once you submit it or clear it.

2.3. Rules that apply to both forms

Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) and, for general questions, our legitimate interest in answering inquiries sent to us (Art. 6(1)(f) GDPR). For this reason we do not ask for a separate consent checkbox when you submit a form.
Storage and access: submissions are stored in the website's database and can be accessed only by the administrator. After submitting, you receive an automatic email confirming receipt, and the administrator receives a notification about the new message or inquiry.
Retention: up to 2 years from our last communication if no contract is concluded. If a contract is concluded, the periods in section 2.5 apply.

Please do not send sensitive data (for example, health information) through the forms. We do not need it to provide our services.

2.4. Spam and abuse protection for the forms

We do not use reCAPTCHA or any other third-party visitor verification service. Protection runs on our own server and relies on a hidden field that people do not see or fill in, a check on how long the form took to complete, and a limit on the number of requests within a given period. For rate limiting, your IP address is used only in hashed (irreversibly transformed) form and kept for no longer than 24 hours. Legal basis: our legitimate interest in security and preventing abuse (Art. 6(1)(f) GDPR).

2.5. Performing a contract and accounting obligations

Data: names, contact details, billing details (of an individual or of a company representative), project information and correspondence.
Purpose and legal basis: performing the contract (Art. 6(1)(b) GDPR); complying with legal obligations under accounting and tax law (Art. 6(1)(c) GDPR); establishing, exercising or defending legal claims (Art. 6(1)(f) GDPR).
Retention: for the term of the contract and 5 years after it ends (the general limitation period); accounting records are kept for 10 years as required by the Bulgarian Accountancy Act.

When you write to us by email or through our social media profiles (for example, LinkedIn), we process the data you send us in order to reply, on the basis of Art. 6(1)(b) or (f) GDPR and for the period set out in section 2.3. The privacy policy of the relevant platform also applies when you use social media.

2.7. Hosting and technical data

The website runs on the OpenKBS cloud platform, which is built on Amazon Web Services (AWS). Pages are stored in Amazon S3 and delivered through the Amazon CloudFront content delivery network, and form submissions are handled by server-side functions on AWS Lambda. We use the eu-central-1 data centre region in Frankfurt, Germany. The website database is provided by Neon (Postgres) in the EU Frankfurt region, and files and media are stored in Amazon S3 in Frankfurt. Automatic emails are sent through Amazon Simple Email Service (Amazon SES) via the platform.

When pages load, the infrastructure processes technical data (IP address, date and time, requested URL, browser details) needed to deliver the content and protect the website against attacks. Legal basis: our legitimate interest in running a reliable and secure website (Art. 6(1)(f) GDPR). These technical records are kept for a limited period and then deleted automatically.

Visitors do not have user accounts on this website. Login cookies are used only by the administrator in the admin area and are never set for visitors.

2.9. Cookies, analytics and embedded content

We use our own consent management tool. Optional categories (functional, analytics and marketing) are switched off by default and are only activated with your consent (Art. 6(1)(a) GDPR and Art. 4a of the Bulgarian Electronic Communications Act).
Google Analytics 4 loads only after you consent to analytics cookies, and only if the administrator has enabled it. It provides visit statistics (pages viewed, time on site, approximate location, device, traffic source). We use Google Consent Mode v2 with every signal set to "denied" by default. User-level data is kept for no longer than 14 months, and Google Analytics 4 does not store IP addresses.
Google Maps on the Contact page loads only if you allow functional cookies. Until then, a static image is shown instead of the interactive map.
Proof of consent: when you make a choice, we store a pseudonymous record on our server: a random ID, the policy version, the categories you selected, a timestamp and your browser family (no IP address). The record lets us demonstrate that consent was given (Art. 7(1) GDPR) and is kept for as long as needed for that purpose, but no longer than 3 years.

The website does not use marketing or advertising technologies (such as Google Ads or Meta Pixel), does not profile visitors and does not make automated decisions that have legal effects on you. Details on each cookie and on how to change your choice are in our Cookie Policy.

2.10. Fonts and icons

Fonts and icons are served from our own hosting, not from Google Fonts or other third-party services, so no data is sent to third parties when they load.

3. Recipients and processors

We do not sell your personal data or share it with third parties for marketing. Data may be accessible to:

the OpenKBS cloud platform and its infrastructure provider, Amazon Web Services (hosting, server-side functions, file storage and automatic emails);
Neon (Postgres database hosting);
the email service provider we use to send and receive correspondence;
Google Ireland Ltd. / Google LLC (Google Analytics and Google Maps, only with your consent);
our accountant, once a contract is concluded and invoices are issued;
public authorities, where required by law.

These providers process data on our behalf under a contract in line with Art. 28 GDPR, or as independent controllers under their own privacy policies.

4. Transfers outside the EU/EEA

The website, database and files are hosted in the EU (Frankfurt, Germany). However, some providers belong to groups headquartered in the United States, and they or their sub-processors may process certain data outside the EU/EEA, for example for support or security, or when Google services are used. Any such transfer relies on the European Commission's adequacy decision under the EU-US Data Privacy Framework for participating companies and/or on standard contractual clauses approved by the European Commission.

5. Your rights

Under the GDPR, you have the right to:

access your personal data and receive a copy (Art. 15);
have inaccurate or incomplete data corrected (Art. 16);
have your data erased, also known as the "right to be forgotten" (Art. 17);
restrict processing (Art. 18);
data portability for data you have provided, where processing is based on consent or a contract and is carried out by automated means (Art. 20);
object to processing based on legitimate interest (Art. 21);
withdraw your consent at any time; for cookies, use the "Cookie settings" button on the website. Withdrawal does not affect the lawfulness of processing carried out before it;
lodge a complaint with the supervisory authority: the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg.

To exercise your rights, email support@penkovstudio.eu. We will reply within one month. For complex requests this may be extended by a further two months, in which case we will let you know. We may ask for information to confirm your identity.

6. Do you have to provide your data?

Providing data is voluntary. However, we cannot answer your inquiry without your name and email address, and we cannot conclude or perform a contract without billing details.

7. Security

We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or alteration: encrypted connections (HTTPS), hosting in EU data centres, server-side abuse protection for the forms, inquiry access restricted to the administrator, a protected admin login and regular updates.

8. Children

Our services are not aimed at people under 16, and we do not knowingly collect their data.

9. Changes

We may update this policy when our services, the website's technical setup or the law change. The current version and the date of the last update are published on this page. If a change affects cookies, we will ask for your choice again.

10. Contact

For questions about this policy or your personal data: support@penkovstudio.eu. See also our Terms and Conditions, Cookie Policy and Legal Information.