Privacy Policy

1. Introduction and scope

This Privacy Policy describes how Parva Faza OOD, referred to below as the “Controller”, “we”, “us” or “our”, collects, uses, stores and protects the personal data of visitors to the website www.digitaldesigneu.com, referred to below as the “Site”.

We are committed to protecting your privacy and process your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation, “GDPR”, the Bulgarian Personal Data Protection Act, “PDPA”, and other applicable Bulgarian and European legislation.

This Policy covers the processing of personal data collected through the Site — for example through the contact form, email correspondence and automatically collected technical information. It does not govern the processing of personal data in connection with specific service contracts concluded between the Controller and clients; separate notices and/or clauses in the relevant contract apply in those cases.

This Policy does not apply to links from the Site to other websites. We recommend that you read the privacy statements of the other websites you visit.

Please read this Policy carefully. By using the Site you confirm that you are aware of it.

2. Data controller

The controller of your personal data is:

We are not legally obliged to appoint a Data Protection Officer, DPO. For any questions about the processing of your personal data you can contact us directly at the email address above.

3. What personal data we collect

3.1. Data you provide voluntarily

When you use the contact form on the Site or write to us by email, we collect the following data:

• First name and/or surname
• Email address
• Telephone number, if you provide one
• Company name, where applicable
• The content of your message and any information you have voluntarily included in it
• Payment data, if you pay by card through the Site: the payer's name, the amount, the date and the status of the transaction. The card number does not pass through us — see section 4.4

The Site also offers a chat assistant. When you write to it, we process the content of your messages and — if you choose to leave them — your email or telephone number, so that we can reply. In order to understand your questions and generate answers, the text of the messages may be processed by an artificial intelligence service provided by Google (Gemini API), acting as a processor on our instructions. Please do not enter sensitive or personal data in the chat — for formal enquiries use the contact form.

3.2. Data collected automatically

When you visit the Site, technical information is collected automatically through server logs and cookies, including:

• IP address, in anonymised form where applicable
• Browser type and version
• Operating system
• Date and time of the visit
• Pages visited and the duration of the visit
• The source you reached the Site from, the referrer

For more information see our Cookie Policy.

3.3. Whether providing data is mandatory

Providing personal data through the contact form is voluntary, but:

• Mandatory fields, for example name, email and the content of the enquiry, are necessary so that we can answer your enquiry. If you refuse to provide them, we will not be able to process your enquiry.
• Optional fields, for example a telephone number or a company name, can make communication easier, but refusing to provide them will not deprive you of an answer.

3.4. Special categories of data

We do not knowingly collect special categories of personal data within the meaning of Article 9 GDPR, such as data on racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, data on health, sex life or sexual orientation. Please do not send us such data through the contact form.

4. Purposes and legal grounds for processing

We process your personal data for the following purposes and on the following legal grounds under Article 6 GDPR:

4.1. Answering your enquiry

Purpose: to answer the questions you have sent us through the contact form or by email, and to provide you with information or a quote.

Legal ground: Article 6(1)(b) GDPR — taking steps at your request prior to entering into a contract; and/or Article 6(1)(f) — legitimate interest, answering a business enquiry.

4.2. Operation and security of the Site

Purpose: ensuring the normal operation of the Site and protection against abuse and technical problems. When you submit a form, we record the IP address, browser data (user-agent and language) and the time taken to fill it in, so we can tell automated requests from real ones. For the same purpose the forms use Cloudflare Turnstile — a check with no cookies and no action on your part.

Legal ground: Article 6(1)(f) GDPR — legitimate interest in maintaining a secure and stable website.

4.3. Statistics and traffic analysis

Purpose: understanding how the Site is used, with a view to improving it.

Legal ground: Article 6(1)(a) GDPR — your consent, given through the cookie banner.

4.4. Payment by bank card

Purpose: accepting and accounting for a payment for an agreed Service, made with a debit or credit card through the Pay by Link service of DSK Bank.

Legal ground: Article 6(1)(b) GDPR — performance of a contract; and Article 6(1)(c) — compliance with accounting and tax obligations.

What we see: the payer's name, the amount, the date and the status of the payment. The card details themselves — the number, the expiry date and the security code — are not entered on the Site and do not reach us. They are processed by DSK Bank in its own secure environment, in its capacity as a separate data controller, in accordance with its privacy policy.

4.5. Compliance with legal obligations

Purpose: fulfilling obligations arising from applicable law, including accounting, tax, consumer protection and others.

Legal ground: Article 6(1)(c) GDPR — compliance with a legal obligation.

5. Retention periods

We store your personal data only for as long as is necessary to achieve the purposes for which it was collected, or for as long as the law requires:

• Enquiries through the contact form: up to 12 months from the last communication, unless the enquiry leads to a contract.
• Data relating to concluded contracts: up to 5 years after the end of the contractual relationship, in line with the limitation periods; accounting documents are kept in accordance with the Accountancy Act, up to 10 years.
• Card payment data: 10 years, in accordance with the Accountancy Act. We keep only the payment confirmation, not card details.
• Server logs: up to 12 months.
• Requests stopped by the bot protection: up to 90 days, after which they are deleted automatically.
• Cookie data: for the period stated in the Cookie Policy.

Once the relevant period expires, your personal data is deleted or anonymised.

6. Recipients of the personal data

We do not sell or rent your personal data to third parties. We may share your data with:

• Service providers acting as processors — for example the hosting provider, email services, analytics platforms such as Google Analytics, and communication tools. These parties act only on our instructions and are bound by confidentiality obligations under a data processing agreement, DPA.
• An artificial intelligence provider — Groq, Inc., USA, which processes the messages sent through the chat assistant in order to generate automatic replies; a backup provider, Google, Gemini API, is used where necessary. These providers act as processors on our instructions and may process data outside the EEA subject to appropriate safeguards, see section 7.
• Cloudflare, Inc. — the Turnstile service checks that a form is sent by a person. It processes the IP address and technical browser data and may process them outside the EEA, see section 7.
• Telegram — when you leave an enquiry through the chat assistant, we send a notification (your name, telephone/email and message) to a company Telegram account so that we can respond quickly. Telegram FZ-LLC may process the data outside the EEA, see section 7.
• DSK Bank — when you pay by card through the Site. The bank processes the card details in its own environment as a separate controller; we receive only the payment confirmation. Card details are not stored by us.
• Public authorities — where required by law or a court order, for example the National Revenue Agency, the CPDP, a court or a prosecutor's office.
• Professional advisers — accountants, lawyers and auditors, where necessary for our business.

7. International data transfers

Some of our service providers, for example Groq, USA, Google, Meta and Telegram, may process data outside the European Economic Area, the EEA. In such cases we ensure that the transfer takes place subject to appropriate safeguards under Chapter V GDPR — for example through standard contractual clauses approved by the European Commission, or on the basis of an adequacy decision.

8. Automated decision-making and profiling

We do not carry out automated decision-making, including profiling within the meaning of Article 22 GDPR, that produces legal effects concerning you or similarly significantly affects you. Traffic analysis tools such as Google Analytics process data in aggregated and/or anonymised form and do not lead to automated individual decisions about you.

The chat assistant generates automatic, purely informative replies with the help of artificial intelligence. It does not make decisions that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. Where a specific quote or binding information is needed, we put you in touch with a member of our team.

If you have consented to marketing cookies, our advertising tools — the Meta Pixel and the LinkedIn Insight Tag — collect signals about your behaviour on the site, for example how far you scrolled, how long you stayed and which buttons you pressed. On the basis of those signals you may be included in advertising audiences and subsequently see our adverts. This constitutes profiling for marketing purposes, but it does not produce legal effects concerning you and does not similarly significantly affect you within the meaning of Article 22 GDPR. The legal ground is your consent, Article 6(1)(a) GDPR, and you can withdraw it at any time from the Cookie Policy, after which these tools stop loading.

9. Your rights as a data subject

Under the GDPR and the PDPA you have the following rights in relation to your personal data:

• Right to information and access — to obtain confirmation of whether we process your personal data and a copy of it.
• Right to rectification — to ask for inaccurate or incomplete data to be corrected.
• Right to erasure, the “right to be forgotten” — to ask for your data to be deleted where the legal conditions are met.
• Right to restriction — to ask for processing to be restricted under certain conditions.
• Right to portability — to receive your data in a structured, commonly used and machine-readable format.
• Right to object — to processing based on legitimate interest, including direct marketing.
• Right to withdraw consent — at any time, where the processing is based on consent, without affecting the lawfulness of processing before the withdrawal.

9.1. How to exercise your rights

To exercise any of these rights, send a written request to the contact email in section 2. The request should contain:

• A clear statement of which right you wish to exercise
• Enough information for us to identify you, usually the name and email address you used to communicate with us
• Additional information, if the request concerns a particular enquiry or period

In order to protect your data, we may ask for additional information to verify your identity before acting on the request. We will respond within one month of receiving it; that period may be extended by a further two months for complex or numerous requests, of which we will inform you.

Exercising your rights is free of charge. Where requests are manifestly unfounded or excessive, for example because of their repetitive character, we may refuse the request or charge a reasonable fee.

10. Right to complain to a supervisory authority

If you consider that the processing of your personal data infringes the GDPR or the PDPA, you have the right to lodge a complaint with:

We recommend that you contact us first, so that we can resolve any questions directly.

11. Data security

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, alteration or disclosure. These measures include, but are not limited to: SSL encryption of communications, restricted access to data, regular backups and system updates.

Despite our efforts, no method of transmission over the internet or of electronic storage is 100% secure. We therefore cannot guarantee absolute security. In the event of a data security breach that results in a high risk to the rights and freedoms of the individuals concerned, we will notify you in accordance with the requirements of the GDPR.

12. Children's personal data

The Site is not intended for persons under the age of 16 and we do not knowingly collect personal data from children under that age. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us so that we can delete it.

13. Changes to the Privacy Policy

We reserve the right to update this Privacy Policy from time to time in order to reflect changes in our practices, in the law or in technology. The current version will always be published on this page with the date of the last update. In the event of material changes we will make reasonable efforts to notify you.

We recommend that you review this page periodically, so that you stay informed about how we protect your privacy.

14. Contact

If you have questions, comments or requests relating to this Privacy Policy or to the processing of your personal data, please contact us:

Thank you for trusting Digital Designs.

15. Language of this document

This is a translation of our Bulgarian Privacy Policy, provided for convenience. In the event of any discrepancy between the two versions, the Bulgarian text prevails.