Privacy Policy

1. What data we collect

We keep data collection to the minimum needed to respond to you and deliver our services:

• Contact & booking data — your name, email, company, and anything you tell us when you book an intro call or email us (collected via Calendly and email).
• Engagement data — the information you share about your systems during a paid engagement, plus deliverables, notes and correspondence.
• Payment data — we use Revolut to take payment. We receive confirmation that a payment was made and limited transaction metadata; we do NOT receive or store your full card details — those are handled by the payment provider.
• Technical data — standard server logs (IP address, browser type, pages requested, timestamps) generated by our hosting provider for security and reliability.
• Local storage — your light/dark theme preference is stored in your browser only; it is not sent to us. See our Cookie Notice.

2. Why we process it, and our legal basis

• To respond to enquiries and arrange calls — legal basis: your consent and steps taken at your request prior to a contract (Art. 6(1)(a)/(b) GDPR).
• To deliver and administer engagements and invoices — legal basis: performance of a contract (Art. 6(1)(b)).
• To keep accounting and tax records — legal basis: compliance with a legal obligation (Art. 6(1)(c)).
• To secure and operate the website and pursue or defend legal claims — legal basis: our legitimate interests (Art. 6(1)(f)).

3. Who we share it with (processors & sub-processors)

We do not sell your data. We share it only with service providers that help us run the business, each acting under a data-processing agreement:

• Calendly — call scheduling.
• Revolut — payment processing.
• [HOSTING PROVIDER] — website hosting and server logs.
• Email and productivity providers used to correspond with you and store records.
• Professional advisors (accountant, lawyer) where necessary.

4. International transfers

Some providers may process data outside the European Economic Area. Where they do, transfers are protected by an adequacy decision or the European Commission’s Standard Contractual Clauses (SCCs) together with appropriate safeguards. You can request details of the safeguards used.

5. How long we keep it

• Enquiries that do not become engagements — up to 12 months, then deleted.
• Engagement records and correspondence — for the duration of the engagement and a reasonable period afterwards for legal/operational reasons.
• Accounting and invoicing records — retained for the period required by Bulgarian tax and accounting law.

6. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent at any time (without affecting prior processing). To exercise any right, email contact@bbogdanov.dev. We respond within one month.

If you believe we have mishandled your data, you may lodge a complaint with the supervisory authority: Commission for Personal Data Protection (CPDP / КЗЛД), 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, Bulgaria — cpdp.bg.

7. Changes

We may update this policy from time to time. The "Last updated" date above reflects the current version; material changes will be highlighted on this page.