01 Who we are
The controller of personal data processed through webcraft.bg is WebCraft, a web design and development studio in Bulgaria (contact details below). For any question about this policy, or to exercise your rights, email kyovtorov@gmail.com or call +359 894 449 992.
02 What data we collect
We only collect what you send us yourself through the contact form:
- your name (required);
- your email address (required);
- phone, company and approximate budget (optional);
- your message and, if you used the configurator or picked a package, the chosen site parameters (type, style, features, package, billing);
- the page language and your consent confirmation.
When you visit the site, our hosting provider automatically processes technical information needed to deliver pages and prevent abuse, such as IP address, browser type and request time (server logs). We do not use it to identify you.
We do not collect sensitive data — please don’t include any in your message.
03 Why we use it, and on what legal basis
- To reply to your enquiry and prepare a quote — steps taken at your request before entering a contract (Art. 6(1)(b) GDPR) and the consent you give in the form (Art. 6(1)(a)).
- To perform a contract if we start working together — Art. 6(1)(b).
- To meet legal obligations (e.g. accounting and tax) once there is a contract — Art. 6(1)(c).
- To keep the site secure and working (server logs, spam protection) — our legitimate interest (Art. 6(1)(f)).
- For anonymous visit statistics (which pages are opened, from which country and on what kind of device) via Vercel Web Analytics — without cookies and without identifying you; our legitimate interest in improving the site (Art. 6(1)(f)).
- To measure how our Google Ads perform (whether a visit came from an ad and whether you sent an enquiry or clicked our phone/email): with cookies — only with your consent (Art. 6(1)(a)); without consent — only anonymous, cookieless signals, based on our legitimate interest in knowing whether our ads work (Art. 6(1)(f)).
We don’t subscribe you to newsletters, we don’t sell data, and we don’t make automated decisions about you.
04 How long we keep it
- Enquiries that don’t lead to a contract — up to 12 months after our last correspondence, then deleted.
- Contract and invoicing data — for the period required by law (under the Bulgarian Accountancy Act, up to 10 years for accounting records).
- Server logs at the hosting provider — for a short period set by the provider.
You can ask us to delete your data sooner at any time, unless the law requires us to keep it.
05 Who we share it with
We do not sell your data or give it to third parties for their own purposes. We only use these providers, which process it on our behalf:
- Vercel Inc. — website hosting, contact-form processing and anonymous visit statistics (Vercel Web Analytics);
- Google (Gmail) — receiving and storing your enquiry emails;
- Google Ireland Ltd. (Google Ads) — measuring ad conversions (with cookies only if you accepted them).
We may disclose data to public authorities where the law requires it.
06 Transfers outside the EU
Vercel and Google are based in the United States, and some data may be processed outside the European Economic Area. This happens under the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses approved by the European Commission.
08 Your rights
Under the GDPR you have the right to:
- access the data we hold about you;
- have inaccurate data corrected;
- have your data erased (“right to be forgotten”);
- restrict processing;
- data portability;
- object to processing based on legitimate interest;
- withdraw your consent at any time, without affecting processing carried out before the withdrawal.
To exercise your rights, email kyovtorov@gmail.com. We will reply without undue delay and within one month at the latest.
You can also lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg.
09 Security
The whole site runs over HTTPS. The form is validated on the server and protected against automated spam, and access to received enquiries is limited to us.
10 Children
Our services are intended for businesses and adults. We do not knowingly collect data from children.
11 Changes to this policy
We may update this policy, for example if we add a new service. The date of the latest change is shown at the top of the page.