Privacy Policy

Who processes the data

The data controller is Boyana Ivanova, freelance photographer, Bulgaria.

For anything to do with your data: boyanaphoto@gmail.com, telephone +359 894 67 13 50.

What I collect, and why

Private event gallery. When you ask for access to a gallery I collect only your email address. So that I can demonstrate consent was given, I also record the IP address, the date and time, the browser the form was sent from, and which version of this policy was in force.

Contact form. A way to reach you, and your message — so that I can reply. These are sent through the FormSubmit service and arrive in my inbox.

Technical records. When gallery access was requested and when it was opened, with the IP address. These exist for security and to detect abuse.

I collect nothing else. There is no cross-site tracking, no profiling and no automated decision-making.

The legal basis

Consent (Art. 6(1)(a) GDPR) — to send you access to the gallery and, separately, to send news and offers. These are two different consents and are given separately.

Legal obligation (Art. 6(1)(c) and Art. 7(1)) — the record by which I demonstrate that consent was given.

Legitimate interests (Art. 6(1)(f)) — the technical records kept for security.

Cookies

I use exactly one cookie, and only inside a private gallery: it remembers that you have confirmed your email, so you do not have to enter it again every time you open the page. It is strictly necessary for the service you asked for, and therefore needs no separate consent.

Your favourite photographs are stored only in your own browser (localStorage) and are never sent to me. I cannot see which photographs you liked.

How long I keep it

Email address — until you unsubscribe or ask for deletion.

An unconfirmed email — if an address was entered but the link in the email was never opened, the record is deleted after 30 days. An address nobody confirmed is one I have no basis to hold.

Consent record — as long as the contact itself, as evidence under Art. 7(1).

Technical records — 90 days, then deleted automatically.

Event photographs — 30 days online, after which the page stops working and the files are removed from the server within a week.

Who it is shared with

I do not sell or pass on data to anyone. I use the following providers, which process data only on my instructions:

Hetzner Online GmbH (Germany) — the server the site and the galleries run on.

Cloudflare — the network the site is served through, for speed and protection.

FormSubmit — delivers messages from the contact form.

The email provider for the galleries will be named here as soon as it is finally chosen.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR).

Every email I send carries two links: one to unsubscribe from news, one to delete your data completely. Both work immediately, without you having to ask.

You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before it.

If you believe your rights have been infringed you can complain to the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd, Sofia, kzld.bg.

Photographs of people

Private galleries contain photographs of identifiable people, including children. They are reachable only by a private link and only after a confirmed email; the pages are not indexed by search engines.

If you are in a photograph and would rather it were not used, write to me and I will remove it.

Changes

Any change to this policy gets a new version and a new date. Your consent record stores which version you accepted, so it is always clear exactly what you agreed to.