The short version
- We do not use analytics, advertising or tracking tools on this site. No tracking pixels, no embedded social feeds.
- We use at most one small cookie, and it only remembers your language. It is strictly necessary, so there is no cookie banner.
- We collect personal data only when you send us a form, email us or join our newsletter. Our hosting providers also keep basic technical logs.
- You can ask to see, correct or delete your data at any time by writing to hello@studioidd.com.
1. Who is responsible for your data?
Studio IDD is a design and development studio based in Bulgaria. We run studioidd.com and build websites, web apps, mobile apps and AI solutions for our clients.
For the personal data described in this policy, Studio IDD is the controller under the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act (Закон за защита на личните данни). In this policy, “we” and “us” mean the controller.
- hello@studioidd.com
Questions about this policy or your data are welcome at hello@studioidd.com.
2. What personal data do we process, and why?
We process personal data in four situations. You are not required by law to give us any of it, but without it we may not be able to answer you.
When you use the contact form or email us
- What we process
Your name, email address and phone number, the budget range you choose, your message, and a document if you attach one (.doc, .docx or .pdf). Also anything else you decide to tell us.
- Why
To read and answer your enquiry, and to prepare a proposal or take other steps you ask for before any agreement is made.
- Legal basis
Steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). For general questions that are not about a possible contract, our legitimate interest in answering business enquiries (Article 6(1)(f)).
- Where it goes
Your message reaches us as an email in our studio inbox, delivered by our email hosting provider. It is not stored in a database on the site.
Please do not send sensitive information (such as health data or identity document numbers) or files you are not allowed to share. If you email hello@studioidd.com directly, we handle your message in the same way. Ticking the box under our forms confirms that you have read this policy. It is not the legal basis for using your data.
When you use the referral form
- What we process
Your name and email address, and your friend’s name and email address, which you give us.
- Why
To get in touch with your friend, tell them who suggested us and talk through what they need. And to keep track of the referral and, if it leads to a new client, handle the commission described on the referral program page.
- Legal basis
Our legitimate interest in receiving introductions and following them up (Article 6(1)(f) GDPR). For you, handling a commission is also necessary to deliver what the referral page offers (Article 6(1)(b)).
- Where it goes
The same route as the contact form: an email to our studio inbox.
We receive your friend’s details from you, not from them. When we first contact your friend, we tell them who gave us their details, what we hold, and how to object or ask us to delete it. We use their details only for that referral and we stop if they ask. We do not add them to our newsletter.
Please refer only someone who knows you are passing on their details and is happy to hear from us.
When you subscribe to the newsletter
- What we process
Your email address, the page of our site where you subscribed, the date and time, and the version of the consent wording you agreed to.
- Why
To send you occasional emails about our content and services.
- Legal basis
Your consent (Article 6(1)(a) GDPR). You can withdraw it at any time. Withdrawing does not affect emails we sent before.
- Where it is kept
In the database of our content system (WordPress), which runs on a server hosted by DigitalOcean.
- Your IP address
Used for a short moment to limit repeated sign up attempts (rate limiting). It is not saved with your subscription.
- Unsubscribing
Use the unsubscribe link in any newsletter, or email hello@studioidd.com.
When you simply visit the site
- What we process
Technical data your browser sends with every request: IP address, date and time, the page requested, browser and device type, the page you came from and the response status.
- Why
To deliver the site, keep it secure, detect abuse and fix errors.
- Legal basis
Our legitimate interest in running a secure and working site (Article 6(1)(f) GDPR).
- Who keeps it
Our hosting providers, in their server logs: Vercel for the website and DigitalOcean for the content server. We do not use these logs to track or profile you.
What we do not do
We do not use analytics, advertising, retargeting or tracking pixels. We do not sell personal data. We do not profile you or make decisions about you by automated means.
5. Is your data sent outside the EU?
Vercel is based in the United States, so technical data such as logs can be processed there. Vercel is certified under the EU-US Data Privacy Framework, which the European Commission has recognised as giving an adequate level of protection (adequacy decision of 10 July 2023). Vercel’s data processing terms also include the EU Standard Contractual Clauses as a backup.
If any other provider handles your data outside the European Economic Area, we make sure a valid safeguard is in place, either an adequacy decision or Standard Contractual Clauses. You can ask us for information about these safeguards at hello@studioidd.com.
6. How long do we keep your data?
We keep personal data only as long as we need it for the purpose it was collected for. When a period ends, we delete the data or make it anonymous.
| Data | How long we keep it |
|---|---|
| An enquiry that does not lead to a project | Up to 12 months after our last message, then deleted. |
| An enquiry that leads to a project | For the length of the project, and after it for as long as Bulgarian accounting, tax and other laws require us to keep the related records, and for as long as a legal claim could still be brought. |
| Referral: your friend’s details | Until we have contacted them and had a reply. If there is no reply, or no project follows, no later than 6 months after we first contact them, or sooner if they ask. |
| Referral: your details | As long as needed to handle the referral and any commission. If a commission is paid, the payment records follow the rules for project records above. |
| Newsletter subscription | Until you unsubscribe. We then remove your address from the list, within 30 days at the latest. |
| Server logs | No longer than 30 days where we control the setting. Otherwise the hosting provider’s own schedule applies. |
| The language cookie | One browser session. |
7. What are your rights?
Under the GDPR you have the right to:
- Access your data and get a copy of it.
- Correct data that is wrong or incomplete.
- Erase your data, when there is no good reason for us to keep it.
- Restrict how we use your data, in the cases the law lists.
- Receive your data in a portable format and have it passed to another provider, where the processing is based on consent or a contract and is automated.
- Object to processing based on our legitimate interest.
- Withdraw your consent at any time, for example by unsubscribing from the newsletter.
To use any of these rights, email hello@studioidd.com. We may ask you to confirm who you are before we act, so that nobody else can get your data. We answer within one month. If your request is complex, we may extend that by up to two more months and we will tell you why. It is free, unless a request is clearly unfounded or excessive.
8. Who can you complain to?
We would like the chance to put things right, so please write to us first. You do not have to. You always have the right to complain to the supervisory authority in Bulgaria:
Commission for Personal Data Protection (Комисия за защита на личните данни, КЗЛД)
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
You can also complain to the authority in the EU country where you live or work, or go to a court.
9. How do we protect your data?
Connections between your browser and the site are encrypted (HTTPS). We limit access to our inbox, content system and hosting accounts to people who need it, and we choose providers that commit to protecting the data they handle.
No online service is completely secure. If a breach is likely to put you at risk, we will report it to the Commission for Personal Data Protection within 72 hours as the law requires, and we will tell you directly when the risk to you is high.
10. What about children?
The site is meant for businesses and adults. We do not knowingly collect data from children. If you think a child has sent us personal data, tell us at hello@studioidd.com and we will delete it.
11. What about links to other sites?
The site links to other websites. Blog articles also have share buttons for Facebook, LinkedIn and Instagram. These are plain links: nothing is loaded from those networks and nothing is sent to them unless you click. Once you do, their own privacy policies apply, and we are not responsible for them.
12. Will this policy change?
We may update it when the site or the law changes. The date at the top shows the latest version. If a change matters to you, for example a new way we use your data, we will say so clearly on the site, and where the law requires it we will ask for your consent again. Our terms and conditions explain the rules for using the site.
13. How can you reach us?
Email hello@studioidd.com. Tell us what you need and we will get back to you.