--- title: "Privacy policy" url: "https://kkdesign.bg/en/privacy/" description: "What personal data the K!K!Design website collects when you write to us or send a brief, why we use it, how long we keep it and what your rights are." updated: "2026-11-01" --- # Privacy policy ## In short At K!K!Design we take your privacy seriously. - When you send a brief or write to us, we ask only for what we need to reply and prepare a quote: your name, e-mail address and a few words about the project. Everything else is optional. - We don’t sell data, use it for advertising or track you. - The site uses strictly necessary cookies only. Details: [Cookie policy](https://kkdesign.bg/en/cookies/). - Briefs that don’t lead to a contract are kept no longer than needed, then deleted. - You can ask to see, correct or delete your data at any time. Last updated: 1 November 2026 ## Who is responsible for your data The controller of your personal data is K!K!Design (referred to below as “we”). How to reach us about personal data: - by e-mail: [info@kkdesign.bg](mailto:info@kkdesign.bg) - by phone: [+359 884 615 302](tel:+359884615302) ## What this policy covers This policy explains what happens to your data on kkdesign.bg, in Bulgarian and in English: - when you send us a brief from the Contact page; - when you e-mail us or call a number shown on the site; - when you browse the site (technical data and cookies). When we build or look after a site for a client, we sometimes process personal data on the client’s behalf, such as the enquiries sent through their site. In that case the client is the controller and we work under a contract with them. This policy doesn’t cover that data. ## What data we collect and why ### A brief from the Contact page - **Required:** your name, e-mail address, phone number, at least one chosen service and a few words about the project. Without these we can’t reply. - **Optional:** company, country, current website, budget and timeline. We use them to reply, arrange a call and prepare a quote. ### When you e-mail or call us We receive your name, your e-mail address or phone number, and whatever you choose to tell us. We use it to reply. ### When you browse the site The server and the site’s security software record technical data: IP address, browser, the page opened and the time. We use it only for security, for example to stop attacks and spam. The site uses no analytics or advertising tools. ### What we don’t do - We don’t sell or rent data. - We don’t use it for advertising or build profiles. - We don’t make automated decisions that affect you. ## Our legal bases - **Replying to a brief and preparing a quote.** Steps we take at your request before a possible contract (GDPR Article 6(1)(b)). - **General questions not about a project.** Our legitimate interest in replying to people who write to us (Article 6(1)(f)). - **Site security and spam protection.** Our legitimate interest in protecting the site and the data on it (Article 6(1)(f)). - **Performing a contract, if you become a client.** Article 6(1)(b). - **Accounting and tax.** A legal obligation (Article 6(1)(c)). ## Who sees your data - **The people on our team** who work on your enquiry. - **Companies that help us technically**, only on our instructions and under a contract with us: - the hosting provider whose servers run the site; - our e-mail provider; - Defiant Inc., USA, maker of the Wordfence security software, which may receive technical data about attacks, such as the IP addresses of failed logins. - **Our accountant**, if you become a client and we invoice you. - **Public authorities**, only where the law requires it. ## Transfers outside the European Union The site and its database are on servers in the European Union. Exceptions: - **Wordfence (Defiant Inc., USA)** receives only the technical security data described above. - **YouTube videos** in a blog post load only if you press the button for them. Google then receives your IP address and browser data and may set its own cookies. If you don’t press the button, YouTube receives nothing from our site. The site’s fonts and scripts all load from our own server, not from other sites. ## How long we keep data - **Briefs and enquiries that don’t lead to a contract:** for as long as we need them to reply and discuss the project, then deleted. - **If you become a client:** for the length of the contract, and payment records for as long as accounting and tax law requires. - **Security logs:** for as long as we need them to detect and stop attacks, then deleted. - **Site backups:** for as long as they are needed to restore the site after a problem. Deleted data disappears from them when the backup expires. - **If you ask us to delete your data:** we delete it sooner, without undue delay, unless the law obliges us to keep it. ## Your rights You have the right: - **of access:** to know whether we hold data about you, what it is, and to get a copy; - **to rectification:** if the data is inaccurate or incomplete; - **to erasure:** when it’s no longer needed, when you withdraw consent, or when it was processed unlawfully; - **to restriction:** for us to stop using it for a while, for example while we check its accuracy; - **to portability:** to receive the data you gave us in a machine-readable format; - **to object:** to processing based on our legitimate interest; - **to withdraw consent** at any time. This doesn’t affect what was done before. How: write to us or call (contact details under “Who is responsible for your data”). It costs nothing. We reply within one month. If a request is complex, this can be extended by two further months, and we’ll tell you so within the first month. We may ask you to confirm your identity so we don’t give your data to someone else. ### Complaints If you believe we’re breaching your rights, you can complain to the Bulgarian Commission for Personal Data Protection (КЗЛД / CPDP): - address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria - e-mail: kzld@cpdp.bg - website: [www.cpdp.bg](https://www.cpdp.bg/) If you live or work in another EU country, you can also contact the supervisory authority there. You can also go to court. We’d be glad if you came to us first, so we can sort it out together. ## How we protect data - The site runs over an encrypted connection only. - Only team members with a personal account, password and two-step login can see briefs. - The site has a firewall, and the forms are protected from spam without outside services or puzzles. - The forms load no scripts or fonts from other sites. - Old briefs are deleted after the period stated above. If a breach affecting your data ever happens, we’ll notify the CPDP within 72 hours, and you too where there is a high risk to your rights, as the law requires. ## Children The site is meant for businesses and adults. We don’t knowingly collect children’s data. ## Changes to this policy We’ll update this policy when the site or the way we work changes, for example if we add analytics. The date of the last change is at the top. We’ll also announce important changes on the site itself.