Privacy policy

The controller of your personal data is K!K!Design (referred to below as “we”).

How to reach us about personal data:

• by e-mail: info@kkdesign.bg
• by phone: +359 884 615 302

This policy explains what happens to your data on kkdesign.bg, in Bulgarian and in English:

• when you send us a brief from the Contact page;
• when you e-mail us or call a number shown on the site;
• when you browse the site (technical data and cookies).

When we build or look after a site for a client, we sometimes process personal data on the client’s behalf, such as the enquiries sent through their site. In that case the client is the controller and we work under a contract with them. This policy doesn’t cover that data.

A brief from the Contact page

• Required: your name, e-mail address, phone number, at least one chosen service and a few words about the project. Without these we can’t reply.
• Optional: company, country, current website, budget and timeline.

We use them to reply, arrange a call and prepare a quote.

When you e-mail or call us

We receive your name, your e-mail address or phone number, and whatever you choose to tell us. We use it to reply.

When you browse the site

The server and the site’s security software record technical data: IP address, browser, the page opened and the time. We use it only for security, for example to stop attacks and spam. The site uses no analytics or advertising tools.

What we don’t do

• We don’t sell or rent data.
• We don’t use it for advertising or build profiles.
• We don’t make automated decisions that affect you.

• Replying to a brief and preparing a quote. Steps we take at your request before a possible contract (GDPR Article 6(1)(b)).
• General questions not about a project. Our legitimate interest in replying to people who write to us (Article 6(1)(f)).
• Site security and spam protection. Our legitimate interest in protecting the site and the data on it (Article 6(1)(f)).
• Performing a contract, if you become a client. Article 6(1)(b).
• Accounting and tax. A legal obligation (Article 6(1)(c)).

• The people on our team who work on your enquiry.
• Companies that help us technically, only on our instructions and under a contract with us:
  • the hosting provider whose servers run the site;
  • our e-mail provider;
  • Defiant Inc., USA, maker of the Wordfence security software, which may receive technical data about attacks, such as the IP addresses of failed logins.
• Our accountant, if you become a client and we invoice you.
• Public authorities, only where the law requires it.

The site and its database are on servers in the European Union.

Exceptions:

• Wordfence (Defiant Inc., USA) receives only the technical security data described above.
• YouTube videos in a blog post load only if you press the button for them. Google then receives your IP address and browser data and may set its own cookies. If you don’t press the button, YouTube receives nothing from our site.

The site’s fonts and scripts all load from our own server, not from other sites.

• Briefs and enquiries that don’t lead to a contract: for as long as we need them to reply and discuss the project, then deleted.
• If you become a client: for the length of the contract, and payment records for as long as accounting and tax law requires.
• Security logs: for as long as we need them to detect and stop attacks, then deleted.
• Site backups: for as long as they are needed to restore the site after a problem. Deleted data disappears from them when the backup expires.
• If you ask us to delete your data: we delete it sooner, without undue delay, unless the law obliges us to keep it.

You have the right:

• of access: to know whether we hold data about you, what it is, and to get a copy;
• to rectification: if the data is inaccurate or incomplete;
• to erasure: when it’s no longer needed, when you withdraw consent, or when it was processed unlawfully;
• to restriction: for us to stop using it for a while, for example while we check its accuracy;
• to portability: to receive the data you gave us in a machine-readable format;
• to object: to processing based on our legitimate interest;
• to withdraw consent at any time. This doesn’t affect what was done before.

How: write to us or call (contact details under “Who is responsible for your data”). It costs nothing. We reply within one month. If a request is complex, this can be extended by two further months, and we’ll tell you so within the first month. We may ask you to confirm your identity so we don’t give your data to someone else.

Complaints

If you believe we’re breaching your rights, you can complain to the Bulgarian Commission for Personal Data Protection (КЗЛД / CPDP):

• address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
• e-mail: kzld@cpdp.bg
• website: www.cpdp.bg

If you live or work in another EU country, you can also contact the supervisory authority there. You can also go to court. We’d be glad if you came to us first, so we can sort it out together.

• The site runs over an encrypted connection only.
• Only team members with a personal account, password and two-step login can see briefs.
• The site has a firewall, and the forms are protected from spam without outside services or puzzles.
• The forms load no scripts or fonts from other sites.
• Old briefs are deleted after the period stated above.

If a breach affecting your data ever happens, we’ll notify the CPDP within 72 hours, and you too where there is a high risk to your rights, as the law requires.

The site is meant for businesses and adults. We don’t knowingly collect children’s data.

We’ll update this policy when the site or the way we work changes, for example if we add analytics. The date of the last change is at the top. We’ll also announce important changes on the site itself.