Privacy and personal data protection

d . media processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the applicable Bulgarian legislation.

Only data required for contact, contractual relations, and payment is processed.
Legal grounds include contract, pre-contractual relations, legal obligation, legitimate interest, and consent.
Storage follows defined periods depending on the type of documentation.
In most cases, data is not shared with third parties outside legally required situations.
Every client has the right to access, correct, erase, restrict, object, and request portability.

What data

Names, address, phone number, e-mail, payment information, and technical identifiers when they are needed for the service or the site.

Why

For contact, preparing offers and agreements, delivering services, accounting needs, protection in disputes, and improving content.

How long

Retention periods depend on the type of data: shorter for correspondence, longer for agreements, invoices, and accounting documents.

How it is protected

Data is stored with technical and organisational security measures and is deleted or anonymised after the necessary period expires.

Rights

Every client can request information, correction, restriction, erasure, or objection through direct contact with d . media.

Read the full policy

d . media conducts its activity in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679. This policy informs every Client about the processing of data through which a person is or may be identified.

Data controller -

d . media

1. TYPES OF PERSONAL DATA PROCESSED

1.1. d . media processes the following groups of personal data:

physical identity: names, address, telephone number;
(2) financial identity: bank account information (IBAN);
(3) digital identity: e-mail address, IP address, MAC address / device identifiers, cookies, tracking pixels, and account IDs in social networks, websites, or applications.

2. SOURCES OF PERSONAL DATA COLLECTION

2.1. d . media processes the following groups of personal data:

(1) from PayPal: e-mail address, address, telephone number, and other publicly visible data provided voluntarily;
(2) from Facebook: e-mail address, name, date of birth, and other publicly visible data provided voluntarily;
(3) from e-mail newsletter forms: e-mail address, name if provided, and IP address;
(4) in connection with services rendered: e-mail address, name, address, and telephone number.

3. PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA

3.1. d . media does not process special categories of personal data of Clients.

4. PURPOSES OF PERSONAL DATA PROCESSING

4.1. d . media processes personal data for the following purposes:

(1) providing information and assistance requested by you;
(2) analysing user behaviour to provide more relevant content;
(3) identification and contact with clients;
(4) all activities related to the existence, amendment, and termination of contractual relations;
(5) offering and promoting additional services;
(6) complying with regulatory requirements;
(7) protecting rights in the event of a dispute.

5. LEGAL BASIS FOR PROCESSING PERSONAL DATA

(1) for the performance of a contract or entry into pre-contractual relations;
(2) for compliance with a legal obligation;
(3) for the purposes of the legitimate interests of d . media;
(4) on the basis of freely given consent.

6. RETENTION PERIOD FOR PERSONAL DATA

6.1. d . media stores personal data during contractual relations and for a transitional period thereafter. If legal action is initiated, data may be retained until the end of such action. Data processed on the basis of consent is processed until consent is withdrawn.

6.2. Retention is carried out in compliance with the principles of minimisation, accuracy, storage limitation, and security.

6.3. After the relevant periods expire, data is deleted or anonymised securely.

6.4. Retention periods for personal data according to operational need are:

(1) client data (services / agreements): up to 5 years after completion of the agreement;
(2) accounting documents (invoices, receipts, agreements, payment documents): 10 years;
(3) communication data (e-mail correspondence, contact forms): up to 1 year after correspondence ends;
(4) marketing data (newsletter subscriptions): until consent is withdrawn;
(5) suppliers and partners: 5 years after the relationship ends;
(6) GDPR consents: for the duration of the consent plus 2 years for evidence.

7. DELETION OR ANONYMISATION OF DATA

7.1. Data deletion is a process in which data is removed in such a way that it cannot be restored.

7.2. The methods of deletion are as follows:

(1) logical deletion from databases and systems;
(2) physical destruction of paper documents through shredding or incineration;
(3) secure deletion from storage media through overwrite software;
(4) removal from backups when the retention period expires.

7.3. Data anonymisation is a process in which data is processed so that it can no longer be linked back to a specific person.

7.4. Examples of anonymisation include:

(1) replacing names with codes or identifiers without a matching key;
(2) removing unique identifiers such as e-mail address or telephone number;
(3) aggregating data, for example 10 users from Sofia instead of a list of names.

8. SHARING OF PERSONAL DATA

8.1. Personal data may be provided to regulatory, tax, judicial, and other authorities in accordance with applicable law.

8.2. Data may be provided to processors such as payment providers, Meta, or hosting providers where necessary.

9. PERSONAL DATA PROTECTION

9.1. d . media maintains appropriate technical and organisational measures for the protection of personal data. Information is stored on dedicated data storage devices located at the seat of d . media.

10. AUTOMATED DECISION-MAKING

10.1. d . media does not carry out automated decision-making using personal data.

11. RIGHTS OF CLIENTS

11.1. Every Client may exercise the following rights by written notice to d . media:

(1) the right to withdraw consent;
(2) the right of access;
(3) the right to rectification;
(4) the right to erasure;
(5) the right to restriction of processing;
(6) the right to object;
(7) the right to data portability.

12. INFORMED CONSENT

12.1. The collection of personal data begins with the initiation of pre-contractual or contractual relations. The service agreement expressly records that the Client agrees for their data to be collected and stored under this Policy.