Privacy Policy

1. Controller

BOYA DESIGN LTD (trading as Sirma Boya Studio)
Vitosha Boulevard, Capital Center, Floor 12, Sofia, Bulgaria
Email: contact@sirmaboya.com

BOYA DESIGN LTD is the data controller for personal data collected through this website.

2. Why we process your data and on what legal basis

When you submit the contact form on this website, we process your personal data to respond to your enquiry and assess whether we can work together.

Legal basis: Article 6(1)(f) GDPR — legitimate interests. Our legitimate interest is to receive and respond to inbound business enquiries from potential clients. We have conducted a three-part Legitimate Interest Assessment (LIA) documenting this basis, available on request.

We do not use your data for marketing, profiling, or any purpose other than handling your enquiry.

3. Personal data we collect

Through the contact form we collect:

Name

Your full name as entered.

Email

Your contact email.

Message

The body of your enquiry.

Project type

One of: Workspaces, Hostspaces, Shopspaces, Relaxspaces, Cultural institution, Other.

We do not collect payment data, sensitive special-category data, or data from minors. We do not operate a newsletter or any marketing list.

4. Recipients and processors

We share your data only with the following processors, each operating under a data processing agreement with us.

We do not sell, rent, or share your data with third parties for their own purposes.

5. International transfers

Resend processes data within the EU. No international transfer occurs.

Cloudflareis headquartered in the United States. Transfers to Cloudflare are covered by Standard Contractual Clauses (SCCs) under Article 46(2)(c) GDPR, implemented through Cloudflare's standard GDPR Data Processing Addendum, which is incorporated into their Terms of Service. You may request a copy of the applicable safeguards by writing to contact@sirmaboya.com.

Vercel— the project is configured to an EU region. If data is processed in a US-region Vercel deployment for any reason, the transfer is covered by Vercel's DPA incorporating SCCs.

6. Retention

We retain contact enquiry data — including all fields listed in Section 3 — for 12 months from the date of submission. After that period, the data is deleted automatically. If we enter into a client relationship following an enquiry, separate retention periods apply to contract and billing records under applicable accounting law.

7. Your rights

Under the GDPR you have the following rights in relation to your personal data:

• Access — request a copy of the data we hold about you (Art. 15).
• Rectification — ask us to correct inaccurate data (Art. 16).
• Erasure — ask us to delete your data where no overriding grounds apply (Art. 17).
• Restriction — ask us to restrict processing in certain circumstances (Art. 18).
• Portability — receive your data in a structured, machine-readable format (Art. 20).
• Objection — object to processing based on legitimate interests (Art. 21); we will cease processing unless we demonstrate compelling legitimate grounds.

To exercise any of these rights, write to contact@sirmaboya.com. We will respond within one month of receiving your request. If your request is complex or numerous, we may extend this by a further two months and will notify you of the extension within the first month.

We do not charge a fee for exercising your rights unless requests are manifestly unfounded or excessive.

8. Right to lodge a complaint

If you believe we have processed your data unlawfully, you have the right to lodge a complaint with the Bulgarian supervisory authority:

You may also lodge a complaint with the supervisory authority in the EU member state of your habitual residence or place of work.