Privacy notice

1. Controller

The controller of your personal data is Ivan Martinov Dimitrov, an individual practising as a freelancer, with permanent address: Mladen Stoyanov 31, Pernik 2303, Bulgaria.

For any question about personal data: [email protected], phone +359 87 789 7510. We are not required to appoint a data protection officer and have not appointed one.

2. Scope

This notice explains how we process personal data when you visit the blockbooks.org website and when you contact us by email or phone, for example to request an offer. It is provided under Article 13 of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”).

Processing within the BlockBooks application at each building’s own address is described separately in the App privacy notice.

3. Visiting the website

On every visit, your browser sends technical data without which pages cannot be delivered: IP address, date and time of the request, the requested page address, the response code, and the type and version of your browser and operating system.

• Purpose: delivering the website, keeping it secure, and detecting and preventing abuse and attacks.
• Legal basis: our legitimate interest in keeping the website running and protected (Art. 6(1)(f) GDPR).
• Retention: technical logs on our server are kept for up to 30 days, unless they are needed longer to investigate a specific security incident.

The website is delivered through the Cloudflare network, which acts as our processor (hosting, content delivery and attack protection). As traffic passes through, Cloudflare processes the same technical data and keeps its own security logs for a limited period under its data processing terms.

Only with your consent (Article 6(1)(a) GDPR) does the website use the analytics and advertising tools listed in the Cookie notice, together with their providers, purposes and retention periods. You can withdraw your consent at any time under “Cookie settings” at the bottom of every page; this does not affect the lawfulness of processing before the withdrawal. The website uses no embedded videos, external fonts or social plug-ins.

Visitor analytics (Matomo)

If you allow the “Analytics” category, the website loads Matomo, open-source visitor analytics software that we run ourselves on our own server in Bulgaria. The data is not shared with the software’s developer or anyone else; it reaches our server through the Cloudflare network, just like the website itself.

• What data: your IP address, shortened before it is stored (the last 2 bytes are removed; the country is derived only from the shortened address), the pages you view and when, the website you came from, your language, browser and operating system type and version, device type and screen size, and clicks on links to other websites.
• Purpose: understanding how the website is used so that we can improve it. We do not use the data for advertising or combine it with other data about you.
• Legal basis: your consent (Art. 6(1)(a) GDPR and Article 4a(1) of the Bulgarian Electronic Commerce Act).
• No cookies: Matomo stores no cookies or other data on your device. Your actions are grouped into one visit by a pseudonymous code that the server computes from the technical data of the request; the code does not contain your IP address. If your browser sends a “Do Not Track” signal, the visit is not recorded.
• Retention: detailed visit data is deleted automatically after 180 days. Only aggregated statistics remain (for example, visits per page per month), which contain no personal data.

You can withdraw your consent at any time under “Cookie settings”; Matomo stops sending data at once and is not loaded again.

The language is chosen by the page address. The theme follows your device setting; if you choose the light or dark theme yourself, your browser keeps only that choice on your device and never sends it to us. See the Cookie notice for more.

4. Enquiries and sales contacts

When you email or call us, we process the data you give us: name, email address, phone number, the building you represent and the content of the correspondence.

• Purpose: answering your enquiry, sending an offer and agreeing on the provision of the service.
• Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR); where you represent a building or an owners’ association, our legitimate interest in communicating with the representatives of a prospective or existing customer (Art. 6(1)(f) GDPR).
• Retention: up to 2 years after the last contact if no contract is concluded. If a contract is concluded, for its duration and until the general five-year limitation period after its termination expires.

Providing the data is voluntary, but without it we cannot reply to you.

5. Invoicing

For customers with a contract, we process the data needed for invoicing and accounting: the name of the building or owners’ association, the representative’s name, address, invoice and payment details. The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and our legal obligations under accounting and tax law (Art. 6(1)(c) GDPR). Accounting documents are kept for the periods required by the Bulgarian Accountancy Act — up to 10 years.

6. Recipients

We do not sell personal data or share it with third parties for marketing. Data may only be received by:

• Cloudflare — website hosting and delivery, DNS and forwarding of incoming mail for addresses in the blockbooks.org domain;
• Google — the mailbox in which we receive emails sent to [email protected];
• Brevo — sending our email replies;
• an accountant serving our business, under confidentiality;
• public authorities, where we are required to by law.

7. Transfers outside the EU

Cloudflare and Google are headquartered in the United States and may process data outside the European Economic Area. Such transfers rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795) for certified companies and, where needed, on standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914). Brevo processes the data in the EU.

8. Your rights

You have the right to request:

• access to your personal data and a copy of it (Art. 15 GDPR);
• rectification of inaccurate data (Art. 16 GDPR);
• erasure where we have no ground to process it (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• portability of the data you provided to us (Art. 20 GDPR);
• to object to processing based on legitimate interest (Art. 21 GDPR).

To exercise your rights, write to [email protected]. We reply without undue delay and at the latest within one month. We may ask for information to confirm your identity.

You have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP / КЗЛД), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg, or with the supervisory authority of the member state where you live or work.

9. Automated decisions

We do not make decisions based solely on automated processing, including profiling, that would have legal effects on you.

10. Security

We apply appropriate technical and organisational measures: encrypted connections (HTTPS), a strict content security policy, restricted access to servers and logs, and regular software updates.

11. Changes

We may update this notice when our services or the law change. The current version and the date of the last change are published on this page.