Privacy

01Who is responsible

Milli is a one-person web studio based in Bulgaria. In this notice, “I” and “me” mean Milli and the person who runs it. I am the controller for personal data processed through this website and through direct correspondence with me.

Controller: [[LEGAL: operator full name, or company name and EIK, and postal address]]. Contact for any privacy question or request: [[CONTACT: studio email address]]. I have not appointed a data protection officer because the law does not require one for a business of this size.

02The short version

• No cookies. Not for analytics, not for advertising, not for anything else.
• No analytics, tracking pixels, social media plugins or embedded third-party content.
• Fonts, images and scripts are served from this site’s own server. Your browser does not contact Google Fonts or any other third party when you visit.
• The enquiry form sends what you type to me by email, with a copy to you. It is not stored in a database on this site.

03Visiting the website

When you open a page, your browser sends technical information to the server that hosts this site. The server records it in log files so it can deliver the page and protect itself against abuse. This typically includes:

• your IP address
• the date and time of the request
• the page or file requested and the response status
• the referring page, if your browser sends one
• your browser type, version and operating system

I use this data only to run the site securely and to diagnose faults. I do not combine it with other data or use it to identify visitors. The legal basis is Art. 6(1)(f) GDPR: my legitimate interest in a secure, working website.

This site is hosted by Namecheap, Inc. (Phoenix, Arizona, USA) on servers in [[LEGAL: Namecheap datacenter chosen for this site (EU/Amsterdam, UK or US)]]. Server logs are kept for [[LEGAL: log retention period]]. Namecheap processes this data on my behalf under its data processing addendum (Art. 28 GDPR).

04The enquiry form

When you send the form, your name, email address, the options you chose and your message are transmitted over HTTPS to this site’s server and delivered by email: one message to me, and a confirmation copy to the address you entered. The form stores nothing in cookies or local storage, and the site keeps no database of enquiries.

The emails are sent through Resend (Plus Five Five, Inc., USA), acting as my processor. Resend keeps delivery records, including recipient addresses and message metadata, for [[CONFIRM: Resend data retention period for sent emails]]. [[CONFIRM: Resend data processing agreement accepted, and its transfer mechanism]]

The legal basis is the same as for email, described in the next section. From the moment the enquiry reaches my inbox, it is handled like any other email I receive.

05When you email me

If you contact me by email, I process what you send: typically your name, email address, company and the details of your project. I use it to reply, to discuss your project and to prepare a proposal.

The legal basis is Art. 6(1)(b) GDPR where your message relates to a possible or existing contract, and Art. 6(1)(f) GDPR for other enquiries, where my legitimate interest is answering you.

My email is handled by Zoho Corporation B.V. (Zoho Mail), acting as my processor. Its European service stores data in data centres in Amsterdam, the Netherlands, and Dublin, Ireland. [[CONFIRM: your Zoho Mail account is on the EU data centre (you sign in at mail.zoho.eu)]]

I delete enquiries that do not lead to a project once the conversation is over, and at the latest after 12 months. Where correspondence becomes part of a contract or an invoice, Bulgarian accounting and tax law requires me to keep it for longer, up to ten years (Accountancy Act, Art. 12). During that time it is kept only for that purpose.

06Clients and their websites

When I build or maintain a website or platform for a client, that client decides what personal data its visitors and customers provide. For that data the client is the controller and I act as a processor. We agree the terms in a separate data processing agreement under Art. 28 GDPR. Questions about a client’s site should go to that client first.

07Links to other websites

Case studies link to live client websites. Those sites are run by their owners and have their own privacy notices. Following a link takes you off this site, and this notice no longer applies.

08Sharing and transfers

I do not sell personal data, and I do not share it for advertising. I share it only with the processors named above, and with authorities or advisers where the law requires it. Namecheap, Inc. and Resend (Plus Five Five, Inc.) are US companies. Where personal data is transferred outside the European Economic Area, the transfer relies on an adequacy decision or on the EU standard contractual clauses. [[CONFIRM: transfer mechanism in Namecheap’s data processing addendum]]

09Your rights

Under the GDPR you have the right to:

• access the personal data I hold about you (Art. 15)
• have inaccurate data corrected (Art. 16)
• have your data deleted (Art. 17)
• restrict how I process it (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on legitimate interests (Art. 21)

To use any of these rights, email me at [[CONTACT: studio email address]]. I will reply within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. In Bulgaria, that is the Commission for Personal Data Protection (cpdp.bg).

You are not required to provide any personal data to use this website. Without an email address, I cannot reply to an enquiry. I do not use automated decision-making or profiling.

10Security

The site is served over an encrypted HTTPS connection. It has no database and no user accounts. The enquiry form sends your message on to email and keeps no copy on the server.

11Changes to this notice

I will update this notice when the site or my providers change. The date at the top shows the current version. If an English version and a translation differ, the English version applies.