Privacy Policy
Last updated: November 2026 · in line with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act
01. General
This policy explains how the personal data of visitors to iamcode.org (the "Site") and of people who send an event enquiry through the Site's form is collected, processed, stored and protected. The Site presents CODE, the events and production brand.
By using the Site and/or sending an enquiry, you confirm that you have read this policy. It should be read together with the Cookie Policy. The Bulgarian version is the governing text.
02. Data controller
- Name
- PRODUCER COMPANY CODE EOOD („ПРОДУЦЕНТСКА КОМПАНИЯ КОД“ ЕООД)
- Company ID (EIK)
- 203622387
- Registered office
- bl. 31A, fl. 1, apt. 1A, Hristo Smirnenski, Slatina district, 1574 Sofia, Bulgaria
- Represented by
- the manager, Cvetelin Ivanov
- Brand under which services are provided
- CODE
- Email for data protection questions
- events@iamcode.org
No data protection officer (DPO) has been appointed under Art. 37 GDPR, as the volume and nature of the data processed do not require one.
03. What data is collected and why
We only collect the data you voluntarily give us through the enquiry form:
- name - to address you;
- contact (email or phone) - to reply and send you a proposal;
- event date (optional) and number of guests (optional) - to assess feasibility;
- indicative budget (optional) - if you choose to give it;
- type of event and message - a description of what you want.
Please do not send us special categories of data under Art. 9 GDPR (health, religion, political views, etc.). Providing the data is not mandatory, but without a name and contact we cannot reply to your enquiry.
Technical data. When the Site loads, your IP address and request data (browser, page address, time) are processed technically by Cloudflare, which sits in front of the Site, and by the hosting provider (server logs). This is needed to deliver the pages, keep them stable and protect the Site from attacks.
Protecting the form from abuse. To limit excessive enquiries from one source, we do not keep the IP address itself, only an irreversible cryptographic fingerprint (hash) together with the count and time of submissions. The fingerprint cannot be turned back into the address and is used for nothing else (data protection by design, Art. 25 GDPR).
04. Legal bases (Art. 6(1) GDPR)
- (b) - steps taken at your request before entering into a contract (replying to the enquiry and making a proposal) and, once a contract is signed, its performance;
- (f) - legitimate interest in the technical operation and security of the Site and protection against abuse (including protection through Cloudflare);
- (c) - legal obligation once a contract is signed (retention under accounting and tax law).
We do not use your data for direct marketing, do not sell it and do not carry out automated individual decisions or profiling (Art. 22 GDPR). As the processing is not based on consent, no separate consent (checkbox) is requested when you send the form.
05. Recipients and processors (Art. 28 GDPR)
Your enquiry is read only by the CODE team handling it. We use two processors:
- SuperHosting.BG OOD - hosting of the Site and email, with a data centre in Bulgaria.
- Cloudflare, Inc. - content delivery and protection network in front of the Site: all requests to iamcode.org pass through it. Cloudflare processes the IP address and request data to deliver the pages quickly and to stop attacks and malicious bots.
The form is processed on our hosting and the message reaches us as an email, with no other intermediary. The Site's fonts, libraries and videos are loaded from its own address; browsing it sends no requests to third-party services other than those listed here.
International transfers. Cloudflare, Inc. is based in the USA and also processes data in its centres outside the European Economic Area. The transfer relies on Cloudflare's certification under the EU-U.S. Data Privacy Framework (European Commission decision of 10 July 2023) and on the European Commission's standard contractual clauses in Cloudflare's data processing agreement. Form data is stored only at the hosting provider in Bulgaria. Data is disclosed to public authorities only where required by law.
06. Retention
Enquiry correspondence is kept for as long as the communication lasts and a reasonable period afterwards. If no contract follows, the data is deleted at your request or, failing that, no later than 12 months after the last correspondence. Once a contract is signed, related data is kept for the periods required by accounting and tax law. The fingerprint under section 03 is deleted automatically at the end of the limiting period. Hosting and Cloudflare logs are kept for the periods set by those providers.
07. Security (Art. 32 GDPR)
The Site is static and has no database of profiles or passwords. The connection is encrypted (HTTPS/TLS), and Cloudflare filters malicious traffic before it reaches the server. We only collect the data we need to reply (Art. 5(1)(c) GDPR).
08. Cookies
The Site sets no tracking, advertising or analytics cookies and uses no Google Analytics or advertising pixels. The only possible cookie is a Cloudflare security cookie, set only if Cloudflare shows a bot check. Details are in the Cookie Policy.
09. Your rights (Art. 12-22 GDPR)
- access (Art. 15) - confirmation of whether we process your data and a copy of it;
- rectification (Art. 16) of inaccurate or incomplete data;
- erasure (Art. 17), where there are grounds;
- restriction of processing (Art. 18);
- portability (Art. 20), where processing is automated and based on a contract;
- objection (Art. 21) to processing based on legitimate interest.
To exercise any of these rights, write to events@iamcode.org. We reply without undue delay and within one month at the latest (Art. 12(3) GDPR); where necessary this may be extended by two further months, and we will tell you. If we have reasonable doubts about your identity, we may ask for additional information (Art. 12(6)). Exercising your rights is free of charge, except for manifestly unfounded or excessive requests (Art. 12(5)).
10. Right to complain (Art. 77-79 GDPR)
You have the right to complain to a supervisory authority. In Bulgaria this is the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, cpdp.bg, kzld@cpdp.bg. You also have the right to a judicial remedy against a decision of the supervisory authority (Art. 78) and against the controller or processor (Art. 79).
11. Minors
The form is not intended for people under 16 and we do not knowingly collect children's data. If we learn that we have received such data without the consent of a parent or guardian, we delete it immediately.
12. Data breaches
In the event of a breach likely to result in a risk to your rights, we notify the CPDP within 72 hours (Art. 33 GDPR) and, where the risk is high, you as well without undue delay (Art. 34 GDPR).
13. Changes
If the way we process data changes, we will publish the new version on this page with a new revision date.
Cookie Policy
Last updated: November 2026
01. What this policy covers
This policy explains whether and how iamcode.org (the "Site") uses cookies and similar technologies to store information on your device. It complements the Privacy Policy, which covers the processing of enquiry form data. The Bulgarian version is the governing text.
02. What a cookie is
A cookie is a small text file a website can store on your computer, phone or tablet. Cookies are most often used to remember preferences, keep you logged in, or track visitor behaviour for advertising and statistics.
03. What the Site does NOT use
The Site itself sets no cookies and stores nothing in your browser's storage (localStorage, sessionStorage). Specifically:
- no Google Analytics or any other web analytics tool;
- no advertising pixels or remarketing tools;
- no visitor profile is built and behaviour is not tracked between visits;
- fonts, libraries and videos load from the Site's own address, with no requests to third-party servers.
The place in the 3D world where you are (for example "Events") is kept only in the page address (the part after "#"), so that a reload does not send you back to the entrance. This is not a cookie and is not sent anywhere.
04. Cloudflare in front of the Site
Cloudflare, Inc. - a content delivery and protection network - sits in front of the Site. Every request to iamcode.org passes through it, so that pages are delivered quickly and attacks and malicious bots are stopped. In doing so Cloudflare processes your IP address and request data (details and legal bases in section 05 of the Privacy Policy).
During normal browsing Cloudflare sets no cookies. Only if its protection judges a request suspicious and shows a bot check is one cookie set after a successful check:
- Name
- cf_clearance
- Set by
- Cloudflare, Inc., for the domain iamcode.org
- Purpose
- remembers that your browser passed the check, so it is not shown again on every page
- Duration
- short, depending on the check setting (30 minutes by default)
- Type
- strictly necessary for the Site's security; contains no name, email or other personal information and is not used for advertising or tracking
If we enable other Cloudflare protections that set cookies in the future, we will describe them here.
05. Why there is no consent banner
Under Art. 4a of the Bulgarian Electronic Commerce Act, storing or accessing information on a user's device requires information and the option to refuse, unless it is strictly necessary to provide the service the user explicitly requested (Art. 4a(4)(2)). The Site itself stores and reads nothing on your device. The only possible cookie - Cloudflare's security cookie - is strictly necessary to deliver the requested page securely and is set only after a bot check. That is why the Site shows no cookie banner.
06. Data processed even without cookies
Even without cookies, when the Site loads Cloudflare and the hosting provider technically process your IP address and request data (logs), and to protect the form only an irreversible fingerprint of the IP address is kept. Details, legal bases and retention periods are in the Privacy Policy.
07. Managing cookies
You can review, delete or block cookies in your browser settings at any time. The Site will keep working; if you also block the security cookie, the bot check may appear more often.
08. Controller and contact
PRODUCER COMPANY CODE EOOD (CODE), Company ID 203622387, bl. 31A, fl. 1, apt. 1A, Hristo Smirnenski, Slatina district, 1574 Sofia, Bulgaria. Questions: events@iamcode.org.
09. Changes
If the way the Site uses cookies changes, we will publish the new version here with a new revision date.