Privacy Policy

Last updated: November 2026 · in line with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act

01. General

This policy explains how the personal data of visitors to iamcode.org (the "Site") and of people who send an event enquiry through the Site's form is collected, processed, stored and protected. The Site presents CODE, the events and production brand.

By using the Site and/or sending an enquiry, you confirm that you have read this policy. It should be read together with the Cookie Policy. The Bulgarian version is the governing text.

02. Data controller

Name

PRODUCER COMPANY CODE EOOD („ПРОДУЦЕНТСКА КОМПАНИЯ КОД“ ЕООД)

Company ID (EIK)

203622387

Registered office

bl. 31A, fl. 1, apt. 1A, Hristo Smirnenski, Slatina district, 1574 Sofia, Bulgaria

Represented by

the manager, Cvetelin Ivanov

Brand under which services are provided

CODE

Email for data protection questions

events@iamcode.org

No data protection officer (DPO) has been appointed under Art. 37 GDPR, as the volume and nature of the data processed do not require one.

03. What data is collected and why

We only collect the data you voluntarily give us through the enquiry form:

• name - to address you;
• contact (email or phone) - to reply and send you a proposal;
• event date (optional) and number of guests (optional) - to assess feasibility;
• indicative budget (optional) - if you choose to give it;
• type of event and message - a description of what you want.

Please do not send us special categories of data under Art. 9 GDPR (health, religion, political views, etc.). Providing the data is not mandatory, but without a name and contact we cannot reply to your enquiry.

Technical data. When the Site loads, your IP address and request data (browser, page address, time) are processed technically by Cloudflare, which sits in front of the Site, and by the hosting provider (server logs). This is needed to deliver the pages, keep them stable and protect the Site from attacks.

Protecting the form from abuse. To limit excessive enquiries from one source, we do not keep the IP address itself, only an irreversible cryptographic fingerprint (hash) together with the count and time of submissions. The fingerprint cannot be turned back into the address and is used for nothing else (data protection by design, Art. 25 GDPR).

04. Legal bases (Art. 6(1) GDPR)

• (b) - steps taken at your request before entering into a contract (replying to the enquiry and making a proposal) and, once a contract is signed, its performance;
• (f) - legitimate interest in the technical operation and security of the Site and protection against abuse (including protection through Cloudflare);
• (c) - legal obligation once a contract is signed (retention under accounting and tax law).

We do not use your data for direct marketing, do not sell it and do not carry out automated individual decisions or profiling (Art. 22 GDPR). As the processing is not based on consent, no separate consent (checkbox) is requested when you send the form.

05. Recipients and processors (Art. 28 GDPR)

Your enquiry is read only by the CODE team handling it. We use two processors:

• SuperHosting.BG OOD - hosting of the Site and email, with a data centre in Bulgaria.
• Cloudflare, Inc. - content delivery and protection network in front of the Site: all requests to iamcode.org pass through it. Cloudflare processes the IP address and request data to deliver the pages quickly and to stop attacks and malicious bots.

The form is processed on our hosting and the message reaches us as an email, with no other intermediary. The Site's fonts, libraries and videos are loaded from its own address; browsing it sends no requests to third-party services other than those listed here.

International transfers. Cloudflare, Inc. is based in the USA and also processes data in its centres outside the European Economic Area. The transfer relies on Cloudflare's certification under the EU-U.S. Data Privacy Framework (European Commission decision of 10 July 2023) and on the European Commission's standard contractual clauses in Cloudflare's data processing agreement. Form data is stored only at the hosting provider in Bulgaria. Data is disclosed to public authorities only where required by law.

06. Retention

Enquiry correspondence is kept for as long as the communication lasts and a reasonable period afterwards. If no contract follows, the data is deleted at your request or, failing that, no later than 12 months after the last correspondence. Once a contract is signed, related data is kept for the periods required by accounting and tax law. The fingerprint under section 03 is deleted automatically at the end of the limiting period. Hosting and Cloudflare logs are kept for the periods set by those providers.

07. Security (Art. 32 GDPR)

The Site is static and has no database of profiles or passwords. The connection is encrypted (HTTPS/TLS), and Cloudflare filters malicious traffic before it reaches the server. We only collect the data we need to reply (Art. 5(1)(c) GDPR).

08. Cookies

The Site sets no tracking, advertising or analytics cookies and uses no Google Analytics or advertising pixels. The only possible cookie is a Cloudflare security cookie, set only if Cloudflare shows a bot check. Details are in the Cookie Policy.

09. Your rights (Art. 12-22 GDPR)

• access (Art. 15) - confirmation of whether we process your data and a copy of it;
• rectification (Art. 16) of inaccurate or incomplete data;
• erasure (Art. 17), where there are grounds;
• restriction of processing (Art. 18);
• portability (Art. 20), where processing is automated and based on a contract;
• objection (Art. 21) to processing based on legitimate interest.

To exercise any of these rights, write to events@iamcode.org. We reply without undue delay and within one month at the latest (Art. 12(3) GDPR); where necessary this may be extended by two further months, and we will tell you. If we have reasonable doubts about your identity, we may ask for additional information (Art. 12(6)). Exercising your rights is free of charge, except for manifestly unfounded or excessive requests (Art. 12(5)).

10. Right to complain (Art. 77-79 GDPR)

You have the right to complain to a supervisory authority. In Bulgaria this is the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, cpdp.bg, kzld@cpdp.bg. You also have the right to a judicial remedy against a decision of the supervisory authority (Art. 78) and against the controller or processor (Art. 79).

11. Minors

The form is not intended for people under 16 and we do not knowingly collect children's data. If we learn that we have received such data without the consent of a parent or guardian, we delete it immediately.

12. Data breaches

In the event of a breach likely to result in a risk to your rights, we notify the CPDP within 72 hours (Art. 33 GDPR) and, where the risk is high, you as well without undue delay (Art. 34 GDPR).

13. Changes

If the way we process data changes, we will publish the new version on this page with a new revision date.