Page

Privacy Policy

This Privacy Policy explains what personal data thefaceofsofia.bg collects and processes, for what purpose and on what legal basis, in accordance with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act.

1. Who processes your data

The controller of the personal data is:

For all questions concerning your personal data and to exercise your rights, please use the email address given above.

2. Data we collect through the contact form

When you send a message through the form on the “Contact” page, the site stores the following in its own database:

The IP address and user agent are recorded to protect against abuse and to trace unwanted messages, not to analyse your behaviour.

Messages are stored in the site’s administration panel (the “Messages from the site” section) and are accessible only to users with an administrator or editor role at The Face of Sofia. The data is not shared with third parties and is not used for marketing.

To limit automated spam, the form uses a hidden field and a check on the time taken to complete it. These measures do not collect any additional personal data.

3. Legal basis and purpose

We process the data from the contact form on the basis of your consent, expressed by sending the message (Article 6(1)(a) GDPR), and our legitimate interest in responding to enquiries and maintaining communication (Article 6(1)(f)). The purpose is solely to handle your enquiry. We do not carry out automated decision-making or profiling.

4. Retention period

Messages from the contact form are stored for up to 12 months from receipt, after which they are deleted, unless a particular exchange requires longer retention — for example ongoing collaboration or a legal obligation.

5. Photographs from public events

The Face of Sofia organises and takes part in public events — project presentations, exhibitions, meetings and discussions open to visitors. Photographs are taken during these events and published in the galleries of the relevant projects and in materials about the association’s work. Individuals present may be recognisable in these photographs.

Purpose. To document the association’s activity and to inform the public about cultural events connected with the history and memory of Sofia.

Legal basis. We process these images on the basis of our legitimate interest under Article 6(1)(f) GDPR — to document and publicly present our own activity. In weighing that balance we take into account that the photographs were taken during public events at which those present participate openly and visibly, and that publication serves a cultural and informational rather than a commercial purpose. Provisions of Bulgarian law on freedom of expression and journalistic activity (the Personal Data Protection Act) may also apply, as may the rules on the use of images (the Copyright and Related Rights Act).

What we do not do. We do not use facial recognition and do not process the images by biometric means for identification. We do not use event photographs for advertising purposes and do not provide them to third parties for commercial use.

If you recognise yourself in a photograph. If you appear in a photograph published on this site and do not wish it to remain published, you may request its removal. Write to us at thefaceofsofia@gmail.com, giving the address of the page and describing which photograph concerns you (for example its position in the gallery). You also have the right to object to the processing under Article 21 GDPR. We will consider your request and, where it is well founded, remove the image as soon as possible.

6. Third-party content

The site loads content from the following external services. With every such request your IP address becomes known to the provider concerned, as this is technically necessary in order to deliver the content.

YouTube (Google). The project pages contain embedded videos. As soon as the page opens, the video’s preview image is loaded from a Google server (img.youtube.com). The video itself does not load automatically — it is loaded from youtube.com only after you press the play button, and at that moment Google/YouTube may set third-party cookies on your device. More in Google’s Privacy Policy.

Google Fonts. The site’s fonts are loaded from Google’s servers (fonts.googleapis.com and fonts.gstatic.com) on every page load. This sets no cookies but transmits your IP address to Google.

Google is a company established outside the European Economic Area, and its processing may involve the transfer of data to third countries under the conditions described in Google’s own policies. This applies only to the Google services listed above — not to where the site itself is hosted (see section 7).

The links to our Facebook, Instagram and YouTube profiles are ordinary links — their icons are part of the site and do not send data to those platforms unless you click the link yourself.

7. Hosting and technical logs

The site is hosted on a server of Hetzner Online GmbH, in a data centre in Helsinki, Finland. Finland is a member state of the European Union, and the site’s data is therefore stored entirely within the EU and does not constitute a transfer to a third country.

The hosting provider may record standard technical data, including IP addresses, in the server logs for security, diagnostics and maintenance purposes.

8. What we do NOT do

9. Cookies

A detailed description of the cookies that may be set when using the site can be found on the Cookies page.

10. Your rights

Under the GDPR you have the right to:

To exercise these rights, write to thefaceofsofia@gmail.com.

You also have the right to lodge a complaint with the supervisory authority — the Commission for Personal Data Protection (CPDP), Sofia, 2 Prof. Tsvetan Lazarov Blvd, www.cpdp.bg.

11. Changes to this policy

We may update this policy if the way the site works changes. The current version is always available at this address.