Privacy Policy

1. Data controller

I, Lachezar Simeonov (Sofia, Bulgaria), am the data controller for this Site. There is no statutory obligation for me to appoint a Data Protection Officer, so all privacy requests come to me directly:

• Email: privacy@lsimeonov.com
• Phone: (+359) 877 215 749

2. Personal data I collect

When you use my contact form or browse the Site, I may collect:

A. Data you provide directly (contact form)

• Your name
• Your email address
• The topic(s) you select and your message text

B. First-party analytics (only with your consent)

If you allow analytics cookies, my own server stores one row per page view in a first-party page_views table containing: page path, referring domain (self-referrals excluded), country derived from the request headers, browser user agent, screen width, browser language, a random session identifier held in your browser's session storage, and a timestamp. Your IP address is not stored.

C. Google Analytics 4 (only with your consent)

If you allow analytics cookies, GA4 collects usage data (pages viewed, clicks, scroll depth, approximate location, device and browser data) with IP anonymisation enabled. Until you consent, Google Consent Mode is set to "denied" and the Google Analytics script is not requested at all, so no data - not even your IP address - is sent to Google.

D. Spam protection

Google reCAPTCHA v3 is loaded only when you start interacting with the contact form. It processes device and interaction signals to score the submission. It is not loaded on pages where you do not use the form.

E. Scheduling embed (only with your consent)

The contact page can display a Calendly scheduling widget. It loads only if you accept the marketing cookie category. Once loaded, Calendly LLC (United States) receives your IP address, device and browser data, and - if you book - the name, email address and any answers you enter in its form, which it processes as an independent controller for the booking. Fonts on this Site are self-hosted, so no font requests go to third parties.

I do not use session recording, heatmaps, or profiling tools, and I do not run advertising or email-marketing tracking on this Site.

3. Purposes & legal bases

I use your data for the following purposes:

4. Cookies & tracking

I use cookies and similar technologies to remember your cookie choice and display preferences, and - only with your consent - to measure site traffic through Google Analytics 4 and my own first-party page-view counter, and to load the Calendly scheduling embed on the contact page. I do not use session replay, heatmaps, or advertising tracking.

On your first visit you can reject all non-essential cookies with a single click, accept all, or choose category by category. You can change your mind at any time via the "Cookie Preferences" button in the footer. Your choice is stored for 365 days, after which you will be asked again. For the full cookie inventory, see the Cookie Policy.

5. Data sharing & third parties

I do not sell or rent your personal data. The only recipients are the service providers that run this Site:

• Lovable (hosting, database, serverless functions) - stores the Site, contact submissions, and first-party analytics rows.
• Google Ireland / Google LLC - Google Analytics 4 (consent-based) and reCAPTCHA v3 (form spam protection).
• Cloudflare - content delivery and network-level protection for requests to the Site.
• Calendly LLC (United States) - the scheduling embed on the contact page, loaded only with your marketing consent. Calendly acts as an independent controller for bookings you make through the widget; transfers rely on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses.

These providers act as processors under data-processing agreements. Where a provider processes data outside the EEA (for example in the United States), the transfer relies on the EU Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework.

6. Data retention

• Contact form submissions: kept for up to 24 months after our last exchange, then deleted. You can request earlier deletion at any time.
• First-party analytics (page_views): kept for a maximum of 14 months on a rolling basis.
• Google Analytics 4: event data retention is set to 14 months.
• Your cookie consent record: stored in your browser for 365 days, after which you are asked again.
• Consent proof record: when you save your cookie choices, I store a record of the choice (timestamp, chosen categories, policy version, pseudonymised visitor and IP hashes, browser user agent) as evidence of consent under Art. 7(1) GDPR. Kept for 3 years, then deleted automatically.
• Erasure requests: the request record (email address and timestamp) is kept only until the request is actioned, and for a short period afterwards as proof of handling.
• 404 error logs: kept for 90 days.

These periods are enforced automatically: a scheduled monthly job deletes records that have passed their retention window.

7. Your rights

Under the GDPR, you have the right to:

• Access the personal data I hold about you.
• Rectify any inaccuracies.
• Erase your data ("right to be forgotten"), where I have no overriding legitimate interest.
• Restrict or object to processing based on legitimate interest.
• Withdraw consent for analytics or preference cookies at any time, with no effect on the lawfulness of processing before withdrawal - use the "Cookie Preferences" button in the footer.
• Data portability for data you have provided.

To exercise these rights, email me at privacy@lsimeonov.com. I respond within 30 days (Art. 12(3)), and free of charge unless a request is manifestly excessive.

For erasure of contact-form data you can also use the data deletion form. The Site sends no outgoing email, so requests are queued and reviewed by me personally, then actioned within one month at the latest. For your protection the form never discloses whether any records exist for the address you enter.

Right to lodge a complaint: if you believe I have handled your data unlawfully, you may complain to the Bulgarian supervisory authority - the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, email kzld@cpdp.bg, cpdp.bg - or to the supervisory authority in your own EU country of residence.

8. No age restrictions

My Site does not knowingly collect data from minors under 16. If you believe I have collected such data, please contact me to request its deletion.

9. Policy updates

I may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect changes. Please review periodically.

10. Contact me

For any questions or requests regarding your privacy, please contact:

• Email: privacy@lsimeonov.com
• Phone: (+359) 877 215 749