Privacy Policy
Last updated: 30 October 2026
🇧🇬 На български: Политика за поверителност
This Privacy Policy explains how Promote Bulgaria (“Promote Bulgaria”, “we”, “us”) collects, uses, shares and protects personal data when you visit promotebulgaria.com or read our news, history and culture articles, subscribe to our newsletter, post a free or paid listing, book advertising, shop with us, donate or contact us. It is written to meet the EU and UK General Data Protection Regulation (GDPR and UK GDPR), Bulgaria’s Personal Data Protection Act, US state privacy laws including the California Consumer Privacy Act (CCPA/CPRA) and the California Online Privacy Protection Act (CalOPPA), Canada’s PIPEDA, Brazil’s LGPD, Australia’s Privacy Act and similar laws worldwide.
1. Who we are
promotebulgaria.com is run by Boryana Borisova, who runs Promote Bulgaria as a non-profit project (the data controller). Contact us about anything in this policy at hi@promotebulgaria.com. We are a very small project and do not have a Data Protection Officer; you will reach us directly. Our postal address is Repton House, London E4 9AE, United Kingdom.
2. What we collect
- Contact details — your name, email address and what you write when you contact us or book advertising.
- Newsletter and reader features — your email address and preferences if you subscribe to our weekly newsletter, register or answer a reader survey, including through Google Reader Revenue Manager.
- Listings and advertising — the business details, images, links and contact information you submit with a free or paid listing or advertising booking. Contact details you choose to publish in a listing are visible to everyone.
- Order details — name, billing and delivery address, email, phone number, what you bought and your order history. Card payments are handled by Stripe; we never see or store your full card number.
- Donations — your name, email and donation amount. Donations are processed by Stripe; we never see your full card number.
- Comments — the name, email and text you submit. Comments are checked for spam by Akismet.
- Usage and device data — pages visited, links clicked, device and browser type, IP address (which gives an approximate location), referring site and the date and time of your visit, collected through cookies and similar technologies.
3. How and why we use your data (legal bases)
| Purpose | Legal basis (EU/UK GDPR) |
|---|---|
| Reply to you and provide what you ask for | Contract, or steps before a contract |
| Take payment, deliver orders (including print-on-demand merch made and shipped by Printful) and handle returns | Contract |
| Publish, review and moderate listings and adverts, and send impression reports | Contract; legitimate interests (keeping the site safe and lawful) |
| Process and acknowledge donations | Contract; legal obligation (accounting) |
| Send newsletters and updates you signed up for | Consent (unsubscribe at any time with the link in every email) |
| Measure how the site is used and improve it (Google Analytics) | Consent in the EU/EEA; legitimate interests or consent elsewhere |
| Show ads, including personalised ads from Google AdSense | Consent in the EU/EEA, UK and Switzerland; notice and the right to opt out in the US and elsewhere |
| Keep the site secure, stop spam and fraud | Legitimate interests |
| Keep tax, accounting and legal records and respond to legal requests | Legal obligation |
Where we rely on legitimate interests, we have balanced them against your rights. You can object at any time (see “Your rights”). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Cookies and similar technologies
We use essential cookies to run the site, cart and checkout, and optional cookies for analytics and advertising only where you allow them. You can change your choices at any time through our cookie banner (CookieAdmin) and Google’s consent message. Full details, including a list of cookies, are in our Cookie Policy.
5. Who we share data with
We share personal data only with service providers that help us run the site, under contracts that require them to protect it, and only as much as they need:
- Our web hosting provider
- WordPress and WooCommerce plugins we use, including Akismet (spam filtering) by Automattic and CookieAdmin (consent)
- Google (Analytics, Tag Manager, Search Console, Site Kit, Reader Revenue Manager, AdSense advertising, Google Fonts, consent management)
- Stripe (shop payments, advertising bookings and donations)
- Printful (making and shipping merch) and delivery couriers
- Our email and newsletter provider
- YouTube, when you play an embedded video
- Facebook, when a featured listing is shared in our Facebook group (only the details you asked us to publish)
- Professional advisers (such as an accountant) and authorities where the law requires it
We do not sell your personal data for money. However, under some US state laws, letting Google use cookies to show personalised ads counts as “selling” or “sharing” personal data for “targeted advertising”. You can opt out at any time — see Your Privacy Choices (US State Privacy Notice).
6. International transfers
Some of our providers, including Google, Stripe and Printful, process data outside your country, including in the United States. Where the law requires it, we rely on adequacy decisions (such as the EU–US Data Privacy Framework and the UK Extension), Standard Contractual Clauses or the UK International Data Transfer Addendum.
7. How long we keep your data
- Listings and ad bookings: while the listing runs, then up to 2 years for records
- Enquiries: up to 2 years after our last contact
- Orders, donations, invoices and payment records: for as long as tax and accounting rules require (usually 6 years)
- Newsletter: until you unsubscribe
- Analytics data: 14 months
- Comments: until you ask us to remove them
8. Your rights
Wherever you live, you can ask us to:
- tell you what personal data we hold about you and give you a copy (access)
- correct it if it is wrong
- delete it
- give it to you, or another organisation, in a portable format
- restrict or stop using it, or object to how we use it
- stop sending you marketing
- withdraw any consent you gave, at any time (this does not affect what we did before)
- opt out of “sale”, “sharing” and targeted advertising (US) — see Your Privacy Choices (US State Privacy Notice)
Email hi@promotebulgaria.com to use any of these rights. We may ask you to confirm your identity. We reply within one month (GDPR) or 45 days (US state laws), and we never charge you or treat you differently for using your rights. If you are not happy with our answer you can appeal by replying to us, and you can complain to your data protection authority — for example the Commission for Personal Data Protection (CPDP) in Bulgaria, your national authority elsewhere in the EU, the ICO in the UK, the California Privacy Protection Agency or your state Attorney General in the US, or the Office of the Privacy Commissioner in Canada or Australia.
9. Do Not Track and Global Privacy Control
Browsers’ older “Do Not Track” setting has no agreed standard, so we do not respond to it. We do honour Global Privacy Control (GPC): if your browser sends a GPC signal, we treat it as a request to opt out of sale, sharing and targeted advertising for that browser.
10. Security
The site uses HTTPS encryption. We use strong passwords, two-factor authentication where available, regular updates and trusted providers. No system is perfectly secure; if a breach affects your data in a way that puts you at risk, we will tell you and the authorities as the law requires.
11. Children
promotebulgaria.com is not aimed at children. We do not knowingly collect personal data from anyone under 16. If you think a child has given us their data, email us and we will delete it.
12. Changes to this policy
We update this policy when our services or the law change. The date at the top shows the latest version. If a change is significant, we will tell you on the site or by email.
13. Contact
Questions or requests: hi@promotebulgaria.com. See also our Cookie Policy, Your Privacy Choices (US State Privacy Notice), Terms of Service and all our policies.