Privacy Policy

Neda Georgieva Petrova is committed to protecting your privacy. This Privacy Policy explains how personal data is collected and used, as well as your rights and options in this regard. Please also review our Cookie Policy, which explains the use of cookies and other web tracking technologies through the website www.nedapetrova.com.

Who Is the Data Controller?

Data Controller: Neda Georgieva Petrova
Tax ID: 9703298457
Registered Address: 21 Treti Mart Str., 6500 Svilengrad, Bulgaria
Phone: +359 876 506 032
Email: nedapetrov.paperartist@gmail.com
Domain name: www.nedapetrova.com

The Data Controller acts within the meaning of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and the Bulgarian Personal Data Protection Act.
Appropriate technical and organisational measures are applied to ensure the security, integrity, and confidentiality of personal data in accordance with applicable European Union and Bulgarian legislation.

For What Purposes Do We Process Your Personal Data?

Personal data is processed only to the extent permitted by the GDPR and applicable Bulgarian legislation. Processing is carried out for specific, explicit, and legitimate purposes and will not be further processed in a manner incompatible with those purposes.

Personal data may be processed for the following purposes:

• responding to inquiries, requests, or communications submitted via the website, contact form, email, or phone;
• managing professional relationships with clients and interested persons;
• communicating regarding artistic projects, exhibitions, commissions, or potential collaborations;
• issuing invoices and fulfilling accounting and tax obligations where a sale or service is agreed outside the website;
• complying with legal and regulatory obligations;
• improving website content and professional communications;
• protecting the legitimate interests of the Data Controller, including the establishment, exercise, or defence of legal claims;
• managing and administering newsletter subscriptions;
• sending newsletters or promotional communications only where explicit consent has been provided.

How Do We Collect Your Personal Data?

Personal data is collected directly from users when they:

• submit a contact form on the website;
• subscribe to the newsletter;
• contact the Data Controller by email or phone.

At the time of collection, users are informed about the identity of the Data Controller, the purposes and legal basis of processing, recipients or categories of recipients, retention periods, and their rights under data protection law.

Categories of Personal Data

The personal data processed may include:

• identification and contact data (name, email address, and, if provided, phone number);
• message content and any information you choose to include in the contact form or correspondence;
• newsletter subscription data (email address and technical records evidencing consent, such as date, time, and source);
• invoicing and payment-related data, only where legally required and applicable.

The website does not intentionally collect special categories of personal data. Users are kindly requested not to include sensitive personal information in the contact form or messages.

Website, Cookies, and Social Media

The website www.nedapetrova.com may collect limited technical information related to website navigation through cookies and similar technologies. Detailed information about cookie usage, purposes, and management options is available in the Cookie Policy.

The Data Controller maintains profiles on social media platforms for communication and promotion. These profiles are operated independently from this website. If you contact the Data Controller through social media, your personal data will be processed by the relevant platform provider in accordance with its privacy policy and may also be processed by the Data Controller for the purpose of responding to your request.

User Responsibility

By providing personal data via electronic means, the user confirms that they are at least 14 years of age, in accordance with applicable Bulgarian legislation, and that the information provided is accurate and up to date.
Users are responsible for informing the Data Controller of any changes to their personal data.

Legal Basis for Processing

Personal data is processed in accordance with Article 6 of the GDPR on the basis of one or more of the following legal grounds:

• performance of a contract or taking steps prior to entering into a contract, such as responding to requests for artistic services, commissions, or collaborations;
• compliance with legal obligations, including accounting and tax requirements;
• legitimate interests pursued by the Data Controller, such as professional communication, portfolio presentation, website security, and protection against legal claims, provided that such interests do not override the rights and freedoms of data subjects;
• explicit consent, where required, in particular for newsletter subscriptions and promotional communications. Consent may be withdrawn at any time.

Conservation Period of Personal Data

Client and invoicing data, where a professional relationship or sale is established outside the website, is retained for as long as necessary to fulfil legal and accounting obligations. Accounting and invoicing documents are retained for 10 years in accordance with the Bulgarian Accountancy Act.

Communications and correspondence are retained for up to 5 years from the last interaction, where necessary to manage professional relationships or to establish, exercise, or defend legal claims.

Personal data of prospective clients who submit inquiries without resulting in a professional engagement is retained for up to 24 months from the last contact, unless deletion is requested earlier.

Newsletter subscription data is retained until consent is withdrawn (unsubscribe). Evidence of consent and minimal suppression records may be retained for a limited period as necessary to demonstrate compliance and to ensure that unsubscribed users are not contacted again.

Data Recipients

Personal data may be disclosed to third parties only where necessary and legally permitted, including:

• public authorities and supervisory bodies, where required by law;
• accounting and tax service providers;
• newsletter and email communication service providers acting as data processors;
• legal advisers and service providers assisting with compliance and dispute resolution.

All recipients are required to process personal data in compliance with applicable data protection legislation and under appropriate contractual safeguards where applicable.

Your Rights as a Data Subject

You have the right to:

• access your personal data;
• request rectification of inaccurate or incomplete data;
• request erasure of personal data where legally applicable;
• request restriction of processing;
• object to processing based on legitimate interests;
• request data portability where applicable;
• withdraw consent at any time, where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

How to Exercise Your Rights

You may exercise your rights free of charge by sending a request to:
nedapetrov.paperartist@gmail.com

If necessary, you may be asked to provide proof of identity to ensure the security of your data.
If you believe your rights have been infringed, you have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) or with the competent supervisory authority in your country of residence within the European Union.

Amendments to This Privacy Policy

This Privacy Policy may be updated or amended from time to time to reflect changes in practices, services, legal requirements, or operational needs. Any changes will be published on www.nedapetrova.com and will take effect from the date of publication unless stated otherwise. Where required by applicable law, additional notice of significant changes will be provided.

Last updated: 17 February 2026