The site uses no cookies and collects no statistics. When you send an enquiry through the form, it is stored in a protected database (Google Firebase) so that I can reply to you. One of the demo applications also uses an external service. This document explains what is processed and on what terms.
| Controller | Nikolay Nedelchev, a natural person practising a liberal profession |
|---|---|
| Activity | building websites and digital solutions under the name SAITORA |
| nikolay@nedelchevweb.com | |
| Phone | 0878 396 223 |
| Location | Sofia, Bulgaria |
The activity is carried out by a natural person. There is no registered company and no designated data protection officer, since the processing does not require one under Art. 37 of the General Data Protection Regulation (GDPR).
The site has no user accounts for visitors and does not track your behaviour. The only thing stored on a server is an enquiry that you send yourself through the form (section 4).
| Cookies | None are used — neither first-party nor third-party. |
|---|---|
| Analytics | None. Traffic is not counted, visits are not tracked. |
| External services | The pages embed no maps, fonts, videos, chats or social network buttons and load no external scripts. The form connects to Google Firebase only when you press “Send enquiry”. For the demo applications see section 3. |
| Ad networks | None. No profiling and no automated decision-making take place. |
| Local storage | Your browser keeps the page language you select (Bulgarian, English or German). While the tab is open (sessionStorage, not a cookie) it also remembers the first page you opened and the domain of the site you came from (for example google.com). These two values leave your device only together with an enquiry you send, and disappear when you close the tab. |
The /demos/ section contains working applications you can try out. They are separate from the site and some of them work differently:
| Snake Luigi | Keeps a leaderboard of the best scores. When a score is saved, the game sends to Google Firebase the name you chose and your points. Do not enter a real name if you do not want it to be stored. The controller of this database is Nikolay Nedelchev, and Google Ireland Limited acts as processor. |
|---|---|
| Grave Knight, BO Calculator, Област·Демо | They run entirely in your browser. Nothing is sent out. |
| The remaining demos | Static mock-ups with no data processing. |
The leaderboard data is kept for as long as the game exists, and is deleted on request at the address given below.
When you press “Send enquiry”, the form data is sent directly to a Cloud Firestore database on Google Firebase (a SAITORA project, data centre in Belgium, region europe-west1). Only I can see the stored enquiries — through an internal application with a protected login. Site visitors can only send new enquiries, not read the ones already stored.
| What you fill in | Required: what you need (type of service), a short description, name and email. Optional: company, phone, the address of your current website and a timeline. |
|---|---|
| What is added automatically | The language of the form; the date and time of sending; the first page of the visit and the domain you came from (section 2); the offer code if you opened the site from a link in one of our emails; how long it took to fill in the form (to protect against automated spam); the version of this policy that you have read. |
| What is not stored | The form does not store your IP address, cookies or device data. Google, as the service provider, processes technical connection data (such as the IP address) to deliver the request and protect the service against abuse. |
| Spam protection | A hidden field, a minimum time to fill in and a limit on how often the form can be sent. Enquiries that look like automated spam are set aside and deleted within 30 days. |
| If sending fails | The form offers to send the same text by email from your own mail account. The enquiry then reaches me as an email (section 6). |
The checkbox “I have read the Privacy Policy” confirms that you have read this text. It is not consent to marketing: addresses from enquiries are not used for newsletters or advertising campaigns.
| What data | What you sent through the form or by email, and my working notes on the enquiry: its stage (for example “offer sent”), the date of the next step, notes from calls and the offer sent. |
|---|---|
| Purpose | Replying to the enquiry, preparing a quote and, if it comes to that, performing a contract. |
| Legal basis | Art. 6(1)(b) GDPR — steps taken at the data subject's request prior to entering into a contract, and performance of a contract. For correspondence outside that scope — Art. 6(1)(f) GDPR, the legitimate interest in replying to messages received. |
| Retention | Spam and automated messages — up to 30 days. Enquiries with no follow-up (no reply, declined, unsuccessful offer) — up to 12 months after the last contact. Where a contract is concluded — up to 5 years after it ends, and accounting documents for the period set by the Accountancy Act (Закон за счетоводството). Deleting an enquiry also deletes all notes on it. |
I do not sell personal data and do not provide it to third parties for their own purposes. Technically, it is accessible only to the providers I work through:
Some of these services may involve transfers of data outside the European Economic Area (for example technical support by Google). Such transfers take place on the basis of European Commission adequacy decisions or standard contractual clauses.
Under the GDPR you have the right to:
Write to nikolay@nedelchevweb.com. I reply within one month. If the request is complex, that period may be extended by a further two months, of which I will notify you.
If you believe your rights have been infringed, you may lodge a complaint with the supervisory authority:
| Authority | Commission for Personal Data Protection (Комисия за защита на личните данни) |
|---|---|
| Address | Sofia 1592, bul. „Prof. Tsvetan Lazarov“ 2 |
| kzld@cpdp.bg | |
| Website | cpdp.bg |
Besides websites, I build ordering systems, booking systems, customer portals, internal business systems and automations. In such cases the system handles the data of my client's own customers.
| Where responsibility lies | The client is the controller of that data. I act as processor under Art. 28 GDPR and work only on their documented instructions. |
|---|---|
| What we sign | Before any access to real data, a separate data processing agreement is concluded, setting out the purposes, the types of data, the duration and the security measures. |
| During development | I work with synthetic or anonymised data wherever that is technically possible. |
| Sub-processors | I do not engage sub-processors with access to data without the client's prior written consent. |
| After the end | When the contract ends, the data is returned or deleted on the client's instructions. |
This policy governs my site only. Processing within a system already built is governed by the policy of the client concerned.
The site is served over HTTPS. The database rules allow visitors only to create a new enquiry with validated fields — no visitor can read, change or delete stored enquiries. The internal application requires a login with an account that has been explicitly granted a role; signing out deletes the local copy of the data from the device. Correspondence is stored in a mailbox protected by a password and two-factor authentication.
The services are aimed at business clients and are not intended for persons under 18. I do not knowingly collect children's data.
If the way I work changes, this document is updated. Material changes are announced on the home page.
Questions about this document: nikolay@nedelchevweb.com