Privacy policy

Last updated: 20 July 2026

This privacy policy explains what personal data we collect, why we collect it, how we use it and what your rights are. It is drawn up in accordance with Regulation (EU) 2016/679 (GDPR).

1. Who processes your data

For any question about your personal data, you can contact us at the email address above.

2. What data we collect

2.1. Data you provide to us

Category	Data concerned	When
Contact data	Name, email address, phone number (optional)	When you submit an enquiry via the contact form
Account data	Name, email address, password (stored in encrypted form)	On registration
Business description	Information about your business, requirements for the site, the conversation with the AI assistant	When requesting a generated site
Content for the site	Text, images, logos and other materials you provide	During site development
Billing data	Company name, company number, VAT number, registered address	On payment for the service

2.2. Data collected automatically

When you visit the site, technical data is processed automatically: IP address, browser and device type, operating system, pages visited, date and time of access. This data comes from the web server logs and is used for security and correct operation of the site.

3. Why we process your data and on what basis

Purpose	Legal basis
Generating the design and building the site — handling your request, communication, delivery of the finished product	Performance of a contract — Art. 6(1)(b) GDPR
Responding to enquiries via the contact form or by phone	Performance of a contract or pre-contractual steps — Art. 6(1)(b) GDPR
Managing your user account — login, access to your projects	Performance of a contract — Art. 6(1)(b) GDPR
Invoicing and accounting	Legal obligation — Art. 6(1)(c) GDPR
Site security — preventing abuse, attacks and spam	Legitimate interest — Art. 6(1)(f) GDPR
Showing completed sites in our portfolio	Legitimate interest — Art. 6(1)(f) GDPR. You may object at any time.
Defence in the event of a dispute	Legitimate interest — Art. 6(1)(f) GDPR

4. Use of artificial intelligence

These providers process the data in accordance with their own policies and contractual data protection commitments. Transfers to the USA are made on the basis of standard contractual clauses approved by the European Commission and/or an adequacy decision (EU–US Data Privacy Framework).

If you would prefer your business description not to pass through AI processing, you can contact us for an individual quote for development entirely by our team.

5. Who we share data with

We do not sell or pass on your personal data to third parties for marketing purposes. We share it only with the providers necessary for the service to work:

• Hosting provider — storage of the site and database (servers in the EU);
• AI service providers — OpenAI, Anthropic (see section 4);
• Google Fonts — loading fonts; Google may receive your IP address in the process;
• Email provider — sending messages to you;
• Accountancy firm — for accounting purposes;
• Public authorities — only where legally required.

With all providers processing data on our behalf, we have concluded processing agreements under Article 28 GDPR.

6. How long we keep data

Data	Retention period
Enquiries via the contact form	Up to 12 months after the last exchange
Site generation requests (not completed)	Up to 12 months
Client data with a performed contract	5 years from performance (limitation period)
Accounting documents and invoices	As required by law
User account data	Until the account is deleted at your request
Server logs	Up to 12 months

Once the relevant period expires, the data is deleted or anonymised.

7. Your rights

Under the GDPR you have the following rights:

To exercise your rights, write to contact@wdesign.bg. We respond within one month of receiving the request. For complex or numerous requests this period may be extended by two months, of which we will inform you.

Exercising your rights is free of charge. For manifestly unfounded or excessive requests we may refuse to act or charge a reasonable fee.

8. Data security

We apply appropriate technical and organisational measures to protect your data:

• encrypted connection (SSL/TLS) for all communication with the site;
• passwords stored in irreversibly encrypted form (hashing);
• restricted access to data — only staff who need it;
• protection against unauthorised access, CSRF attacks and form abuse;
• regular backups and security updates.

Nevertheless, no method of transmission over the internet is entirely secure. In the event of a security breach resulting in a high risk to your rights, we will inform you without undue delay in accordance with Article 34 GDPR.

9. Cookies

The site uses cookies to function properly and to remember your preferences. Detailed information about the types of cookies and how to manage them is in the Cookie policy.

10. Children's data

Our services are intended for adults and legal entities. We do not knowingly collect data relating to minors. If we discover we have received such data, we delete it immediately.

11. Complaints to the supervisory authority

We would ask you to contact us first — in most cases we can resolve the matter quickly.

12. Automated decision-making

We do not carry out automated decision-making producing legal effects concerning you, nor profiling within the meaning of Article 22 GDPR. Using AI to generate a design does not constitute automated decision-making, as every result is reviewed and validated by our team.

13. Changes to this policy

We may update this policy if our services or the applicable regulations change. The current version is always published on this page with the date of last update. In the event of significant changes we will notify you by email.