1. Controller and scope
Serdica Eterna Sofia Non-Profit Association, UIC 208207280, VAT No. BG208207280, 21 Ivan Radoev St., floor 5, Sofia, Republic of Bulgaria, represented by Filip Boyanov Nikolov, is the controller. Contact: serdica_aeterna@abv.bg; +359 883 345 224.
This Policy explains processing related to the Website and festival under Regulation (EU) 2016/679 ("GDPR") and applicable Bulgarian law. Data is processed lawfully, transparently, for specified purposes, minimally and for limited periods.
2. Data, purposes, legal grounds and indicative retention
| Processing | Purpose, legal ground and indicative retention |
|---|---|
| Email/telephone correspondence | Responding and organisation; legitimate interests or pre-contractual steps; up to 2 years after closure unless law requires longer. |
| Public-event photos/video | Festival documentation and promotion; balanced legitimate interests or consent where required; until purpose expires or a valid objection is upheld. |
| Forms/participation requests — when enabled | Name, contact, organisation and request content; pre-contractual steps, legitimate interests or consent; generally up to 2 years. |
| Newsletter — when enabled | Email and subscription evidence; consent; until withdrawal, plus a limited suppression record. |
| Tickets/donations — when enabled | Identity, payment and accounting data; contract, legal obligation and applicable donation basis; accounting records for statutory periods. |
| Security logs | IP, date, request and device as provided by hosting; legitimate security interest; short provider-defined period. |
| Analytics/advertising — only after consent | Online identifiers and interaction data; consent; according to the published technology table. |
3. Images, video and children
Photography and filming may take place for archival, information and promotional purposes. Notice should be provided at entry or in the programme, with a reasonable way to avoid close individual shots. Wide and journalistic public-event images are assessed under legitimate interests. Directed portraits, interviews and advertising use—especially involving children—will use appropriate parent/guardian permission where legally required. Removal requests may be sent to serdica_aeterna@abv.bg with enough information to identify the image.
4. Recipients and international transfers
Data is shared only as necessary with hosting, IT, email/newsletter, analytics, ticketing/payment providers, accountants, advisers and authorities. Required processor contracts apply. Transfers outside the EEA will rely on a GDPR mechanism such as adequacy or Standard Contractual Clauses, with supplementary measures where needed. Actual providers must be inserted before future functions launch.
5. Your rights
- access and a copy;
- rectification;
- erasure and restriction where conditions apply;
- portability where applicable;
- objection to legitimate-interest processing;
- withdrawal of consent without affecting earlier lawfulness;
- complaint to the Bulgarian Commission for Personal Data Protection, www.cpdp.bg.
6. Requests, security and updates
Send requests to serdica_aeterna@abv.bg. Reasonable identity verification may be requested. Responses follow GDPR deadlines. Appropriate safeguards are used, although no internet service guarantees absolute security. No solely automated decisions with significant legal effects are currently made. This Policy will be updated when activities or providers change.