1. General Provisions
Confidentiality is extremely important to us. This Privacy and Personal Data Protection Policy (hereinafter referred to as the “Policy”) governs the collection, use, storage and protection of personal data of natural persons processed by “Storyline” Ltd., UIC 208616544, with its registered seat and management address at: 158 Geo Milev Str., Entrance A, Floor 1, Apartment 3, Sofia, Bulgaria, e-mail: office@storyline.bg, telephone: +359 89 3968500 (hereinafter referred to as “We”, the “Controller”, or the “Data Controller”), through the website www.storyline.bg.
This Policy applies to the personal data of clients, prospective clients, partners and website visitors in connection with the provision of services in the field of marketing strategy and brand communication, graphic design and visual identity, as well as planning and management of events and brand experiences, including corporate and personal projects.
This document describes who processes personal data (the data controller), whose data is processed (categories of data subjects), what personal data is processed, how it is collected, used, stored and protected, and what rights data subjects have under Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR).
The Policy is available on the website www.storyline.bg as well as at the company’s registered address. Any person who provides personal data to “Storyline” Ltd. should review this Policy before providing such data.
Partners, subcontractors, employees and third parties working with or for “Storyline” Ltd. who have or may have access to personal data are required to be familiar with, understand and comply with this Policy. No third party is granted access to personal data without a prior confidentiality agreement and/or a data processing agreement imposing obligations not less strict than those assumed by the Controller.
For visitors who only browse the content of the website and do not submit enquiries through contact forms, the separate Cookie Policy applies. This Policy does not apply to legal entities.
2. Definitions
“Regulation” means Regulation (EU) 2016/679 (GDPR), which protects the rights and freedoms of natural persons and ensures that personal data is not processed without their knowledge and, where applicable, without their consent.
“Personal Data” means any information relating to an identified or identifiable natural person.
“Processing” means any operation performed on personal data such as collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, restriction, erasure or destruction.
“Controller” means the entity which determines the purposes and means of the processing of personal data.
“Data Subject” means any living natural person whose personal data is processed.
“Consent” means any freely given, specific, informed and unambiguous indication of the data subject’s wishes.
“Third Party” means any person or entity other than the data subject, the controller or the processor.
3. Purposes of Processing
Personal data is processed for:
- provision of marketing services, brand communication, graphic design and visual identity;
- planning and management of events and brand experiences;
- conclusion and performance of contracts and orders;
- processing enquiries;
- marketing communications where consent has been given;
- issuing accounting documents;
- website maintenance and security;
- compliance with legal obligations.
4. Principles
We process personal data in accordance with the following principles:
- lawfulness, fairness and transparency
- purpose limitation
- data minimisation
- accuracy
- storage limitation
- integrity and confidentiality
- accountability
5. Legal Basis for Processing
Personal data is processed on the following legal grounds:
- performance of a contract or steps prior to entering into a contract
- explicit consent
- compliance with a legal obligation
- legitimate interest (service improvement, defence of legal claims)
6. Categories of Personal Data
Depending on the service, the following data may be processed:
- names of individuals
- e-mail address and telephone number
- correspondence address
- company details (name, UIC, VAT number)
- content of enquiries, briefs, contracts and correspondence
- images and video materials from events (where applicable)
- technical data – IP address, cookies, access logs
7. Data Retention Period
We apply the principle of data minimisation and retain personal data only for the period necessary for:
- achieving the purposes of processing
- providing the services
- fulfilling contractual relationships
- complying with legal obligations
Retention periods:
- contract-related data – for the duration of the contract and statutory limitation periods
- accounting and tax documents – according to applicable legislation
- marketing data – until withdrawal of consent
- enquiry data – until completion of communication or up to 1 year from the last contact
- event images and videos – until the purpose is achieved or objection is raised
After the expiry of the relevant period, the data is securely deleted unless otherwise required by law.
8. Disclosure to Third Parties
Where necessary, personal data may be provided to:
- accounting and auditing service providers
- IT and hosting providers
- advertising and marketing platforms
- subcontractors and project partners
- courier and postal operators
- public authorities where legally required
All third parties process the data in compliance with GDPR and confidentiality requirements.
9. Rights of Data Subjects
You have the right to:
- be informed
- access your data
- rectification
- erasure (“right to be forgotten”)
- restriction of processing
- data portability
- object to processing
- withdraw consent at any time
- not be subject to automated decision-making
- lodge a complaint with the supervisory authority
Supervisory authority:
Commission for Personal Data Protection
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
e-mail: kzld@cpdp.bg
website: www.cpdp.bg
tel.: +359 2 915 3 518
If you have provided images or video materials, you may request their removal from the website or marketing materials, where feasible.
Requests for exercising rights shall be submitted to: office@storyline.bg
10. Security Measures
The Controller applies appropriate technical and organisational measures, including access control, protection of information systems and staff training.
11. Cookies
A separate Cookie Policy is available on www.storyline.bg and forms an integral part of this Policy.
12. Amendments to the Policy
We reserve the right to update this Policy. The current version is published on the website.
In case of significant changes affecting clients with existing contractual relationships, they will be notified by e-mail.
13. Contact Details
Company: “Storyline” Ltd.
E-mail: office@storyline.bg
Telephone: +359 89 3968500
Address: 158 Geo Milev Str., Entrance A, Floor 1, Apartment 3, Sofia, Bulgaria
Last updated: 21.01.2026