Privacy Policy

How we collect, use, and protect your personal data

Effective date: 21 April 2026  Â·  Last updated: 21 April 2026

1. Who We Are

Bulgarian 56 Peaks ("we", "us", "our") is a nonprofit organisation based in Bulgaria. We operate the website bulgarian56peaks.org and are the data controller for all personal information collected through it.

If you have any questions about this policy or how we handle your data, please contact us at hello@bulgarian56peaks.org.

2. What Data We Collect

We only collect personal data that you voluntarily provide to us. Currently, the only way we collect personal data is through our contact form, which asks for:

  • Your name — so we know who we are speaking with
  • Your email address — so we can reply to you
  • A subject line — to help us route your message
  • Your message — the content of your enquiry

We do not collect payment information, location data, or any special category data (health, religion, ethnicity, etc.). We do not use tracking pixels, advertising networks, or behavioural analytics.

3. How We Use Your Data

We use the information you submit through the contact form solely to:

  • Read and respond to your message or enquiry
  • Follow up if your request requires further communication
  • Maintain an internal record of correspondence for organisational purposes

We will never use your data for unsolicited marketing, sell it to third parties, or share it with anyone outside our organisation except where legally required.

4. Legal Basis for Processing (GDPR)

As Bulgarian 56 Peaks operates within the European Union, we process your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR).

The legal bases we rely on are:

  • Legitimate interests (Article 6(1)(f)) — responding to your contact form submission is a legitimate interest of our organisation, and it is the reason you submitted the form.
  • Consent (Article 6(1)(a)) — by voluntarily submitting the contact form you consent to us processing your data to reply to you. You may withdraw this consent at any time by contacting us.

5. How Long We Keep Your Data

We retain contact form submissions for a maximum of 24 months from the date of receipt, after which they are securely deleted. If your enquiry results in an ongoing relationship (e.g. a donation, partnership, or volunteering), we may retain relevant correspondence for as long as that relationship is active, plus a further 24 months.

You may request deletion of your data at any time — see Section 7.

6. Cookies

This website uses no tracking cookies, advertising cookies, or analytics cookies. The only cookie we set is a short-lived PHP session cookie used exclusively to generate a CSRF (Cross-Site Request Forgery) security token when you submit the contact form. This cookie:

  • Contains no personal information
  • Is deleted automatically when you close your browser
  • Is required for the security of form submissions and cannot be disabled without breaking the form

If we introduce analytics or other cookies in the future we will update this policy and display a cookie consent banner before setting any non-essential cookies.

7. Your Rights Under GDPR

As a data subject in the EU/EEA, you have the following rights. To exercise any of them, email us at hello@bulgarian56peaks.org with the subject line "Data Request".

  • Right of access — request a copy of the personal data we hold about you
  • Right to rectification — ask us to correct inaccurate or incomplete data
  • Right to erasure ("right to be forgotten") — ask us to delete your personal data
  • Right to restriction — ask us to stop actively processing your data while still retaining it
  • Right to data portability — request your data in a structured, machine-readable format
  • Right to object — object to processing based on our legitimate interests
  • Right to withdraw consent — withdraw consent at any time without affecting the lawfulness of prior processing

We will respond to all requests within 30 days. In complex cases we may extend this by a further two months, and will notify you if we do.

8. Third-Party Services

This website loads the following third-party resources. None of them receive your personal data:

  • Lucide Icons (unpkg.com) — a CDN-hosted icon library. Your browser fetches icon assets from unpkg.com. This is a static file request with no personal data transmitted beyond a standard HTTP request (IP address, browser type).
  • GSAP (cdnjs.cloudflare.com) — an animation library loaded on the homepage only, served by Cloudflare's CDN under the same conditions as above.
  • Hostinger (hosting provider) — our website is hosted on Hostinger servers. Hostinger may process server access logs (IP addresses, request timestamps) as part of standard server operation. See Hostinger's privacy policy for details.

We do not embed social media tracking scripts, advertising pixels, or any other third-party analytics.

9. Data Security

We take reasonable technical and organisational measures to protect your personal data. This includes:

  • HTTPS encryption for all data in transit (enforced site-wide)
  • CSRF token protection on all form submissions
  • Input sanitisation and validation on our contact form backend
  • Restricted access to correspondence records

No method of transmission over the internet is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

10. Children's Privacy

This website is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has submitted data to us, please contact us at hello@bulgarian56peaks.org and we will delete it promptly.

11. Right to Lodge a Complaint

If you believe we have not handled your personal data in compliance with GDPR, you have the right to lodge a complaint with the relevant supervisory authority. In Bulgaria, this is the Commission for Personal Data Protection (CPDP):

  • Website: www.cpdp.bg
  • Address: 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, Bulgaria
  • Email: kzld@cpdp.bg

We would, however, appreciate the opportunity to resolve any concern directly before you approach the authority — please contact us first at hello@bulgarian56peaks.org.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. We encourage you to review this page periodically. Continued use of this website after changes are posted constitutes acceptance of the updated policy.

13. Contact

For any questions, requests, or concerns regarding this Privacy Policy or your personal data, please reach out: