Mandatory information on data subjects' rights under data protection law
General information
Since 25 May 2018, Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR) has been in force across the European Union. It aims to protect natural persons' data and harmonise rules for its processing.
DevInfi meets GDPR requirements and collects personal data only to the extent necessary to operate devinfi.com, respond to inquiries, and — only with your explicit consent — provide anonymous traffic statistics. We do not sell personal data, show ads, or run remarketing.
1. Data controller
The data controller within the meaning of GDPR is:
- Company: Devinfi OOD, company ID (EIK) 208828839 (trading as DevInfi)
- Registered address: Burgas 8000, Slaveykov district, bl. 71, entr. 7, fl. 1, apt. 1, Bulgaria
- Email: devinfi@devinfi.com
- Phone: +31 6 42721190, +359 886 754 934
Current identification details (company ID, legal form, VAT status, etc.) are published on the Company details page.
For independent studios like ours, GDPR does not require appointing a Data Protection Officer (DPO). Data-related questions are handled directly by the co-founders of DevInfi.
2. Supervisory authority
- Name: Commission for Personal Data Protection (CPDP / KZLD)
- Address: 2 "Prof. Tsvetan Lazarov" Blvd., 1592 Sofia, Bulgaria
- Correspondence: 2 "Prof. Tsvetan Lazarov" Blvd., 1592 Sofia, Bulgaria
- Phone: +359 2 915 35 18
- Email: kzld@cpdp.bg
- Website: www.cpdp.bg
3. Legal basis for collecting and processing personal data
(1) DevInfi collects and processes personal data to respond to inquiries submitted via the contact form or email, and for the technical operation and security of the site. Google Analytics processing takes place only after explicit consent via the cookie banner.
(2) DevInfi follows these GDPR principles:
- lawfulness, fairness, and transparency;
- purpose limitation;
- data minimisation;
- accuracy and storage limitation.
3.1. Types of data we collect
When you submit the contact form:
- name;
- email address;
- project type (optional);
- approximate budget (optional);
- message / project description;
- submission timestamp.
Depending on the backend service used (see section 5), your IP address and browser user-agent may also be recorded for spam protection.
When you browse without submitting the form:
- Country from your IP address (first visit): our host (Firebase Hosting) reads only the two-letter country code from your IP address, so we can show the site in Bulgarian in Bulgaria and in English everywhere else. It isn't stored or sent to any third party.
- Server access logs: the hosting provider may record IP, time, URL, and status for security and abuse prevention.
Purpose of collection: responding to inquiries, preparing quotes for our services, site operation and security, and — with consent — anonymous traffic statistics.
(3) DevInfi does not collect or process special-category personal data revealing:
- racial or ethnic origin;
- political, religious, or philosophical beliefs, or trade union membership;
- genetic or biometric data, health data, or data concerning sex life or sexual orientation.
(4) Legal bases under GDPR Art. 6:
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Form data | Reply to inquiry; prepare quote | Art. 6(1)(a) — consent; Art. 6(1)(b) — pre-contract steps |
| Browser language | Site language choice | Art. 6(1)(f) — legitimate interest |
| Geo IP (one-time) | Site language choice | Art. 6(1)(f) — legitimate interest |
| Google Analytics 4 | Anonymous statistics | Art. 6(1)(a) — consent |
| Server logs | Security, abuse prevention | Art. 6(1)(f) — legitimate interest |
4. Retention period
- Form data (active correspondence): for the duration of the conversation + 12 months afterward.
- Form data (became clients): for the duration of the contract + 5 years after termination (tax/accounting requirements under Bulgarian law).
- Server logs: typically 30–90 days (depends on hosting provider).
- Country code: kept only in your browser until you close the tab (
sessionStorage).
5. Recipients and third parties
We aim to use as few external services as possible. Currently:
- Firebase Hosting (Google Cloud) — hosts the site, static files, and standard server logs. The site is served through Google's global network. See Firebase Privacy & Security and Google Privacy Policy.
- Fonts — Inter, JetBrains Mono, and Caveat are self-hosted on devinfi.com under
/assets/fonts/. No requests to Google Fonts. - Formspree — receives contact form submissions and forwards to
devinfi@devinfi.com. See their policy. - Google Analytics 4 (consent only) — anonymous statistics. Does not load without an explicit "Accept" click on the cookie banner. IPs are anonymised. See Google's policy.
We do not use Facebook Pixel, Hotjar, Mixpanel, or other remarketing / heat-map services. Google Analytics loads only with consent; otherwise gtag.js is never loaded.
6. Transfers outside the EU
Some listed services (Firebase / Google Cloud, Formspree) are US-based or globally distributed. Transfers are made under Standard Contractual Clauses (SCC) and/or the EU-US Data Privacy Framework.
7. Cookies and local storage
To run the site and personalise your visits, we sometimes store small data files called "cookies" and values in your browser's local storage. This is standard practice on most websites. None of the cookies or stored values we use can identify a specific person on their own. Blocking some cookies may affect how the site works.
7.1. Functional (no additional consent)
The following values are "strictly necessary" under GDPR and ePrivacy rules and do not require separate consent. They are stored in your browser's local storage:
- remembering your preferred language (Bulgarian or English);
- remembering that you closed the launch-offer banner;
- remembering your cookie banner choice (valid 12 months).
Technical identifiers: devinfi-lang, devinfi-offer-dismissed, devinfi-consent, devinfi-geo.
7.2. Analytics (consent only)
Analytics cookies are never set without an explicit "Accept" choice on the banner. We use Google Analytics 4 for anonymous traffic statistics; IP addresses are anonymised. Retention: up to 24 months. Until you confirm your choice, Google's consent mode remains in a denied state.
We do not use advertising cookies or ad-tracking services.
Changing your choice: you may change or withdraw consent by clearing stored data for devinfi.com in your browser settings or by emailing devinfi@devinfi.com.
8. Your rights regarding collection, processing, and storage
Under GDPR (Regulation (EU) 2016/679) you have the following rights:
Withdrawal of consent
If you do not wish all or part of your personal data to continue being processed by DevInfi for a specific or all processing purposes, you may withdraw consent at any time by free-text request to devinfi@devinfi.com.
Right of access
You have the right to obtain confirmation from DevInfi as to whether personal data concerning you is being processed, and a copy of that data.
Right to rectification
You may request correction or completion of inaccurate or incomplete personal data concerning you.
Right to erasure
You have the right to request erasure of personal data concerning you, and DevInfi must erase it without undue delay unless there is a legal basis to retain it.
Right to restriction
You have the right to request restriction of processing of data concerning you.
Right to data portability
You may request that DevInfi transmit your personal data directly to another controller where technically feasible.
Right to object
You may object at any time to processing of your personal data by DevInfi on grounds of legitimate interest (Art. 21).
Automated decision-making and profiling
We do not perform automated decision-making or profiling within the meaning of Art. 22. No decision on inquiries or quotes is made automatically.
Complaint to a supervisory authority
You have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP) — see section 2. If you reside elsewhere in the EU, you may also lodge a complaint with the supervisory authority in your country.
To exercise any right: devinfi@devinfi.com. We reply within 30 calendar days (usually within 24 hours). This service is free except where requests are manifestly unfounded or excessive (Art. 12(5)).
9. Security
The site is served over HTTPS. The contact form transmits data encrypted. Only the founder and any team members have access to inquiry emails, protected by two-factor authentication.
10. Changes to this policy
We may update this policy when services, legislation, or technical infrastructure change. The "last updated" date at the top always reflects the current version.
11. Contact
For anything regarding personal data — email devinfi@devinfi.com with subject "GDPR" or "privacy".
This policy is governed by Bulgarian and European Union law. If it conflicts with a newer regulation, the newer one prevails.