Privacy policy

Effective from 23 October 2026.

This policy explains what personal data we collect through sofiachristmasfest.bg, why we collect it, who we share it with and what rights you have. It follows Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act.

1. Who processes your data

The data controller is BSG Media EOOD („БИ ЕС ДЖИ МЕДИА“ ЕООД), the organiser of Sofia Christmas Fest, 31 Angel Kanchev St., Sofia, Bulgaria.

For questions about your personal data: office@bsgmedia.bg, phone +359 888 32 68 98.

2. What we collect and why

Visiting the site

When you browse the site, the servers of our provider Netlify record technical data: IP address, browser and device type, the page visited and the time. We use it to keep the site running and secure. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

Account and sign-in

When you sign in through the “Sign in” or “Participant sign-in” pages with Google, Facebook or email, we receive your name, email address, profile picture (if the provider shares it) and a unique identifier. If you register as a participant, we also store the type of participation you chose. We use this data to provide your account and, for participants, access to the management panel. Legal basis: performance of a contract (Art. 6(1)(b)).

Participation applications

The “Take part” form collects: brand name, description and concept, links to your website and social media, company details (name, UIC, VAT number, registered address, manager), contact person, phone and email. We use them to review your application and contact you. Legal basis: your consent given in the form, and steps taken before entering into a contract (Art. 6(1)(a) and (b)).

Visit statistics

If we use Google Analytics, it loads only after you accept cookies in the site's banner. It collects aggregated information about visits (pages, device, approximate location) with an anonymised IP address. Legal basis: your consent (Art. 6(1)(a)). You can withdraw it at any time as described in the Cookie policy.

Correspondence

When you write to us by email or on social media, we process the data you send us in order to reply.

3. Who we share data with

We do not sell personal data. We share it only with providers that help us run the site and process the data on our behalf:

• Netlify, Inc.: the site's server infrastructure and emailing applications to our team;
• Okta, Inc. (Auth0): account sign-in, including with Google and Facebook;
• Google Ireland Ltd.: Google Analytics, only with your consent;
• the site's database and the company that maintains the site under contract with us.

Some of these providers are in the United States. Transfers there rely on the EU–US Data Privacy Framework or on standard contractual clauses approved by the European Commission.

We may disclose data to public authorities where the law requires it.

4. How long we keep data

• server technical logs: up to 30 days;
• accounts: until you ask us to delete yours, or 2 years without a sign-in;
• applications that do not lead to a contract: up to 2 years after the end of the edition you applied for;
• data under signed contracts: as long as accounting and tax law requires (up to 10 years);
• Google Analytics data: up to 14 months.

5. Your rights

You have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, and to object to processing based on legitimate interest. Where we rely on consent, you can withdraw it at any time; this does not affect processing carried out before.

To exercise your rights, write to office@bsgmedia.bg. We will reply within one month.

You can lodge a complaint with the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg.

6. Children

Accounts and the participation form are not intended for people under 16.

7. Other websites

Tickets are sold by Eventim, and the site links to Facebook, Instagram and YouTube. These companies process your data under their own policies.

8. Changes

We may update this policy. The current version is always published on this page with the date it takes effect.