Home · Privacy policy

Privacy Policy

What data we collect through this website, why we collect it, who else sees it and how you can have it deleted.

WebStar Royco — a web design and website development agency based in Burgas, Bulgaria.
Email for data protection questions: [email protected]
Phone: +359 886 387 424
Our activity does not fall within the cases listed in Article 37(1) GDPR, so we are not required to appoint a Data Protection Officer.

Through the contact form: your name, phone number or email, your business or website, the service you selected, and the text of your message.
Through the booking form: your name, phone number and email, plus optionally your company and a short description of the project. We also record the topic, format, date and time you selected.
We do not collect behavioural data automatically. The site carries no analytics, advertising or tracking tools.
We do not collect special categories of data, and we never ask for national ID numbers or bank or payment details through the site.

To answer your enquiry and arrange the consultation — on the basis of your consent, Article 6(1)(a) of Regulation (EU) 2016/679 (GDPR).
If the consultation leads to a project — on the basis of steps taken at your request prior to entering into a contract, Article 6(1)(b).
We do not use your data for marketing messages unless you expressly ask us to.
We carry out no automated decision-making and no profiling within the meaning of Article 22 GDPR.

Web3Forms — the service that carries the completed form through to our inbox. Its servers are located in the USA. The transfer relies on standard contractual clauses adopted by the European Commission (Article 46(2) GDPR).
Cloudflare, Inc. — our hosting provider, on whose servers the website sits. On every visit Cloudflare processes your IP address and technical browser data in order to deliver the page and protect it from attacks, based on our legitimate interest in keeping the website available and secure (Art. 6(1)(f)). Transfers to the US rely on the EU–US Data Privacy Framework (European Commission decision of 10 July 2023), with standard contractual clauses as a fallback.
We do not sell, rent or trade your data. We do not pass it to third parties for their own marketing purposes.
We may disclose data to a public authority only where the law requires us to.

Enquiries and bookings that do not lead to a project — up to 30 days, after which they are deleted.
If we start working together — for the duration of the project and afterwards for as long as accounting and tax law requires for the relevant documents.
If you withdraw your consent sooner, we delete the data immediately, except where the law obliges us to retain it.

The site uses no advertising, analytics or tracking cookies. There is no Google Analytics and there are no social media pixels.
We store two preferences locally on your device: your chosen language and light or dark theme. They stay in your browser, are never sent to us, and disappear if you clear your browser data.
Because these preferences are strictly necessary for the site to work the way you chose, no consent is required for them. That is why there is no cookie banner.

Access (Art. 15) — to find out what data about you we hold.
Rectification (Art. 16) — to correct inaccurate or incomplete data.
Erasure (Art. 17) — the right to be forgotten.
Restriction of processing (Art. 18) and objection to it (Art. 21).
Portability (Art. 20) — to receive your data in a machine-readable format.
Withdrawal of consent at any time (Art. 7(3)). Withdrawal does not affect the lawfulness of processing carried out beforehand.
Right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (Art. 77) — cpdp.bg.
How: write to [email protected]. We reply within one month and free of charge (Art. 12(3) and (5)).

Last updated: October 2026. If we change the way we handle data, we will update this page and change the date.