Privacy Notice

Francisco Matilla Serrano, an independent professional established in Bulgaria, is the data controller for this website.

Registered business or service address: Campus 90, 90 Tsar Osvoboditel Boulevard, 9000 Varna, Bulgaria.

Contact email: franchimatilla@gmail.com.

When you submit the project inquiry form, this site collects the information you provide: name, email, and optionally company, role, website, LinkedIn profile, platform or technology, project type, current stage, budget range, timeline, preferred contact method, and your project summary.

For security purposes, the form also processes a one-way hashed value derived from your IP address and browser type. The raw IP address is never stored — only this irreversible hash, used solely to apply rate limiting and prevent abuse.

This Privacy Notice is governed by Regulation (EU) 2016/679 (the GDPR) and the Bulgarian Personal Data Protection Act, as applicable.

Where you contact us about possible services, we process the information necessary to respond to your inquiry and to take steps at your request before entering into a contract under Article 6(1)(b) GDPR.

General business correspondence and processing necessary to protect the website, prevent spam or abuse, maintain security and establish, exercise or defend legal claims may be based on our legitimate interests under Article 6(1)(f) GDPR, provided those interests are not overridden by your rights and freedoms.

Inquiry correspondence that does not result in a client engagement is retained for up to 24 months after the last meaningful contact. It may be deleted earlier where appropriate or following a valid erasure request. If an inquiry results in a client engagement, relevant records may be retained for the periods required by the applicable contract and by legal, tax, accounting, dispute-resolution or claims-related obligations.

This site uses the following processors to operate the contact form and hosting: Vercel (hosting), Resend (email delivery), Cloudflare Turnstile (bot and abuse protection), and Upstash (rate-limiting data store).

Some service providers used to host, protect and operate this website, including Vercel, Resend, Cloudflare and Upstash, may process personal data outside the European Economic Area, including in the United States. Where a transfer is subject to Chapter V of the GDPR, it is protected through an applicable adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses, as applicable to the provider and transfer. Further information about the relevant safeguards may be requested at franchimatilla@gmail.com.

This site is served over HTTPS. The contact form is protected by a bot-verification challenge, durable rate limiting, and server-side validation. No permanent database of form submissions is retained beyond what is needed to prevent duplicate or abusive submissions.

Subject to the conditions and limitations established by the GDPR, you may request access to, rectification or erasure of your personal data, restriction of processing or data portability, and you may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. To exercise a data-protection right, contact franchimatilla@gmail.com. We may request information necessary to verify your identity before completing a request.

You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), the competent supervisory authority in Bulgaria.

Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria. Website: https://cpdp.bg/en/