This statement describes the practices regarding the collection and dissemination of information for the website: https://www.keystudios.bg/ (hereinafter referred to as “the Site”).

“Key Studios” Ltd., UIC: 208083886, with its registered office and address of management: Sofia, 1142, Sredets District, Center Residential Complex, 13 Patriarch Evtimii Blvd. 13 Patriarch Evtimii Blvd. (hereinafter referred to as the “Company” or “Key Studios”), processes your personal data in accordance with the requirements of the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Personal Data Protection Act.

This Privacy Policy pertains to Key Studios’ activities related to the rental of photo and video studios, podcast rooms, professional equipment, as well as a floor/house for events and productions, and related services—online reservations, customer communication, marketing, and collaboration with external partners (photographers, videographers, etc.).

In order to comply with regulatory requirements, Key Studios provides information in this Privacy Policy regarding your rights, the types of personal data collected, the legal basis for processing such data, how it is stored and used, and the circumstances under which it is disclosed to third parties.

According to Article 4 of the GDPR, “personal data” means any information relating to an identified natural person or a natural person who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, etc.

Key Studios guarantees that the processing of personal data (name, address, phone number, email, etc.) will always comply with the GDPR and applicable Bulgarian data protection laws.

1. Collection and Use of Personal Data

Key Studios collects and processes your personal data in connection with:

• използване на уебсайта https://www.keystudios.bg/;
• online reservations for studios, podcast rooms, equipment, and spaces;
• providing access to the studio and fulfilling requested services;
• communication regarding reservations, inquiries, and contractual relations;
• sending a newsletter, offers, and promotions (subject to your consent);
• marketing activities and conducting promotional games or campaigns (if any);
• concluding and performing contracts with clients, partners, and suppliers.

Processing is carried out on the basis of Art. 6 and, where applicable, Art. 9 of the GDPR, namely:

• explicitly obtained consent from your side;
• performance of a contract or taking steps at your request prior to entering into a contract;
• compliance with a legal obligation applicable to Key Studios;
• legitimate interest of the Company or a third party (e.g., security, property protection, prevention of abuse).

Key Studios does not collect personal data beyond what is necessary for its operations or what you have voluntarily and freely provided with your consent.

2. Personal data we process

2.1. Personally identifiable information

We may collect personal information, including:

• full name (or first and last name);
• email address;
• phone number;
• legal entity data (if you are a corporate client) – name, UIC, correspondence address;
• billing address;
• information related to your social media profiles/pages (where applicable and voluntarily provided);
• other information related to reservations and requested services.

This data is collected during:

• online reservation of a studio, podcast room, equipment, or space;
• registration/request for information via a contact form;
• subscription to a newsletter or marketing messages;
• participation in promotional campaigns or games (if organized).

2.2. Data for marketing activities

For marketing purposes (newsletter, promotions, events), we collect:

• name;
• email address;
• phone number (where applicable);
• other data provided by you in connection with a specific marketing campaign about which you were previously informed.

Personal data is collected on the basis of explicitly given consent (Art. 6, para. 1, point (a) of the GDPR).
Consent is expressed by:

• entering data into the form;
• checking a field/checkbox “I agree to my personal data being used to receive a newsletter and I am familiar with the Privacy Policy.”

2.3. Technical information

Every time you open the website at https://www.keystudios.bg/, we receive information in the form of logs, including:

• your IP address and the page/link from which you were referred to our site;
• information about your stay on our website and the sections you visit;
• information about the browser and operating system;
• other technical data, according to the requirements of the information system.

Personal data is collected on the basis of consent to the use of cookies and similar technologies, expressed through the relevant banner/button on the site (“I agree”, “Accept”, etc.), in accordance with GDPR and ePrivacy requirements.

3. Personal data we do not process

Key Studios does not collect or process the following categories of special personal data, unless there is explicit consent:

• data revealing racial or ethnic origin;
• data related to health or mental state;
• data revealing political, religious, or philosophical beliefs;
• membership in trade unions or other organizations;
• genetic and biometric data;
• data regarding sexual orientation.

If such data is shared by users through the Site or during reservations, it will not be processed unless there is explicit consent and a legal basis.

4. Grounds and purposes for processing personal data

The provided personal data is processed:

• to provide you with access to Key Studios’ services;
• to perform and manage your reservations and payments;
• to communicate with you by email or phone regarding your requests;
• to fulfill legal obligations (accounting, archiving);
• for marketing purposes – only with your explicit consent;
• to protect the legitimate interests of the Company – protection against claims, abuse, and ensuring security.

Key Studios does not engage in automated decision-making, including profiling, that would produce legal effects for you without your knowledge. Data will not be used for marketing unless you have given explicit consent.

Personal data will not be provided to third parties, except in the following cases:

• when provided for by law or regulation;
• when required by a competent state/judicial authority;
• when you have given explicit consent;
• when necessary for the performance of a contract or service (e.g., to a payment operator, hosting provider, etc.).

5. Retention period of the provided data

Key Studios stores your data in accordance with legally required periods and no longer than necessary:

• data related to reservations and contractual relations – up to 5 years after the termination of the relationship;
• data in financial documents – at least 10 years (according to the Accounting Act);
• data processed based on marketing consent – until the withdrawal of consent;
• technical logs – for the technically necessary period, but no longer than 1 year, unless otherwise required by law.

Upon expiration of the grounds for processing, your personal data is deleted or anonymized within a reasonable period.

6. Technical and organizational security

Key Studios has implemented technical and organizational measures to protect your personal data in accordance with the GDPR, including:

• protection of the Site via HTTPS/SSL;
• limited access to personal data only for authorized persons;
• protection of servers and information systems;
• backup and archiving procedures;
• confidentiality agreements with employees and suppliers.

The goal is to protect data from loss, alteration, unauthorized access, or disclosure.

7. Sharing and disclosure of personal data to third parties

In certain cases, Key Studios may disclose your personal data to:

• hosting, server, and cloud service providers;
• payment operators (virtual POS, online payments);
• external accountants, auditors, lawyers;
• marketing and advertising service providers (e.g., platforms like Google, Meta/Facebook) that have publicly declared compliance with the GDPR;
• external partners (photographers, videographers) when necessary for the performance of the service.

In these cases, Key Studios takes the necessary actions to ensure lawful data processing by entering into data processing agreements and verifying partners’ compliance with the GDPR.

8. Your rights as a data subject

Under the GDPR, you have the following rights:

8.1. Right of access
You have the right to obtain confirmation as to whether we are processing your personal data and to access it.

8.2. Right to rectification
You may request the correction of inaccurate or incomplete personal data.

8.3. Right to restriction of processing
Under certain conditions (dispute regarding accuracy, grounds for processing, etc.), you may request restriction.

8.4. Right to erasure (‘right to be forgotten’)
You may request the deletion of your personal data when the grounds for processing no longer exist and there is no other legal basis.

8.5. Right to data portability
You may request to receive your data in a structured, commonly used, and machine-readable format and/or have it transferred to another controller when the processing is based on consent or a contract and is carried out by automated means.

8.6. Right to object
You may object to the processing of your data based on legitimate interest, including profiling.

8.7. Right to withdraw consent
When processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

8.8. Right to lodge a complaint
If you believe we are violating your rights, you may lodge a complaint with:
Commission for Personal Data Protection (CPDP) – Sofia, 2 Prof. Tsvetan Lazarov Blvd.

To exercise your rights, you can write to us at:
???? info@keystudios.bg