1. Scope of this policy
This policy describes how personal data is processed when you use the public website of Kindergarten No. 10 "Karamfilche".
2. Data controller and contact details
The data controller is Kindergarten No. 10 "Karamfilche", 13 Karamfil Street, Varna 9010. You can contact us by phone on 052 303 170, at dg10karamfilche@abv.bg or at info-400257@edu.mon.bg.
Personal data requests are accepted through these verified channels and forwarded to the responsible person at the institution.
3. Technical data and security
The server and security tools may process standard request data: IP address, date and time, requested URL, user agent and response status. This data is used to provide and protect the website, diagnose issues and prevent misuse.
4. Contact form
The contact form collects your name, email address, subject and message. The message is emailed to the kindergarten, and the form does not create a record of its contents in the WordPress database.
Request validation, a hidden anti-spam field and a rate limiter are used to prevent misuse. The rate limiter uses an irreversible code calculated from the request address using a secure WordPress value; it does not store the raw IP address.
Do not send personal identification numbers (EGN), health information, medical documents, information about special educational needs or other sensitive personal data through the public form.
5. Photographs of children
Photographs in which children can be identified are published only once the purpose and applicable legal basis have been documented. When processing is based on consent, requests to withdraw consent or remove photographs may be submitted using the kindergarten's contact details.
6. Cookies, embedded services and external links
The public form does not store your message in a cookie. WordPress uses technically necessary cookies for authorised staff to sign in and work in the administration area.
The contact page embeds an OpenStreetMap map. When the map loads, the browser connects to OpenStreetMap servers and may transmit standard technical data such as IP address, date, time and user agent. The website does not load fonts from an external provider or public profile pictures from an external service.
7. Recipients
Data access may be granted only to authorised staff, hosting, maintenance and email providers, and competent authorities when applicable rules require it. Access is limited to what is necessary for the relevant purpose.
8. Retention periods
Data is retained in accordance with the approved document retention schedule and only for as long as necessary for its purpose. When an email becomes part of an official administrative file, the rules for that file apply to it.
9. Your rights
Subject to the applicable conditions, you may request access, correction, erasure or restriction of processing, object to processing, obtain data portability where applicable, and withdraw consent when processing is based on it. Submit your request through the verified contact channels above. To protect personal data, we may ask for sufficient information to confirm your identity and the scope of your request.
10. Complaint to the supervisory authority
You have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP): 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592, kzld@cpdp.bg, cpdp.bg.
11. Security and updates
We apply organisational and technical measures appropriate to the risk and restrict access to authorised persons. This policy is updated when the website or the way data is processed changes.
Version: 29 September 2026