Privacy policy

1. Controller and contact

The data controller is Dzmitry Arlou, organiser of the AI · VARNA community (Varna, Bulgaria).

For data questions and to exercise your rights: the data request form (same controller, school website), a private message to the admin of the t.me/ai_varna group, or a DM to @ai.varna. No account is needed.

2. What data we receive

From the sign-up form: your name, how to reach you (Telegram, WhatsApp, phone or email — your choice), the interests you pick, an optional comment, the consent tick, the date and time of the request and the page language.

Technical data: Cloudflare processes your IP address and browser information to deliver the page and protect the site. To protect the form from spam, the site keeps an anonymised HMAC fingerprint of your IP address in the Cloudflare cache for one hour; the IP itself is not added to your request.

Please don’t send documents, health data or information about other people.

3. Purposes and legal bases

To tell you the meetup time and place and answer your question — based on your consent, Art. 6(1)(a) GDPR. Consent is voluntary and you can withdraw it at any time through the same channel; withdrawal does not affect processing carried out before it.

Protecting the form and site from spam and abuse — the controller’s legitimate interest, Art. 6(1)(f) GDPR.

Answering requests about your rights — a legal obligation, Art. 6(1)(c) GDPR.

No advertising, newsletters, profiling or automated decisions.

4. Recipients and transfers outside the EU

Cloudflare, Inc. — site hosting and the server function that receives your request (Cloudflare privacy policy). The request is not stored on the site; it is passed straight to Google.

Google (Google Forms) — storage of requests in a private form in the controller’s account (Google privacy policy).

Cloudflare and Google may process data outside the EEA, including in the USA. Transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, in which both companies participate (DPF list), and on standard contractual clauses.

We don’t sell data or share it for advertising. Only the controller sees the requests.

5. Retention

A request is deleted no later than 90 days after the meetup it relates to or after our last contact with you, whichever is later — or sooner if you ask.

The IP fingerprint used for spam protection is kept for one hour. Retention of Cloudflare and Google technical logs is set by their policies.

6. Your rights

You can ask for access to your data, rectification, erasure, restriction of processing and data portability, object to processing based on legitimate interest, and withdraw your consent.

We reply without undue delay, normally within one month. To confirm the data is yours, we may ask you to write from the contact given in your request.

You may lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP, cpdp.bg) or with the supervisory authority of the country where you live or work.

7. Children

If you are under 14, a parent or legal guardian should submit the request (Art. 25c of the Bulgarian Personal Data Protection Act).

8. Cookies and browser storage

The site uses no cookies, analytics, advertising pixels or third-party fonts, so no cookie banner is needed.

Browser storage (localStorage) keeps only the site language you chose, under the key ai-varna-lang. It is needed for the site to work as you asked; you can delete it in your browser settings.

Reel videos load from this site. Links to Instagram, Telegram and Google Maps open external sites with their own policies.