Privacy policy
Last updated: 2026-08-18
Who processes the data
Data is processed by Marina Koval, photographer, Sofia, Bulgaria. Questions about your data: marina@marinakoval.com.
NOTE: business registration in Bulgaria is in progress. The trading name and company number will be added here once it completes.
What I collect
- From the enquiry form: your name, contact method (email, phone, Instagram or Viber), preferred language, type of session, desired date, location and your message.
- Technical data: IP address and submission time — solely to defend against automated spam.
- Analytics cookie data — only if you consented.
Legal basis
- Answering your enquiry — steps taken at your request prior to entering a contract (Art. 6(1)(b) GDPR).
- Spam protection — legitimate interest (Art. 6(1)(f)).
- Analytics and marketing cookies — your consent alone (Art. 6(1)(a)), withdrawable at any time.
How the data reaches me
The enquiry is sent from the site to the hosting server, written to a protected file outside the public web root, and forwarded as a Telegram notification which I receive. The data is not published anywhere and is not shared with third parties for marketing.
How long I keep it
- Enquiries that did not lead to a session — 12 months.
- Client records and contracts — 5 years (accounting requirements).
- Online photo galleries — 12 months after delivery.
Who else sees the data
- The hosting provider — stores the site and submitted forms.
- Telegram — new-enquiry notifications.
Photographs as personal data
The photographs themselves are personal data. I use them in my portfolio, on this site or on social media only with your separate written consent, which you can withdraw. Declining to have your photos published does not change the price — discounting in exchange for image rights is common on this market and I deliberately do not do it.
Your rights
For any of these, write to marina@marinakoval.com.
- Access to the data I hold about you.
- Rectification of inaccurate data.
- Erasure (the "right to be forgotten").
- Restriction of, and objection to, processing.
- Data portability.
- Withdrawal of consent at any time — without affecting the lawfulness of processing before withdrawal.
- A complaint to the Commission for Personal Data Protection (CPDP), Sofia.