Privacy Policy

What to include in the Privacy Policy

# ArtSoulutions Privacy Policy

**Publication draft — complete the bracketed fields and confirm the operational statements before publication. Remove this drafting note and the publisher notes at the end from the public policy.**

**Effective date:** [DATE OF PUBLICATION] 
**Last updated:** [DATE OF LAST UPDATE]

## 1. Who we are

ArtSoulutions is a creative studio providing photography, video production, visual storytelling, drone filming and AI-assisted creative services.

For the processing described in this Privacy Policy, the data controller is:

**Legal name:** ArtSoulutions Ltd. 
**Trading name:** ArtSoulutions 
**Privacy contact email:** yordanov@artsoulutions.com
**Website:** https://www.artsoulutions.com/

References to “ArtSoulutions”, “we”, “us” and “our” mean the controller identified above.

We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation or “GDPR”) and applicable Bulgarian data protection legislation.

## 2. Scope of this policy

This policy explains how we handle personal data when you visit our website, complete a contact form, respond to our advertisements, submit a Facebook or Instagram Instant Form, interact with our social media pages, or communicate with us about a project or service.

Where a project involves filming, photography, interviews or the processing of client-supplied materials, additional project-specific privacy information may apply. This policy does not itself authorise the recording, publication or promotional use of anyone’s image, voice or other personal data.

Where we process personal data solely on a client’s documented instructions as its processor, the client’s privacy information and our data processing agreement govern that processing. We remain responsible for processing for which we determine the purposes and means ourselves.

## 3. Personal data we collect and its sources

Depending on your interaction with us, we may process:

- **Identity and contact details:** first and last name, email address, telephone number and, where relevant, company name, professional role and business contact details.
- **Enquiry and project information:** the service requested, project or event date, location, budget information if supplied, availability, preferences and the contents of your messages and correspondence.
- **Client administration information:** quotation and booking records, contractual details, billing information, payment status and records needed to administer a client relationship.
- **Social media information:** your profile name, information visible to us when you interact with our page, comments, messages and information submitted through a lead form.
- **Technical information:** IP address, browser and device information, access times, visited pages and security logs, to the extent collected by the website and its configured services.
- **Preference records:** consent choices, their date and source, withdrawals, objections and communication preferences.

Most enquiry information comes directly from you. When you submit a Meta lead form, Meta makes the submitted information available to us; some fields may have been prefilled from your account, and you should review them before submission. We may also receive relevant contact or project information from the organisation or person arranging a project involving you. Technical information may be collected automatically through our website infrastructure and permitted technologies.

Please do not include identity document numbers, payment card details, medical information or other sensitive personal information in general contact or lead forms. Where sensitive information is necessary for a particular project, we will address the applicable conditions and safeguards separately before processing it.

## 4. Purposes and legal bases

We use personal data only for specified purposes and on an applicable legal basis:

**Responding to enquiries and preparing quotations.** Where you are considering a contract with us, we process information necessary to take steps at your request before entering into that contract, under Article 6(1)(b) GDPR. Where you contact us on behalf of a business or for a general enquiry, we rely on Article 6(1)(f), namely our legitimate interest in responding to relevant communications and managing business relationships.

**Administering agreed services.** We process information necessary to perform our contract with you under Article 6(1)(b). When communicating with a client’s employees or representatives, we rely on our legitimate interest in organising and delivering the engagement under Article 6(1)(f).

**Accounting and legal compliance.** We process records necessary to meet applicable accounting, tax and other statutory obligations under Article 6(1)(c).

**Security and legal claims.** We process necessary information to protect our website and communications against misuse, maintain appropriate records, and establish, exercise or defend legal claims under Article 6(1)(f). The interests pursued are the security of our operations and the protection of our legal rights, assessed against your rights and reasonable expectations.

**Optional promotional communications.** Where we offer subscriptions to promotional emails, we rely on your separate consent under Article 6(1)(a). You may withdraw that consent at any time. An enquiry or request for a quotation does not automatically subscribe you to promotional messages.

**Optional website analytics and advertising technologies.** Where enabled and requiring consent, these operate only on the basis of your prior consent under Article 6(1)(a) and applicable rules on access to information on your device. The technologies actually in use must be described in the cookie information referred to in Section 7.

Where we rely on legitimate interests, you may object on grounds relating to your particular situation. We will assess the objection in accordance with the GDPR. You may object to direct marketing at any time, and we will stop processing your data for that purpose.

## 5. Facebook and Instagram lead forms

If you submit an Instant Form in response to an ArtSoulutions advertisement, we use the information submitted to handle the request described in that advertisement or form. This may include discussing your requirements, checking availability, preparing a quotation and following up on that specific enquiry through the contact channels identified in the form.

The applicable legal basis is the relevant basis for enquiries in Section 4. We do not treat submission of a lead form as blanket consent to unrelated advertising, disclosure to other advertisers or every form of future contact.

Any optional subscription to promotional communications must be presented separately, identify the relevant communication channel and allow a genuine choice. Declining it does not prevent you from requesting a quotation.

Meta also processes information for its own platform purposes. This policy describes our handling of your information and does not replace Meta’s privacy information, available at https://www.facebook.com/privacy/policy/.

## 6. Social media pages and Page Insights

When you contact us or interact with our social media pages, we process the information visible to us to answer messages, manage interactions and understand interest in our services. Our legitimate interests are maintaining our business presence and responding to relevant communications. Public comments may be visible to other platform users.

Facebook Page Insights provides aggregated statistics about activity on our page. For personal data processed to produce Page Insights, ArtSoulutions and Meta Platforms Ireland Limited act as joint controllers to the extent described in Meta’s Page Insights Controller Addendum. Meta takes primary responsibility for the GDPR obligations allocated to it under that arrangement, including providing information about its processing and handling relevant rights requests. You may nevertheless exercise your rights against either controller.

The arrangement and further information are available at https://www.facebook.com/legal/terms/page_controller_addendum. Meta’s platform processing, including its own advertising and profiling activities, is explained in its privacy policy. Our access to aggregate statistics does not give us access to every underlying personal data record held by Meta.

## 7. Website hosting and cookies

Our website is hosted using Wix. Wix processes visitor information to provide hosting, infrastructure, security and website functionality. Information about Wix’s processing is available at https://www.wix.com/about/privacy.

Strictly necessary cookies and similar technologies support functions such as security and the operation of the website. Optional analytics, advertising technologies and third-party embedded content that require consent must remain inactive until you make the relevant choice.

**Current cookie and tracking details:** [INSERT A LINK TO THE COMPLETED COOKIE NOTICE OR COOKIE SETTINGS PANEL IDENTIFYING THE TECHNOLOGIES ACTUALLY USED, THEIR PROVIDERS, PURPOSES AND DURATIONS. STATE HOW VISITORS CAN REOPEN THEIR SETTINGS.]

You may reject optional technologies or subsequently withdraw consent through the cookie controls identified above. Withdrawal does not affect the lawfulness of earlier processing. Browser settings may also allow you to remove or block cookies, although blocking necessary cookies may affect website functionality.

Links to external websites are governed by those websites’ own privacy information. Embedded services may receive information when activated; relevant consent controls must be applied where required.

## 8. Who may receive your information

We disclose personal data only where necessary for a stated purpose and on an appropriate legal basis. Depending on the service involved, recipients may include:

- Wix and providers of website hosting, technical support and security services;
- providers of email, business communication, secure storage and enquiry management services used to administer your request;
- professional advisers, including accountants and legal advisers, where their involvement is necessary;
- project collaborators or delivery providers where necessary for an agreed service and explained in the relevant project information;
- public authorities, courts or other recipients where disclosure is legally required or necessary to establish, exercise or defend legal claims.

Service providers acting as processors must process information under appropriate contractual terms and instructions. Other recipients may act as independent controllers for their own legally defined purposes. Meta’s role is described in Sections 5 and 6.

We do not sell enquiry or lead-form personal data. We do not provide that information to other businesses for their independent direct marketing.

## 9. International transfers

Use of international service providers, including Wix and Meta, may involve processing outside the European Economic Area, including in Israel and the United States, depending on the provider and service concerned.

Where we transfer personal data to a country outside the EEA, we ensure that an applicable transfer mechanism is in place. This may be a European Commission adequacy decision covering the recipient and processing, or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, with supplementary measures where required.

You may contact us for information about the mechanism applicable to a particular transfer and to request a copy of relevant safeguards, subject to necessary redactions protecting confidential information and the rights of others. Additional provider information is available in the privacy notices linked above.

## 10. How long we keep personal data

We keep personal data for no longer than needed for the relevant purpose, taking account of the relationship, applicable legal duties and any properly justified need to retain evidence.

- **Enquiries and leads that do not become clients:** [CONFIRM RETENTION PERIOD] after the last substantive communication, unless you request continued discussions or a specific legal need requires longer retention.
- **Client administration and contract records:** for the duration of the engagement and subsequently for applicable statutory retention periods and relevant limitation periods for legal claims. Different record types may have different requirements.
- **Promotional contact records:** until you withdraw consent or the record is removed under our periodic review of inactive subscriptions. We may retain limited evidence of consent and a minimal suppression record where necessary to demonstrate compliance and respect your preferences.
- **Technical records and cookies:** for the periods documented for the relevant service or in the cookie information in Section 7, according to their security or functional purpose.
- **Project footage, photographs and deliverables:** under the retention arrangements communicated for the particular project; keeping such materials is not automatically authorised by submitting an enquiry.

Records relevant to an actual dispute or legal obligation may be retained for as long as necessary for that specific purpose, with access restricted appropriately. When retention is no longer justified, we delete or irreversibly anonymise the information. Copies in backups are removed through the applicable backup rotation and remain protected pending deletion.

## 11. Your rights

Subject to the conditions and limitations in applicable law, you may request access to your personal data, correction of inaccurate or incomplete data, erasure, restriction of processing, and portability of qualifying data processed by automated means on the basis of consent or contract.

You may object to processing based on legitimate interests on grounds relating to your particular situation. Your right to object to direct marketing, including related profiling, is unconditional.

Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw promotional consent, use an unsubscribe mechanism provided in the message or contact our privacy email. To change optional cookie choices, use the controls described in Section 7.

Send requests to **[PRIVACY CONTACT EMAIL]**. We may request proportionate additional information where reasonably necessary to confirm your identity. We normally respond within one month of receiving a request. Where permitted because of its complexity or the number of requests, this may be extended by up to two further months; we will notify you within the initial month and explain why.

Requests are ordinarily handled free of charge. Where a request is manifestly unfounded or excessive, the GDPR permits a reasonable fee or refusal, subject to the applicable conditions and explanation.

## 12. Complaints

You may lodge a complaint with a competent supervisory authority, particularly in the EU Member State of your habitual residence, place of work or the alleged infringement. You do not have to contact us first.

In Bulgaria, the supervisory authority is the **Commission for Personal Data Protection**:

Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria 
Website: https://cpdp.bg/en/ 
Contact and complaint procedures: https://cpdp.bg/en/contacts/ and https://cpdp.bg/en/lodging-complaints-and-alerts/

## 13. Security

We implement technical and organisational measures appropriate to the nature of the information and the risks of processing, including access restrictions and protection of the systems used to handle enquiries and client information. No online system can guarantee absolute security. Where a personal data breach occurs, we assess and fulfil applicable notification obligations.

## 14. Children and project participants

Our enquiry forms and lead advertisements are intended for adults arranging services. They are not intended to collect personal data directly from children.

Where a commission involves children, we address the relevant privacy information, lawful basis, permissions and safeguards with the responsible client and, where required, the parent or person holding parental responsibility. An adult’s booking does not by itself constitute permission for every use of a child’s image. Contact us if you believe a child has submitted personal information through our enquiry channels inappropriately.

## 15. Automated decisions and provision of information

We do not make decisions about enquiries solely by automated processing that produce legal or similarly significant effects. AI-assisted creative production, if agreed for a project, is a separate matter: any personal data involved requires an appropriate assessment, information and safeguards before use. This policy does not grant permission to upload identifiable client materials into any AI service.

Submitting an enquiry is voluntary. Fields marked as required are needed to identify and respond to your request. If you do not provide them, we may be unable to respond or prepare a quotation. Optional information and optional marketing consent are not conditions for submitting an enquiry. Information required for a subsequent contract or by law will be identified at the relevant stage.

## 16. Changes to this policy

We may update this policy to reflect changes in our services, processing or applicable requirements. The revised version will show an updated date. Where a change requires additional information or fresh consent, we will provide that information or obtain that consent before the relevant processing begins. Continued use of the website does not itself constitute consent to new processing.

---

# Publisher notes and lead form wording

**These notes are not part of the public privacy policy.**

This is a tailored drafting document, not a certification of compliance or a substitute for review of your actual operations by a qualified Bulgarian lawyer. A privacy policy must describe what you actually do. The website’s public pages were reviewed; private Wix settings, cookies, Meta integrations, storage providers and retention practices were not audited.

Before publication:

1. Identify the actual legal controller. ArtSoulutions is a trading name; insert either the individual operating the business or the legal entity responsible. Complete the correspondence address, monitored email and dates. Replace every bracketed field.
2. Set an enquiry retention period you can actually enforce. A proposed starting point is 12 months after the last substantive communication, subject to confirmation that this is necessary and proportionate for your sales cycle. This is a proposed operational choice, not a statutory GDPR period. Confirm statutory record retention with your accountant or lawyer.
3. Check the Wix cookie and integration settings. Complete Section 7 with the real cookie inventory, providers, purposes and durations. Confirm that rejecting optional cookies prevents relevant trackers and embeds from loading. Do not state that Meta Pixel, Conversions API, Google Analytics or customer-list audiences are used unless confirmed. If any are used, add the specific data flows, purpose, basis, recipients, transfer details and applicable controller arrangements before launch; this draft alone does not fully disclose them.
4. Confirm the recipient categories, transfer arrangements, security, deletion and no-sale statements. Identify the actual providers in your internal records and expand the public notice if needed for transparency. Remove processing that does not occur. Confirm the non-automated-decision statement.
5. Use separate project information for footage, images, voices, children, AI services and portfolio publication. Do not use this policy as a blanket model release or authorisation to publish client work. Projects revealing sensitive information, including religious beliefs, need a separate assessment.
6. Publish the policy as an accessible page on the existing website, for example at https://www.artsoulutions.com/privacy-policy. This is a proposed address; this document has not created or published that page. Link to the final working page from the website footer, enquiry form and Meta Instant Forms. Use link text **ArtSoulutions Privacy Policy**.
7. For Bulgarian-language ads and forms, provide corresponding Bulgarian privacy information so people can readily understand it. Keep both versions consistent.

## Short notice for a lead form

“ArtSoulutions, operated by [LEGAL CONTROLLER NAME], will use the information you submit to respond to your enquiry, discuss your requirements and provide a quotation. We may contact you by email or telephone about this request. Submitting this form does not subscribe you to promotional emails. Please read our Privacy Policy for information about how we use your data and how to exercise your rights.”

Link **Privacy Policy** to the published page. Retain only the contact channels you actually use and collect.

## Optional marketing consent

Use this only if you intend to send promotional emails and have a working consent and unsubscribe process. Keep it separate, optional and unticked:

“I would like to receive occasional promotional emails from ArtSoulutions about its services, offers and creative projects. I can withdraw my consent at any time using the unsubscribe link or by contacting [PRIVACY CONTACT EMAIL].”

Do not require this checkbox to obtain a quotation. If you want promotional contact through another channel, describe that channel expressly and obtain any separate consent required.

## Reference materials

Reviewed on 23 September 2026. These references support the drafting framework and do not establish that the business has implemented the described practices.

- GDPR official text: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
- Meta Lead Ad Terms: https://www.facebook.com/legal/leadgen/tos
- Meta Page Insights Controller Addendum: https://www.facebook.com/legal/terms/page_controller_addendum
- Meta Privacy Policy: https://www.facebook.com/privacy/policy/
- Wix Privacy Policy: https://www.wix.com/about/privacy
- Wix sub-processors: https://support.wix.com/en/article/list-of-wixs-sub-processors
- Bulgarian Commission for Personal Data Protection: https://cpdp.bg/en/

Meta legal pages required login during direct retrieval; the publicly indexed material and official links were used, and the applicable account-visible terms should be checked before launch.