Privacy policy
What we collect, why, who sees it and how long we keep it. Written to be read, not to be scrolled past.
Last updated:
1. Who we are
This website is run by Inverted Digital Ltd., a creative studio based in Sofia, Bulgaria ("Inverted Digital", "we"). Company details: Inverted Digital Ltd., UIC 206353756, registered office: 8 Stracin Str., Floor 2, Apt. 6, Veliko Tarnovo, Bulgaria.
For anything in this policy, write to hello@inverted.digital. We have not appointed a data protection officer because the law does not require one for a studio of our size and kind of processing; privacy requests are handled by the studio's management.
2. What this policy covers: controller and processor
We hold personal data in two different roles, and the rules differ for each.
- As a controller we decide why and how data is used. This covers visitors to inverted.digital, people who send us an enquiry, and the contact people at our clients and suppliers. Sections 3 to 5 and 10 to 14 apply.
- As a processor we handle data on behalf of a client and only on that client's instructions. This covers the websites, social media accounts, mailing lists and event guest lists we manage for clients. The client is the controller, and the client's own privacy notice applies to you. Sections 6 and 7 explain this.
3. What we collect and the legal basis for each use
| Use | Data | Legal basis (GDPR) |
|---|---|---|
| Replying to an enquiry or consultation request | Name, email, and anything else you choose to send: company, phone, service of interest, message | Your consent, given with the checkbox on the form (Art. 6(1)(a)); steps taken at your request before a contract (Art. 6(1)(b)) |
| Running a client project | Contact details of the people we work with, project correspondence, files you give us | Performance of a contract (Art. 6(1)(b)) |
| Invoicing and accounting | Billing name and address, company identifiers, payment records | Legal obligation (Art. 6(1)(c)) |
| Measuring how the website is used | Pages viewed, approximate location from a shortened IP address, device and browser type | Your consent, given in the cookie notice (Art. 6(1)(a)) |
| Protecting the contact form from abuse | A one-way hash of your IP address and the time of each attempt | Legitimate interest in keeping the form usable (Art. 6(1)(f)) |
| Showing past work in our portfolio | Names of client organisations and, where agreed, of individuals | Legitimate interest, or consent where an individual is named (Art. 6(1)(f) or (a)) |
We do not buy contact lists, we do not build advertising profiles, and we do not sell personal data.
4. Contact and consultation forms
The forms on this site ask for your name, email address and a message. Company, phone number and service of interest are optional. You must tick a consent box before sending; we record the exact wording you agreed to and the time, together with your message, so we can show what you consented to.
The form also contains a hidden field that people never see and bots usually fill in. Submissions with that field completed are discarded. The form limits how many messages one connection can send per hour.
Your message is delivered to our studio inbox by email and a copy is kept in a private log on our web server that is not reachable from the internet.
5. Analytics and cookies
We use Google Analytics 4, loaded through Google Tag Manager, to understand which pages are useful. It is switched off until you say yes: neither script is downloaded at all before you accept. If you decline, or simply ignore the notice, nothing is loaded and no analytics cookies are set.
When analytics is on, IP anonymisation is enabled, Google Signals is disabled, and advertising storage, advertising user data and ad personalisation remain denied. We do not use analytics data for advertising. Details, cookie names and the switch to change your mind are in our cookie policy.
6. Client work: when we act as a processor
When we build or maintain a website, manage social media accounts, send email campaigns or run an event for a client, we may handle personal data that belongs to that client's customers, followers, subscribers or guests.
In those cases the client decides what is collected and why. We act only on the client's documented instructions, under a data processing agreement, keep the data confidential, apply appropriate security, help the client respond to requests from individuals, and delete or return the data when the work ends.
If you want to exercise your rights over data held on a site or account we manage for a client, contact that client. If you write to us instead, we will pass your request to them.
7. Registration and event forms: who is responsible
We often build sign-up, registration and RSVP forms: for a client's website, for a webinar, or for an event we are organising on a client's behalf.
- Forms on inverted.digital (the contact and consultation forms): we are the controller and this policy applies.
- Forms we build or operate for a client, including event registration and guest lists: the client is the controller. The client is responsible for the lawful basis, the wording of the form and its privacy notice, and for answering requests. We are the processor and use the data only to deliver the service, such as sending confirmations, printing badges or checking guests in.
- Events we host in our own name: we are the controller, and the registration page will say so.
Guest and attendee data collected for a client's event is handed to the client or deleted after the event, as the client instructs.
8. What our team can see
Enquiries arrive in a shared studio inbox that only people working at Inverted Digital can open. Client project data is visible only to the people assigned to that project.
Analytics reports show us aggregated figures such as page views, countries and device types. They do not show names or email addresses, and we cannot see what an identifiable person did on the site. Nobody at the studio can see your full IP address in analytics.
Everyone who works with us, employee or freelancer, is bound by a confidentiality obligation.
9. AI processing
We use AI tools in parts of our work: drafting and editing text, research, code assistance, and generating or editing images and video.
- We do not make decisions about people by automated means, and no AI system decides whether or how we respond to you.
- We do not put enquiry details, guest lists or other personal data into AI tools unless that is necessary for the task, and for client data only where the client has agreed.
- Where we use AI tools with personal data, we use business versions under terms that prohibit the provider from training its models on that data.
- AI-assisted work is reviewed by a person before it is delivered or published.
10. Who we share data with
We share personal data only with providers that help us run the studio, each under a contract that limits what they may do with it:
- our web hosting and email provider, which stores this website, its logs and our mailboxes;
- Google Ireland Limited, for Google Analytics, only if you accept analytics;
- our accountants, for invoices and payment records;
- project tools such as file storage and task management, for client project material.
We disclose data to public authorities only where the law requires it.
11. International transfers
We keep data in the European Economic Area where we can. Some providers, Google in particular, may process data in the United States or other countries. Those transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses. You can ask us for a copy of the relevant safeguards.
12. How long we keep data
| Data | Kept for |
|---|---|
| Enquiries that do not become a project | Up to 24 months after our last contact with you, then deleted |
| Contact form log on the web server (message, consent wording, time) | 12 months, then removed automatically |
| Rate-limit records (hashed IP address and timestamps) | 24 hours |
| Client project correspondence and files | For the project and up to 5 years afterwards, unless the contract says otherwise |
| Invoices and accounting records | As long as Bulgarian accounting and tax law requires, currently up to 10 years |
| Analytics data | 2 months in Google Analytics; the analytics cookies themselves last up to 2 years unless you withdraw consent |
| Data we process for clients | As the client instructs; returned or deleted when the work ends |
13. Security
The site is served only over HTTPS with HSTS, a strict content security policy that blocks scripts we did not write, and no third-party code before consent. Form input is validated on the server, private folders are not reachable from the web, and access to our systems is limited to the people who need it and protected by two-factor authentication where available.
No system is perfectly secure. If we become aware of a personal data breach that puts you at risk, we will tell you and the supervisory authority as the law requires.
Reporting a vulnerability. If you have found a security problem on this site, write to hello@inverted.digital with the details and give us reasonable time to fix it before making it public. We will not pursue anyone who reports a problem in good faith without accessing other people's data or disrupting the service.
14. Your rights
Under the GDPR you have the right to:
- be informed about how your data is used, which is the purpose of this page;
- access the personal data we hold about you and receive a copy;
- rectification of data that is inaccurate or incomplete;
- erasure of your data where we have no lawful reason to keep it;
- restriction of processing while a question about accuracy or lawfulness is resolved;
- data portability: to receive data you gave us in a commonly used, machine-readable format;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- withdraw consent at any time, without affecting what was done before you withdrew it;
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects. We make no such decisions.
To use any of these rights, email hello@inverted.digital. We reply within one month and do not charge for reasonable requests. We may ask for information to confirm who you are.
You also have the right to lodge a complaint with a supervisory authority. In Bulgaria this is the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg. You may instead complain to the authority in the EU country where you live or work.
15. Changes to this policy and contact
We update this policy when what we do changes. The date at the top shows the latest version; for significant changes we will add a notice on the site. Earlier versions are available on request.
Questions: hello@inverted.digital.