PRIVACY POLICY

Sugarev Com EOOD — Audio Post-Production, Sound Design & Video Production

Effective date: 18 June 2026 Last updated: 18 June 2026

1. Introduction

This Privacy Policy explains how Sugarev Com EOOD (Сугарев Ком ЕООД) (the “Company”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data when you visit sugarev.com (the “Website”), request a quote, or engage our services.

We are committed to handling personal data in accordance with the EU General Data Protection Regulation (GDPR), the Bulgarian Personal Data Protection Act, and other applicable privacy laws.

2. Who we are (Data Controller)

For personal data we process for our own purposes, the data controller is:

  • Controller: Sugarev Com EOOD (Сугарев Ком ЕООД)

  • UIC (ЕИК): 208720016

  • VAT ID: BG208720016

  • Registered office: Business Park, 473A, ent. A, unit 1, 1715 Sofia, Bulgaria

  • Email: [email protected]

  • Website: sugarev.com

For privacy questions or to exercise your rights, contact us at [email protected].

3. Scope and our dual role

This Policy covers Website visitors and our clients and their representatives.

  • As controller, we decide how and why we process personal data such as your contact and billing details and your communications with us.

  • As processor, where the files you send us for a project (Client Materials) contain personal data — for example, voices in a recording or individuals appearing in footage — we process that data on your behalf and on your instructions to deliver the service. In that case you are the controller, you are responsible for the lawful basis and any required notices or consents, and our processing is governed by our Terms and, where required, a data processing agreement under Article 28 GDPR. This Policy describes our role as controller; Section 8 addresses our role as processor.

4. Personal data we collect

Information you provide - Identity and contact details (name, email address, company name, phone number where provided) - Billing and tax details (billing address, VAT number, payment references) - Project information and instructions - Client Materials, which may contain personal data (such as voices, images, or names) within the files you submit - The content of your messages and communications with us

Payment information Payments are handled by third-party payment processors — Stripe and PayPal. We do not store full payment card numbers. Depending on the method, the processor may collect billing address, card or account information, transaction details, and fraud-prevention data, governed by their own privacy policies.

Information collected automatically We have deliberately kept our Website lightweight and privacy-respecting. We do not use advertising, ad-targeting, or cross-site tracking technologies; we do not build marketing profiles of visitors; and we do not sell or share data with advertisers. Our hosting and security providers (Squarespace and Cloudflare) do process limited technical data — such as IP addresses and basic browser or device information in server logs — to keep the Website running and secure and to protect against abuse. This is standard infrastructure data, processed on our behalf for security and operation; it is not used to track you across the web or for advertising. See Section 9 for cookies.

5. How and why we use personal data, and our legal bases

  • Provide our services — Discussing, scheduling, performing, and delivering projects; communicating about your project; support (Performance of a contract (Art. 6(1)(b)))

  • Quotes and enquiries — Responding to quote requests and messages (Steps prior to a contract / legitimate interests (Art. 6(1)(b)/(f)))

  • Payments — Processing payments and managing chargebacks (Contract / legitimate interests (Art. 6(1)(b)/(f)))

  • Invoicing, accounting, tax — Issuing invoices; keeping accounting and tax records (Legal obligation (Art. 6(1)(c)))

  • Website operation and security — Hosting, maintaining, securing the Website; preventing fraud and abuse (Legitimate interests (Art. 6(1)(f)))

  • Limited analytics — Understanding overall Website performance in aggregate — never for advertising or cross-site tracking (Legitimate interests (Art. 6(1)(f)))

  • Portfolio and marketing — Showcasing completed work after public release, subject to our Terms (Legitimate interests (Art. 6(1)(f)) or consent (Art. 6(1)(a)))

  • Legal claims — Establishing, exercising, or defending legal claims (Legitimate interests (Art. 6(1)(f)))

Where we rely on legitimate interests, we have balanced those interests against your rights. Where we rely on consent, you may withdraw it at any time without affecting prior processing.

We do not sell, rent, or share personal data with advertisers; we do not use it for advertising, ad targeting, or cross-site tracking; and we do not carry out automated decision-making that produces legal or similarly significant effects.

6. Sharing and recipients

We share personal data only as necessary, with:

  • Payment processors — Stripe, PayPal

  • Website hosting and infrastructure — Squarespace

  • Content delivery, DNS, and security — Cloudflare

  • Email and productivity services — Apple (iCloud Mail)

  • Secure file transfer — Infomaniak (SwissTransfer)

  • Accounting and tax advisers

  • Subcontractors and collaborators engaged on a project, bound by confidentiality

  • Authorities, advisers, or successors where required by law, to enforce our terms, or in connection with a business reorganisation

Each provider processes personal data only as needed to provide its service to us, under its own terms. This list of categories of recipients may change as our providers change.

7. International transfers

Some of our providers (including Stripe, PayPal, Squarespace, and Cloudflare) may process personal data outside the European Economic Area (EEA), including in the United States. Where this happens, the transfer is protected by an appropriate safeguard recognised under the GDPR, such as an adequacy decision, certification under the EU–US Data Privacy Framework, and/or Standard Contractual Clauses, together with supplementary measures where appropriate. You may request more information about the safeguards in place.

8. Client Materials (our role as processor)

Where Client Materials you send us contain personal data, we process that data on your behalf, only on your documented instructions and as needed to perform the service, and we do not use it for our own purposes. We keep it confidential, apply robust security (Section 11), and retain, return, or delete it in line with your instructions, our Terms, and any agreed retention period. As controller of that data, you remain responsible for ensuring a lawful basis and for any notices or consents required from the individuals concerned.

9. Cookies and similar technologies

No advertising or tracking — and no annoying banner. We have chosen not to run advertising, marketing, or cross-site tracking cookies on our Website, and we do not use cookies to profile you or to sell or share your data. Because the Website relies only on cookies that are strictly necessary for it to function and stay secure, you are not made to click through an intrusive cookie-consent prompt just to use it.

  • Strictly necessary cookies — required for core functionality and security. Under EU rules these do not require consent.

  • Payment cookies — if you make a payment, our processors (Stripe, PayPal) may set their own cookies as part of completing and securing the transaction, governed by their privacy policies.

We do not use non-essential analytics, advertising, or social-media tracking cookies. You can still control or delete cookies through your browser settings, although disabling strictly necessary cookies may affect how the Website works.

10. Data retention

We keep personal data only as long as necessary for the purposes for which it was collected, including:

  • Project and contract data — for the duration of the engagement and for the period during which legal claims may arise (generally up to the applicable limitation period under Bulgarian law).

  • Accounting and tax records — for the periods required by Bulgarian law; under the Bulgarian Accountancy Act, accounting registers and financial statements are generally retained for 10 years, with other documents retained for the periods prescribed by law.

  • Client Materials and completed projects — we keep secure backups indefinitely as a convenience, unless you ask us to delete or return them or a separate agreement requires otherwise; where Client Materials contain personal data, we act on your instructions as described in Section 8. You remain the custodian of your final masters and should keep your own copies (see our Terms).

  • Enquiry and marketing data — for as long as needed for the relevant purpose or until you object or withdraw consent.

When data is no longer needed, we delete or anonymise it securely.

11. Data security

We protect personal data — and especially confidential client content — with layered technical and organisational measures, including encryption of data in transit and at rest, secure and access-controlled file transfer, strict least-privilege access, segregated and controlled storage, secure regularly maintained backups, confidentiality obligations on any collaborators, and the security standards of our payment processors. We maintain internal data-handling, retention, and confidentiality practices designed to prevent unauthorised access, disclosure, or leakage. While no method of transmission or storage anywhere can be guaranteed entirely immune from risk, we treat your material as if it were our own, and in the unlikely event of a breach we will act promptly to contain it and will notify you and any relevant authority as required by law.

12. Your rights

Subject to applicable law, you have the right to:

  • access the personal data we hold about you;

  • request rectification of inaccurate or incomplete data;

  • request erasure (“right to be forgotten”);

  • request restriction of processing;

  • object to processing based on legitimate interests or to direct marketing;

  • receive your data in a portable format (data portability); and

  • withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email [email protected]. We will respond within the time required by the GDPR (generally one month, extendable for complex requests). We may need to verify your identity. Exercising these rights is free in most cases.

Complaints. If you believe we have not handled your personal data properly, we would appreciate the chance to resolve it first. You also have the right to lodge a complaint with the Bulgarian supervisory authority:

Commission for Personal Data Protection (Комисия за защита на личните данни – КЗЛД)Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria Website: www.cpdp.bg · Email: [email protected] · Phone: +359 2 915 3518

If you are located in another EEA country, you may also complain to your local data protection authority.

13. Children

Our Website and services are intended for individuals aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

14. Third-party links

The Website may contain links to third-party sites (for example, social media). We are not responsible for the privacy practices of those sites, and we encourage you to review their privacy policies.

15. Changes to this Policy

We may update this Privacy Policy from time to time. The current version is always available on the Website, with the “Last updated” date shown above. Material changes will be indicated by updating that date, and where appropriate we will provide additional notice.

16. Contact

For any question about this Privacy Policy or your personal data:

Sugarev Com EOOD (Сугарев Ком ЕООД) Business Park, 473A, ent. A, unit 1, 1715 Sofia, Bulgaria Email: [email protected] · Website: sugarev.com

We will respond within the timeframe required by GDPR.

|