Privacy Policy

1. Who processes your data

The data controller is the Bulgarian Association of Milk Processors (BAM) — a non-profit association with its registered seat at Izgrev St. № 46, Sliven 8805, Bulgaria.

For any question about this policy, or to exercise your rights, write to [email protected] or use our contact form.

2. What data we collect, why and for how long

We only process the data you provide to us through this website, plus the minimum technical data required for its security.

Activity	Data	Legal basis	Retention
Contact form	Name, company, email, phone, subject and message text; where the subject is “Membership application”, also any document you choose to attach	Art. 6(1)(f) GDPR — our legitimate interest in answering an enquiry addressed to us	The message and any attached document are emailed to the Association and are not stored on the website — the file never enters the media library and is never reachable at a URL. The correspondence is kept for up to 12 months after the communication ends.
Newsletter subscription (including notifications about new articles on the site)	Email address; date, time and IP address of the confirmation; the exact wording of the consent	Art. 6(1)(a) GDPR — your consent. The confirmation details are kept in order to demonstrate that consent, as required by Art. 7(1).	Until you withdraw your consent. Unconfirmed requests are deleted automatically after 30 days.
Member area (including email notifications about new announcements and articles)	Username, email address, site role, technical sign-in data	Art. 6(1)(b) GDPR — performance of the membership relationship	For the duration of the membership and up to 12 months after it ends.
Web analytics (Google Analytics 4)	Truncated IP address, device and browser type, approximate city-level location, pages visited, visit duration, a random identifier stored in a cookie	Art. 6(1)(a) GDPR — your consent, given through the cookie bar. Without consent the tag stores no cookies and collects no data.	14 months in Google Analytics; the _ga cookies — 2 years or until consent is withdrawn
Server logs	IP address, date and time of the request, requested address, browser type	Art. 6(1)(f) GDPR — our legitimate interest in the security and stability of the website	Up to 12 months.

Providing your data is voluntary. Without it, however, we cannot answer your enquiry, send you the newsletter, or give you access to the Member area.

3. Automated decision-making and profiling

We do not use your personal data for automated decision-making or for profiling.

4. Who else has access to the data

Access is limited to authorised representatives of the Association and to the following providers, which act as processors under a contract with us and may not use the data for their own purposes:

• Cloudflare, Inc. — delivers and protects the website through its global network: every request to the site passes through it, together with your IP address and the technical details of the request. Cloudflare further provides DNS, the protection of the forms against automated traffic (Turnstile), and the routing of incoming mail sent to an address on the domain.
• Mailgun Technologies, Inc. — sends the site’s outgoing mail: contact-form messages, newsletter confirmations and notifications, and the invitations and access emails for the member area. The recipient’s address, the content of the message and the technical details of its delivery pass through the service. The Association uses Mailgun’s European region, so message content is processed and stored in the EU.
• Google Ireland Limited — for the Google Analytics service, and only if you have consented to analytics cookies.

We do not sell or share personal data with third parties for marketing purposes. The contents of the forms and the member-area data are stored on the website’s server within the European Union.

Cloudflare and Mailgun are companies established in the United States, while Google Ireland Limited is a company in the European Union belonging to a group established in the United States. Mailgun serves the Association from its European region, so message content is processed and remains in the EU. Where a transfer outside the EU/EEA nonetheless occurs — for example when a request passes through Cloudflare’s global network — it takes place under the appropriate safeguards of Chapter V of the GDPR: the EU–US Data Privacy Framework and standard contractual clauses. All three companies act as processors under a contract with the Association.

5. Cookies and web analytics

This website uses strictly necessary cookies, plus Google Analytics analytics cookies which are only stored after you consent. A choice bar is shown on your first visit; you can change or withdraw your choice at any time through the “Cookie settings” link at the bottom of every page. The full list and the Google Analytics details are on the Cookies page.

6. Your rights

As a data subject you have the right:

• to access the personal data we process about you (Art. 15 GDPR);
• to have inaccurate or incomplete data corrected (Art. 16);
• to erasure — the “right to be forgotten” (Art. 17);
• to request restriction of processing (Art. 18);
• to data portability to another controller (Art. 20);
• to object to processing based on legitimate interest (Art. 21);
• to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3)).

Unsubscribing from the newsletter is possible at any time through the “Unsubscribe” link at the bottom of every email we send. The unsubscription takes effect immediately and the email address is deleted from the list. If you no longer have such an email, enter your address here and we will send you an unsubscribe link:

Email address

Send unsubscribe link

To exercise your other rights, send a request to [email protected]. We reply free of charge within one month of receiving the request. For complex or numerous requests this period may be extended by a further two months, of which you will be informed.

7. Right to lodge a complaint

If you believe that we process your data unlawfully, you have the right to lodge a complaint with the supervisory authority:

Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
tel. +359 2 915 3518 · [email protected] · www.cpdp.bg

You also have the right to seek a judicial remedy.

8. Security

The website runs over an encrypted connection (HTTPS). Access to the administration and to the Member area is protected by individual usernames and passwords. We apply appropriate technical and organisational measures against unauthorised access, loss or disclosure of data.

9. Changes to this policy

If the way we process personal data changes, we will update this page. The current version is always available at this address.

Last updated: 24 септември 2026