Privacy policy
PRIVACY AND PERSONAL DATA PROTECTION POLICY
Last updated: 29.10.2026
Introduction
This Privacy Policy explains how [name of the nursery/company] collects, uses, stores and protects the personal data you provide through this website and its online inquiry form.
Personal data is processed in accordance with Regulation (EU) 2016/679 – the General Data Protection Regulation (GDPR) – and applicable Bulgarian law.
1. Data controller
The controller of your personal data is:
• Company name: Kiddix EOOD
• Company ID (EIK): BG204238912
• Registered address: Block 38, Entrance B, Floor 9, Apt. 36, Lagera, Sofia
• Website: https://rucheyche.bg/
• Contact email: csotirova@kiddix.eu
• Phone: +359 88 8241161
For questions about the processing and protection of your personal data, you can contact us at the email address above.
2. What personal data do we collect?
When you fill in and send the online inquiry form, we may process the following data, depending on the fields the form contains:
• the name of the parent or person making the inquiry;
• phone number;
• email address;
• information about your interest in enrolment at the nursery;
• preferred start date or age group, if the form asks for them;
• the content of the message you choose to send.
Depending on the website's technical setup, technical data needed for its operation and security may also be processed.
Please do not send your child's personal identification number (EGN), medical documents, diagnoses or other sensitive information through the general inquiry form when it is not needed for the initial inquiry.
3. What do we use personal data for?
Personal data is used to:
• respond to your inquiry;
• get back to you by phone or email;
• provide information about enrolment terms, organisation and availability;
• take steps at the parent's request before a possible contract is concluded;
• protect the website against misuse, where applicable.
Personal data is not used for unrelated purposes that are incompatible with the original purpose for which it was collected.
4. Legal basis for processing
Depending on the specific purpose, processing is based on the applicable legal basis under Article 6 GDPR, including:
• Article 6(1)(b) GDPR – where processing is necessary to take steps at the request of the data subject before entering into a contract;
• Article 6(1)(f) GDPR – where processing is necessary for the legitimate interests of the controller, for example to respond to a general inquiry, provided those interests are not overridden by the rights and freedoms of the data subject.
Where a specific activity requires consent, it is obtained separately, freely and on an informed basis. Consent to marketing messages, if any are sent, is not a condition for sending an ordinary inquiry.
5. How long we keep personal data
We keep personal data only for as long as necessary to achieve the purposes for which it was collected, in line with the principle of storage limitation.
• Inquiries that do not lead to a contract: up to [a set period, e.g. 6 months] after communication ends, unless there is a specific legal basis for keeping them longer.
• Data related to a signed contract: for the periods needed to fulfil contractual obligations and applicable legal requirements.
• Data that the law requires us to keep: for the relevant statutory period.
• Technical logs: for a period appropriate to security needs and the actual settings of the systems used.
Once the applicable period has expired, the data is deleted or anonymised, unless there is another legal basis for keeping it.
6. Who has access to personal data?
Only authorised persons have access to personal data, where this is necessary to handle the inquiry and perform their duties.
Depending on the services used, the data may be accessible to providers of hosting, technical support, email or inquiry management systems, where they are involved in processing it.
Personal data may be disclosed to competent public authorities where required by law.
Where an external provider processes data on behalf of the controller, the necessary contractual and organisational measures are applied to protect the information.
Personal data is never sold to third parties.
7. Transfers of personal data outside the European Economic Area
If the services used involve transferring personal data to a country outside the European Economic Area, this is done only in compliance with the GDPR and subject to appropriate safeguards.
Specific information about such transfers depends on the providers and services actually used.
8. Your rights
Under the GDPR, and subject to the applicable legal conditions, you have the right:
• to access your personal data;
• to request correction of inaccurate or incomplete data;
• to request erasure of your data;
• to request restriction of processing;
• to object to processing based on legitimate interest;
• to data portability, where this right applies;
• to withdraw your consent, where processing is based on consent;
• to lodge a complaint with the competent supervisory authority.
To exercise your rights, you can contact the controller at [contact email].
In some cases we may need to confirm your identity to prevent unauthorised disclosure of personal data.
9. Right to lodge a complaint
If you believe your personal data is being processed in breach of applicable law, you have the right to lodge a complaint with:
Commission for Personal Data Protection (CPDP)
Website: https://www.cpdp.bg/
Current contact details and the procedure for filing complaints are available on the Commission's official website.
10. Protection of personal data
We apply appropriate technical and organisational measures to protect personal data against loss, unauthorised access, unlawful disclosure, alteration or other unlawful processing.
Access to the data is limited to the persons who need it to carry out their duties.
11. Cookies
The website may use strictly necessary cookies and other technologies, depending on its features.
If analytics, advertising or other non-essential cookies are used, information about them and how to manage your preferences will be provided separately, in line with the site's actual configuration and the applicable rules.
12. Changes to this policy
This policy may be updated if the law, the website's features or the way personal data is processed change.
The current version is published on this page together with the date of the last update.