Privacy Policy

Last update: 25 April 2026.

1. Personal Data Controller

The data controller is Digital New Era Ltd, UIC 207276590, with registered office and registered address. Sofia (1680), Krasno Selo district, gk. Borovo Str. 47 Solun Str. B, et. 1, app. 3A. For contact in matters related to personal data protection: contact@studionewera.com.

2. What data we collect

2.1. Data provided directly by you

Identification data - names, name of legal entity, UIC/EIN
Contact details - email address, phone number, postal address
Business information - information about the activity, brand and needs of your business
Communication data - content of messages, requests and correspondence

2.2. Data collected automatically

Technical data - IP address, browser type and version, operating system, device, time zone, language settings
Data for use - pages visited, duration of sessions, reference URLs
Data from cookies - see Cookie Policy

2.3. Payment details

Payment information (card number, CVV, expiration date) is processed entirely by Stripe, Inc. The company does not receive or store complete payment card data. We only receive confirmation of successful/failed payment and the last four digits of the card for reference purposes.

3. Purposes and legal basis for processing

Objective	Legal basis (Article 6 GDPR)
Provision of the Services, account management, payment processing	Contract performance (b. "b")
Service improvement, technical support, analytics	Legitimate interest (point "f")
Compliance with tax, accounting and regulatory obligations	Legal obligation (point "c")
Marketing messages, analytics and advertising cookies	Consent (b. "a")

4. Storage periods

Data category	Deadline
Customer data on contracts	5 years after termination of contract
Accounting and tax documents	10 years
Analytical data	Up to 26 months
Communication data	Up to 3 years
Marketing data	Until withdrawal of consent

5. Sharing with third parties

We can share data with:

Stripe, Inc. - payment processing (Stripe is PCI DSS Level 1 certified)
Google LLC - Google Analytics, Google Ads (when using cookies with your consent)
Meta Platforms, Inc. - Facebook/Instagram Pixel (when used with your consent)
Hosting providers - for the technical infrastructure of the Services
Postal/marketing services - for sending correspondence
Accounting and legal consultants - if necessary
State authorities - under a legal obligation

6. International data transfers

Some of these third parties (e.g. Stripe, Google, Meta) may process data in the US or other third countries. Transfers are based on: Standard Contractual Clauses (SCC) approved by the European Commission; EU-US Data Privacy Framework, where applicable; Other appropriate safeguards under Article 46 of the GDPR.

7. Your rights (GDPR)

Under the GDPR, you have the following rights:

Right of access (Article 15)
Right to rectification (Article 16)
Right to erasure / "right to be forgotten" (Art. 17)
Right to restriction of processing (Article 18)
Right to data portability (Article 20)
Right to object (Art. 21)
Right not to be subject to an automated decision (Article 22)
Right to withdraw consent

To exercise your rights: contact@studionewera.com. We will reply within 30 days.

You have the right to file a complaint with the Personal Data Protection Commission (PDPC): www.cpdp.bg, bul. "Proff. Tsvetan Lazarov" № 2, gr. Sofia 1592.

8. Additional CCPA Rights (California Residents)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA)/California Privacy Rights Act (CPRA): the right to know what personal information we collect; the right to erasure; the right to refuse the sale of personal information - We do not sell personal information; the right to nondiscrimination. To exercise: contact@studionewera.com.

9. Data security

We implement appropriate technical and organisational measures to protect data, including: SSL/TLS encryption; firewalls and intrusion detection systems; restricted data access; regular backups; team training. Despite the measures taken, no security system is absolutely foolproof.

10. Children

The Company's services are not directed to persons under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data of a person under the age of 18, we will delete it immediately.