# Privacy Policy | Studio New Era

> How Studio New Era collects, processes and protects your personal data under the GDPR.

Canonical URL: https://studionewera.com/en/privacy-policy/

## Privacy Policy

Privacy Policy
Last updated: 4 August 2026

This is an English translation provided for convenience. In case of any discrepancy, the Bulgarian version prevails.

### 1. Personal Data Controller

The controller of personal data is Digital New Era LTD (Диджитъл Ню Ера ЕООД), UIC (ЕИК) 207276590, with registered office and address of management: Sofia (1680), Krasno Selo district, Borovo residential complex, ul. Solun 47, entr. B, fl. 1, apt. 3A. For contact on matters related to personal data protection: contact@studionewera.com .

### 2. What Data We Collect

#### 2.1. Data Provided Directly by You

Identification data — names, name of legal entity, UIC/Personal Identification Number (ЕИК/ЕГН)

Contact data — email address, telephone number, postal address

Business information — information about the activity, brand and needs of Your business, including descriptions and materials provided for building or AI generation of content

Communication data — content of messages, requests and correspondence

#### 2.2. Data Collected Automatically

Technical data — IP address, browser type and version, operating system, device, time zone, language settings

Usage data — pages visited, session duration, referring URLs

Audit records in the client portal — when using the client portal (portal.studionewera.com), logins and login attempts, activity and submitted statements (requests, comments, messages, approvals) are automatically recorded, together with user, date, time, IP address and browser information. These records serve the security of the portal and the proof of statements made in connection with the contractual relations.

Cookie data — see the Cookie Policy

#### 2.3. Payment Data

Payment information (card number, CVV, expiry date) is processed entirely by Stripe, Inc. The Company does not receive or store full payment card data. We receive only confirmation of successful/failed payment and the last four digits of the card for reference purposes.

#### 2.4. Data in Electronic Signing

When contracts and orders are signed electronically through an electronic signing platform (e.g. SignNow), the following are processed: names, email address, IP address, date and time of actions and the audit trail of the signing process. The audit trail is an integral part of the signed document and is stored together with it.

### 3. Purposes and Legal Basis for Processing

Purpose Legal basis (Art. 6 GDPR)

Provision of the Services, account management, payment processing Performance of a contract (point "b")

Improvement of the Services, technical support, analytics Legitimate interest (point "f")

Security of the client portal and proof of contractual statements (audit records, electronic signing) Legitimate interest (point "f") and performance of a contract (point "b")

Compliance with tax, accounting and regulatory obligations Legal obligation (point "c")

Marketing communications, analytics and advertising cookies Consent (point "a")

### 4. Retention Periods

Data category Period

Client data under contracts 5 years after termination of the contract

Accounting and tax documents 10 years

Login and activity records in the client portal Up to 24 months

Audit records of statements in the portal (comments, messages, approvals) and audit trails from electronic signing 5 years after termination of the contract

Analytics data Up to 26 months

Communication data Up to 3 years

Marketing data Until withdrawal of consent

### 5. Sharing with Third Parties

We may share data with:

Stripe, Inc. — payment processing (Stripe is PCI DSS Level 1 certified)

airSlate, Inc. (SignNow) — platform for electronic signing of contracts and orders; processes names, email address, IP address and the signing audit trail

Google LLC — Google Analytics, Google Ads (when cookies are used with Your consent)

Meta Platforms, Inc. — Facebook/Instagram Pixel (when used with Your consent)

AI technology providers — for the AI Powered Website and AI Website Builder services, business information provided by You (descriptions, preferences, materials) may be processed by third-party AI models for the purpose of generating structure, design directions and content. We do not knowingly provide personal data to third parties for AI processing.

Hosting providers — for the technical infrastructure of the Services

Mailing/marketing services — for sending correspondence

Accounting and legal advisers — where necessary

Public authorities — where required by law

### 6. International Data Transfers

Some of the third parties listed (e.g. Stripe, airSlate/SignNow, Google, Meta, as well as AI technology providers) may process data in the USA or other third countries. Transfers are carried out on the basis of: Standard Contractual Clauses (SCC) approved by the European Commission; the EU-US Data Privacy Framework, where applicable; Other appropriate safeguards under Art. 46 GDPR.

### 7. Your Rights (GDPR)

Under the GDPR, You have the following rights:

Right of access (Art. 15)

Right to rectification (Art. 16)

Right to erasure / "right to be forgotten" (Art. 17)

Right to restriction of processing (Art. 18)

Right to data portability (Art. 20)

Right to object (Art. 21)

Right not to be subject to automated decision-making (Art. 22)

Right to withdraw consent

To exercise your rights: contact@studionewera.com . We will respond within 30 days.

Please note that the right to erasure does not apply to data whose retention is necessary for the establishment, exercise or defence of legal claims (Art. 17(3), point "e" GDPR) — for example audit records of contractual statements and payment documentation — nor to data that we are legally obliged to retain.

You have the right to lodge a complaint with the Commission for Personal Data Protection (КЗЛД): www.cpdp.bg , bul. "Prof. Tsvetan Lazarov" 2, Sofia 1592.

### 8. Additional Rights under the CCPA (California Residents)

If You are a California resident, You have additional rights under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA): the right to know what personal data we collect; the right to deletion; the right to opt out of the sale of personal data — We do not sell personal data; the right to non-discrimination. To exercise these rights: contact@studionewera.com .

### 9. Data Security

We apply appropriate technical and organisational measures to protect data, including: SSL/TLS encryption; firewalls and intrusion detection systems; restricted access to data; audit records of access to the client portal; regular backups; team training. Despite the measures taken, no security system is absolutely reliable.

### 10. Children

The Company's Services are not directed at persons under 18 years of age. We do not knowingly collect personal data from children. If we discover that we have collected data of a person under 18 years of age, we will delete it immediately.

© 2026 Digital New Era LTD. All rights reserved.

UIC (ЕИК): 207276590 | VAT (ДДС): BG207276590