Privacy Policy

Who is responsible

We are Borderless Professionals Foundation, registered in Bulgaria as Фондация „ПРОФЕСИОНАЛИСТИ БЕЗ ГРАНИЦИ“, EIK 205863450, at Bulgaria, 7000 Ruse, 18 Oborishte Street. We are the controller of personal data processed for our website and enquiries. For privacy questions or rights requests, contact hi@melistics.co or write to this address. See our legal entity details.

This notice covers the informational website, enquiries, newsletter signup and voluntary donations. Advertising, sales, bookings and accounts remain planned.

Browsing and contacting us

Website delivery and security. Serving a page involves processing technical information such as an IP address, requested URL, time, browser details and response or error information. Vercel is our selected hosting and content-delivery provider for the public site. When the site is served through Vercel, it processes technical requests and may retain operational and security logs. Our purpose is to deliver, protect and diagnose the website; our legal basis is our legitimate interest in a functioning, secure service (GDPR Article 6(1)(f)). This means a website without a submissions database can still involve personal data processing.

Contact enquiries. We ask for your name, email address, topic and message. When the form offers “Continue to email”, it uses these details to open a draft in your own email app. In that mode the website does not submit the fields to us. Your email provider processes the message if you choose to send it.

When the form offers “Send message”, it sends these details to our server after a Google reCAPTCHA check. We use Resend to deliver the enquiry to our Google Workspace inbox. Resend processes the message and delivery metadata for that purpose. We do not store enquiry contents in a website database or intentionally include them in application logs. Our email and delivery providers process and retain records under their applicable terms.

Anti-spam verification. When direct submission is available, Google reCAPTCHA loads on the contact page before you send a message. It processes technical information, including IP address, browser and device information and interaction signals, to detect automated abuse. It sets a _GRECAPTCHA cookie for risk analysis. We use this processing to protect our contact channel from spam and abuse, based on our legitimate interest in a secure service (Article 6(1)(f)). We verify the resulting token with Google before requesting email delivery.

For reCAPTCHA customer data, we are the controller and Google acts as our processor under the Google Cloud Data Processing Addendum. See Google’s reCAPTCHA data-processing guidance and cookie information. You can contact us directly at hi@melistics.co without using the form.

We use enquiries to respond, manage correspondence and follow up on the matter you raised, based on our legitimate interest in communicating with people who contact us (Article 6(1)(f)). Where you ask us to take steps towards a contract with you, Article 6(1)(b) applies to those necessary steps. We may retain relevant records to meet a legal obligation (Article 6(1)(c)) or handle a legal claim (Article 6(1)(f)). Sending an enquiry does not subscribe you to marketing.

Providing enquiry details is voluntary, but without a reply address and sufficient context we may be unable to respond. Do not include medical records, health information, identity documents, card details or another person's confidential data. We do not request sensitive health information through this channel.

Cookies and local resources

We save the language you select in your browser’s local storage under preferred-locale. It contains only a language code, not your name or email, and remains until you change the choice or clear site data. We use it only to remember your language preference. For links without a language prefix, we use this saved choice first; if it is absent or storage is unavailable, we choose a supported language using the country code Vercel provides from your IP address, with Bulgarian as the fallback. We do not save your location for this feature. Links with an explicit language keep that language. Without JavaScript, we use the country-based fallback. You can clear or block local storage in your browser; language switching still works, but the choice may not be remembered.

Fonts and the site's images are served with the site. We do not currently use analytics tools, Google Ads tags or Meta pixels. There is no advertising consent mechanism yet because those optional technologies are not enabled.

Newsletter and advertising

Newsletter. We use EmailOctopus for voluntary subscriptions to our educational news, based on your consent (Article 6(1)(a)). By submitting the signup form, you confirm you are 18 or over and agree to receive these emails. We send your email address, chosen website language, signup placement and consent-notice version to EmailOctopus. New contacts are created as pending confirmation; we do not use the form to reactivate an existing opt-out. EmailOctopus records subscription and confirmation activity. Each marketing email will offer an unsubscribe link; you can also contact us. We do not keep a separate website subscriber database. To limit automated submissions, the server temporarily uses hashed email and, on Vercel, IP identifiers for 15-minute rate-limit windows. The signup form adds no tracking cookies or scripts. Any email open or click tracking will be described and configured with the required consent before it is enabled.

New subscriptions require you to follow the confirmation link sent by EmailOctopus before you receive our newsletter. The confirmation email and its confirmation page are currently in Bulgarian, whichever website language you choose. If you did not request a subscription, you can ignore the confirmation email.

Advertising. We plan to use Google Ads and Meta conversion tracking. These tools can send identifiers, IP or device information, page visits and conversion events to the relevant provider for measurement and advertising. Before activation, we will identify the tags, cookie lifetimes, recipients and purposes in a consent notice. Optional tracking will remain off until you consent, with a way to refuse or withdraw as easily as accepting. We will not send enquiry contents, health information or children’s data in advertising events. Consent to optional advertising is separate from access to the website or sending an enquiry.

Sales, bookings and accounts. These features are not yet available. Providers, data fields and transaction-related retention have not been finalised. We will update this notice with the actual arrangements before collecting such data.

Donations

When online donations are available, we use Stripe to process one-time donations. When you continue to payment, we send the amount, currency and website language to Stripe. You enter payment details, your email address and your phone number directly in Stripe’s embedded form. We use these contact details for questions about your donation; donating does not subscribe you to our newsletter. We can access transaction and donor details in our Stripe account; the website retrieves the session identifier, amount, currency and payment status to show your confirmation. We do not store full card numbers or security codes, or maintain a separate website donation database. We process the information to carry out your requested donation (Article 6(1)(b)), protect payments (Article 6(1)(f)) and meet applicable legal obligations (Article 6(1)(c)).

Starting checkout sets a necessary first-party donation_… cookie containing a signed session reference, valid for up to 24 hours. It lets us verify the returning browser. Stripe’s payment and fraud-prevention services load only after you continue to payment and may use their own cookies and technical data; see Stripe’s Cookie Policy. Stripe retains payment records under its privacy policy, including legal and fraud-prevention requirements. We retain required donation and accounting records for applicable statutory periods and relevant disputes; the enquiry deletion period does not apply to those records. Contact hi@melistics.co for payment-data questions. International processing and safeguards also apply to Stripe.

Recipients and international processing

Access is limited to people who need the information for the purposes above and the providers supporting those purposes. We use Vercel for hosting and image delivery, Resend for contact-form email delivery, Google Workspace for our inbox, Google reCAPTCHA for anti-spam checks and EmailOctopus for newsletter subscriptions. Google Ads and Meta are planned advertising recipients, subject to the consent arrangements above. We may also disclose necessary information to professional advisers or authorities where required by law or necessary to establish, exercise or defend legal claims.

Provider infrastructure, support or subprocessors may process data outside Bulgaria and the European Economic Area, including in the United States and, for EmailOctopus, the United Kingdom. Transfers must rely on an applicable adequacy decision or appropriate safeguards such as the European Commission’s standard contractual clauses, with additional measures where needed. You can ask us about the safeguards relevant to your data or request a copy, with confidential information redacted where necessary.

Provider documentation: Vercel data processing terms, Resend data processing terms, Google Workspace data processing terms and EmailOctopus data processing schedule. We do not sell enquiry information.

How long we keep information

• Enquiries: we delete correspondence 12 months after the matter is resolved, unless specific information is still necessary for a legal obligation or claim.
• Routine website and security logs under our control: up to 30 days where the provider permits configuration. Provider-managed infrastructure, security and backup records can have separate retention under the provider's terms; the 30-day period is not a guarantee covering every provider record.
• Newsletter subscriptions: until you unsubscribe or withdraw consent. We then remove the active subscription and keep only the minimum suppression information needed to respect your opt-out and prevent further marketing, for as long as that remains necessary.
• Legal exceptions: if a law requires retention or a specific dispute requires evidence, we keep only the relevant records for the required period or until the claim and applicable limitation period are resolved. Access and use remain restricted to that purpose.

These are our retention rules. Deletion from active systems may precede removal from providers' backup cycles; backup copies are governed by the applicable provider's deletion arrangements.

Your rights and choices

Under the GDPR, and subject to its conditions, you may request access, correction, erasure, restriction or portability of your data. You may object to processing based on legitimate interests and object to direct marketing at any time. You may withdraw consent without affecting the lawfulness of processing before withdrawal.

Send requests to hi@melistics.co. We may ask for proportionate information to confirm your identity. We normally respond within one month; a complex request may take up to two additional months, and we will explain an extension within the first month. Requests are normally free of charge.

You can complain to the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592, Bulgaria, or to the competent authority where you live or work. You do not need to contact us first. See the GDPR for the conditions governing these rights.

Children, security and changes

Our enquiry channel is for people aged 18 and over. We do not knowingly accept enquiries or subscriptions from children. A parent or guardian may contact us in their own name without sending a child's personal information. If we discover that a child has supplied personal data, we will delete it unless retention is legally required. Please tell us if you believe this has happened.

We apply access restrictions and proportionate technical and organisational measures. No website or email service can guarantee absolute security. We do not currently make decisions producing legal or similarly significant effects solely through automated processing.

We will revise this notice when our practices change and update the date above. Where a change requires new information or consent before processing starts, we will provide it at that point. For any question, contact hi@melistics.co.