Privacy Notice
The short version
This site runs no analytics, serves no advertising, builds no profiles and has no accounts or newsletter. Nothing is sold or shared for anyone's marketing. I do not know who you are or which pages you read.
The assessment tools are the part people ask about most. They run entirely inside your browser. Your answers, your scores and the files you export never leave your device and never reach me, which is why they can be used on real internal material without that material going anywhere.
There are three places where data does move: the contact form, the cookie banner scanner, and content embedded from other organisations. Each is set out below with its legal basis and how long anything is kept.
Who is responsible
The controller for the processing described here is Simeon Atanasov, a private individual in Bulgaria, acting in a personal capacity. This is a personal portfolio and reference site rather than a commercial service, and no company operates it.
You can reach me directly at sim.atanasov@gmail.com about anything on this page, including to exercise any of the rights below. A site of this kind does not meet the conditions in Article 37 GDPR for a mandatory data protection officer, so there is no DPO and your message comes straight to me.
The processing is governed by the General Data Protection Regulation (EU) 2016/679 and the Bulgarian Personal Data Protection Act. Storing or reading anything on your device, which is what cookies and embedded content do, is separately governed by the Electronic Communications Act, which implements Article 5(3) of the ePrivacy Directive 2002/58/EC.
What is processed, and why
One block per activity. If something is not listed here, it does not happen.
Contacting me through the form
- DataYour name, your email address, and whatever you write in the message.
- PurposeReading your message and replying to it. Nothing else. You are not added to any list, because there is no list.
- Legal basisArticle 6(1)(f), legitimate interests. The interest is being able to answer someone who has deliberately written to me. You can object at any time under Article 21, and in practice objecting means asking me to delete the exchange.
- Who else sees itThe form is delivered by Formspree, which passes the message to my email inbox at Google. Both act as processors for this.
- How longKept while we are corresponding, and deleted within 12 months of the exchange ending, unless you have asked me to keep something or I need it to deal with a legal claim.
Using the cookie banner scanner
- DataThe website address you ask it to scan, plus the technical connection data any server receives: your IP address, the time of the request and your browser's user agent string.
- PurposeRunning the scan you asked for and returning the result to you.
- Legal basisArticle 6(1)(f), legitimate interests, the interest being to provide the tool you chose to use.
- Who else sees itThe scan runs on a separate service of mine hosted by Render, not on this site.
- How longThe scan result is returned to your browser and is not kept as a record of your use. The hosting provider keeps short-lived operational logs of requests, which I do not use to identify anyone.
- Worth knowingIf you scan an address that is itself sensitive, such as an internal or staging URL, you are sending it to that service. Scan something you are comfortable sending.
Simply visiting a page
- DataThe technical connection data described above: IP address, request time, user agent.
- PurposeServing the page, and letting the host defend itself against abuse.
- Legal basisArticle 6(1)(f), legitimate interests in the site being available and not being attacked.
- Who else sees itThe site is hosted on GitHub Pages, so GitHub receives this data as part of serving the request. There is no analytics layer on top of it and I do not see visitor logs.
- How longSet by the host, not by me.
Content embedded from other organisations
- DataWhen an embed loads, the organisation serving it receives your IP address and user agent, and may set its own cookies. That covers the Power BI dashboard from Microsoft, certificate badges, institution logos and a script library.
- PurposeShowing that content.
- Legal basisYour consent, Article 6(1)(a), together with the separate consent requirement for storing or reading anything on your device. Nothing in this category loads until you allow it, so if you decline, or simply never answer, those organisations do not learn you were here.
- Who else sees itEach provider is a controller in its own right for what it then does with the data, not my processor. Their own policies govern that.
- How longWhatever each provider sets. The detail, cookie by cookie, is in the cookie notice.
Your cookie choice, and what the tools remember
- DataYour consent choice, and any answers you save in the assessment tools.
- PurposeNot asking you the same question on every page, and letting a long assessment survive a reload.
- Legal basisStrictly necessary for a service you asked for, so no consent is needed for these two. That is also why they are the only things in the strictly necessary category.
- Who else sees itNobody. This is your browser's local storage. It stays on your device, is never transmitted to this site or anywhere else, and I cannot read it.
- How longThe consent record expires after a year. Tool answers stay until you clear them, and the readiness tool has its own Save, Load, Clear and Forget controls.
Transfers outside the EEA
Some of the providers above are established in the United States. Where that is so, the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the standard contractual clauses adopted by the Commission. Ask me which applies to a particular provider and I will tell you what I know.
What does not happen
Stated plainly, because a notice that only lists what is collected leaves the reader guessing about everything else. There is no automated decision-making producing legal or similarly significant effects, and no profiling, within the meaning of Article 22. The assessment tools score your own answers and show you the result; they make no decision about you and nobody else sees the output. No special category data under Article 9 is sought anywhere on this site, and the contact form asks only for a name, an email address and a message. Nothing is sold, and nothing is shared for anyone else's marketing.
This site is not directed at children and I do not knowingly collect their personal data. If you think a child has sent me something through the contact form, tell me and I will delete it.
Your rights
Under the GDPR you have the right of access to your personal data (Article 15), and rights to rectification (16), erasure (17), restriction of processing (18), data portability (20) and to object (21). Where processing rests on your consent, you may withdraw that consent at any time, which does not affect the lawfulness of anything done before you withdrew it. For the embedded content, withdrawing is one click on Cookie settings at the foot of any page, and the content unloads immediately.
To exercise any of these, email sim.atanasov@gmail.com. I will answer within one month, as Article 12(3) requires. There is no charge, and I will not ask you to prove your identity beyond what is needed to be confident I am answering the right person. Given how little is held, the honest answer to most access requests will be that I hold nothing about you at all.
If you are not satisfied with how I have handled something, Article 77 gives you the right to complain to a supervisory authority, either where I am established or where you live or work. The Bulgarian authority is the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, kzld@cpdp.bg, cpdp.bg. You do not have to raise it with me first, though I would rather you did, because it is usually quicker.
Cookies and similar technologies
Covered separately and in full, cookie by cookie, in the cookie notice: what each one is, which organisation sets it, how long it lasts, and which page brings it into play. That page is written from a scan of the site rather than from memory, and it carries the date it was last verified.
Changes to this notice
If what the site does changes, this page changes with it and the date at the top moves. There is no mailing list to notify you through, so that date is the signal. Earlier versions are visible in the site's public repository history.