Privacy Policy

1. Who is responsible for your data

The controller of your personal data within the meaning of the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) is Radoslav Dimitrov, Sofia, Bulgaria.

Email: contact@radodim.com · phone: +359 898 531 339. Use this address for any request or question about your personal data.

No data protection officer has been appointed — the law does not require one for an activity of this kind and scale.

2. What we process and why

We collect only the data you send us yourself, plus the minimal technical data without which no website can operate.

• Artwork enquiry or general question (the form on every artwork page and on the Contact page): name, email, phone (optional), message, the title and address of the artwork you are asking about, and the language in which you use the site. Purpose: to answer your enquiry and, if you wish, to arrange a purchase. Legal basis: Art. 6(1)(b) GDPR — steps taken at your request prior to entering into a contract; for general questions, Art. 6(1)(f) — our legitimate interest in replying to a message addressed to us.
• RSVP for an exhibition opening: name, email, phone (optional), whether you will attend, number of guests and a message. Purpose: organising the event. Legal basis: Art. 6(1)(f) — our legitimate interest in organising an event you have signed up for.
• News from the artist (only if you choose it): if you tick the consent box on the RSVP form, we keep your name and email on a list so we can write to you about new paintings and exhibitions. Legal basis: your consent (Art. 6(1)(a)). You can withdraw it at any time — through the unsubscribe link in every email or by writing to contact@radodim.com. Without the tick, nothing is added to any list.
• Technical data when you visit: like every website, the server that delivers radodim.com receives your IP address, browser and device type, the time and the address of the requested page. This data is used solely to deliver the page, for security and for troubleshooting (Art. 6(1)(f)) and is kept in the hosting provider's system logs for a limited time. We do not link it to you and do not use it for profiling.

3. What we do not do

• We use no analytics or advertising tools (Google Analytics, Meta Pixel or similar), set no tracking cookies and pass no data to advertising networks.
• Fonts, images and every file of the site are served from our own server, not from third-party services that would see your visits.
• We make no automated decisions about you and do no profiling.
• We do not sell or rent personal data to anyone.

4. Cookies and local storage

The site uses no tracking cookies. It relies on only two strictly necessary technical mechanisms, for which no consent is required:

• The cookie “rd_access” — only if the site is temporarily locked before an exhibition opening and you have entered an access code (or scanned a QR code containing it). It remembers that the code was accepted, does not contain the code itself and expires after 60 days.
• The entry “rd-a11y” in your browser's local storage — only if you change the accessibility settings (higher contrast, larger text, no animations). It holds those settings only and never leaves your device.

You can delete both at any time in your browser settings.

5. Who has access to the data

To run the site we use a small number of providers that process data on our behalf and on our instructions under data processing agreements (Art. 28 GDPR):

• Vercel Inc. (USA) — hosting of the site and execution of the forms. Vercel is certified under the EU-U.S. Data Privacy Framework, which the European Commission recognised as providing an adequate level of protection in Implementing Decision (EU) 2023/1795.
• Resend (Resend, Inc., USA) — email delivery service. Messages from the forms travel through it to our mailbox; if you consent to news, it also stores the recipient list. Resend is likewise certified under the EU-U.S. Data Privacy Framework.
• The provider of the mailbox in which the messages arrive.

The messages are accessible to the artist and to the people who help him organise exhibitions. We disclose data to no other recipients unless the law obliges us to.

6. How long we keep the data

• Enquiries and RSVPs — until we have replied and while the matter is current, but no longer than two years after our last correspondence. If a purchase follows, the correspondence and the transaction documents are kept for the periods required by accounting and tax law.
• The news list — until you withdraw your consent.
• Server logs — for a limited time, according to the hosting provider's practice.

7. Your rights

At any time you have the right to:

• access the data we hold about you (Art. 15 GDPR) and receive a copy;
• have inaccurate data corrected (Art. 16);
• erasure (“right to be forgotten”, Art. 17);
• restriction of processing (Art. 18);
• portability of the data you have provided to us (Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Write to contact@radodim.com. We reply without undue delay and within one month at the latest; where necessary we may ask you to confirm your identity.

If you believe your rights have been infringed, you can lodge a complaint with the supervisory authority: the Commission for Personal Data Protection (КЗЛД), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, tel. +359 2 91 53 518, kzld@cpdp.bg, www.cpdp.bg. If you live in another EU country, you may also contact the supervisory authority there.

8. Security

The site is served only over an encrypted connection (HTTPS). Form data is processed on the server and transmitted over encrypted channels; the keys for the email service are not accessible from the browser and are not published on the site. The forms are protected against automated spam submissions.

9. Children

The site is not directed at children and we do not knowingly collect personal data from children. If you believe a child has sent us data, write to us and we will delete it.

10. Links to other sites

The “Map” and “Add to calendar” buttons on the invitation page open Google Maps and Google Calendar only after you press them; Google's terms and policies apply there. The “Share” button uses your device's built-in sharing function and sends us no data.

11. Changes to this policy

If the way the site works changes, we will update this policy; the current version is published here with its effective date.

Effective from 6 October 2026. See also the Terms and Conditions and the Accessibility Statement.