Privacy Policy
Last updated: 20 September 2026
This policy explains what personal data we collect through www.uxp.bg, why we collect it, how long we keep it and what rights you have over it. It applies to the enquiry form on this website, to the measurement and advertising tags we run on it, and to anyone who contacts us through it.
1. Who we are
The controller of your personal data is:
Studio UXP Ltd. (Студио Ю Екс Пи ООД), trading as UXP A limited liability company registered in Bulgaria Company number (ЕИК): 128521889 VAT number: BG128521889 Registered office: 21 Ruen Str., 8600 Yambol, Bulgaria Studio address: 3 Vitoshka zornitsa Str., 1415 Sofia, Bulgaria Represented by: Dimo Georgiev Georgiev, Manager Email: hello@uxp.bg Phone: 0898 428 991
We have not appointed a Data Protection Officer, as our processing does not meet the criteria in Article 37 of the GDPR.
2. What we collect and why
Enquiry form
When you send us an enquiry, we collect:
- Your name — so we know who we are talking to
- Your phone number — so we can reply to you
- Your message — whatever you choose to tell us about your project
That is all — we do not store your IP address alongside the enquiry itself.
When an enquiry is sent successfully, the website also reports that a form submission happened to Google Ads, as a conversion event. That event records that an enquiry was sent and which advertising click it can be attributed to. It does not contain your name, your phone number or your message — those never leave our hosting. Section 3 sets out the detail.
Why we are allowed to do this: we process your name, phone number and message to take steps at your request before entering into a contract (Article 6(1)(b) of the GDPR).
Providing this information is voluntary, but without a name and a phone number we cannot respond to your enquiry.
Server logs
Our hosting provider keeps standard web server logs, which record IP addresses, the pages requested and the time of each request. These are kept for security and troubleshooting on the basis of our legitimate interest (Article 6(1)(f)), and are managed by the hosting provider under their own retention schedule.
3. Cookies, analytics and advertising
This website loads the Google tag (gtag.js), supplied by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use it for two things:
- Google Analytics 4 — aggregated statistics about how the site is used: how many people visit, which pages they look at, how they found us and roughly where in the world they are. We use this to understand whether the site is doing its job.
- Google Ads conversion measurement — so that when someone arrives from one of our Google ads and then sends an enquiry, we can see which campaign brought them. This is what lets us judge whether our advertising is worth the money.
What is stored on your device
These tags store small identifiers in your browser — cookies and similar local storage — so that repeat page views within a visit can be recognised as the same visit. The main ones are:
- _ga and _ga_<id> — Google Analytics visit and session identifiers, kept for up to 2 years.
- _gcl_au — Google Ads click identifier, used to attribute a conversion to an ad, kept for up to 90 days.
What is sent to Google
Through these tags Google receives your IP address (which Google shortens before storing it for Analytics), the pages you view and when, the page or ad that referred you, an approximate location derived from your IP address, basic device and browser information, the identifiers above, and — if you submit the enquiry form — the fact that a conversion occurred.
We do not send Google the contents of your enquiry, and we do not upload customer lists, email addresses or phone numbers to Google. We do not use these tags to build profiles about you as an individual, and nothing here produces a decision with a legal or similarly significant effect on you.
Why we are allowed to do this
Your consent — Article 6(1)(a) of the GDPR, and Article 4a of the Bulgarian Electronic Communications Act (ЗЕС) for the storing and reading of information on your device. These tags run only if you accept them; analytics and advertising storage stays switched off until you do.
You can change your mind at any time. Withdrawing consent is as easy as giving it: use the cookie settings on this site to switch these tags back off. Withdrawal does not affect the lawfulness of what was collected beforehand. You can also delete these cookies in your browser settings, block them there, or install the Google Analytics opt-out browser add-on. Declining has no effect on your enquiry or on how we answer it.
Transfers outside the EEA
Although our contract is with Google's Irish entity, data collected by these tags may be processed by Google LLC in the United States. Google LLC is certified under the EU–US Data Privacy Framework, and Google also relies on the European Commission's Standard Contractual Clauses together with supplementary technical measures. Google's own account of this is in the Google Business Data Responsibility pages and the Google Privacy Policy.
4. How long we keep your data
- Enquiries that do not lead to work: up to 24 months from the date of your last contact with us, then deleted.
- Enquiries that lead to a project: kept for the duration of the engagement and afterwards for as long as required by accounting and tax law.
- Analytics data: event-level data in Google Analytics is retained for 14 months and then deleted by Google. Aggregated reports, which cannot be traced back to an individual, may be kept longer.
- Advertising and conversion data: retained by Google under its own schedule, which for the identifiers described in section 3 is up to 90 days from your last visit.
5. Who else sees your data
We do not sell your data and we do not share it for marketing. It is accessible to the people in our team who handle enquiries, and to the following service providers acting on our instructions:
- SuperHosting.BG Ltd. — hosting for this website and for our email, including the spam filtering our mailboxes pass through. Their servers are located in Bulgaria, in the European Union.
- Google Ireland Limited — analytics and advertising measurement, as described in section 3, and only where you have consented to it. This involves a transfer to the United States; section 3 sets out the safeguards that apply.
Those are the only two, and they see different things. The enquiry you send us never reaches Google. It is handled entirely on our hosting: the form is processed there, the notification email is sent by the server itself and it arrives in a mailbox on the same infrastructure. No third-party email or marketing service is involved, and enquiries are not copied into any customer relationship or project management system.
What Google receives is the browsing and conversion data set out in section 3, and nothing from the body of your enquiry.
We may also disclose data where we are required to by law, or to establish or defend a legal claim.
6. Your rights
Under the GDPR you have the right to:
- ask what data we hold about you and receive a copy of it
- have inaccurate data corrected
- have your data deleted
- ask us to restrict how we use your data
- receive your data in a portable format
- object to processing we carry out on the basis of legitimate interest
- withdraw consent you have given us at any time, including consent to the analytics and advertising tags described in section 3
To exercise any of these, write to hello@uxp.bg. We will respond within one month.
7. Complaints
If you believe we have handled your data improperly, please tell us first so we can put it right. You also have the right to complain to the Bulgarian supervisory authority:
Commission for Personal Data Protection (Комисия за защита на личните данни) 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria www.cpdp.bg · kzld@cpdp.bg
8. Changes to this policy
If we change how we handle personal data we will update this page and the date at the top. Significant changes will be announced on the website.