Last updated: 8 October 2026
This page explains what personal data we process when you browse mhstudio.bg or contact us, why we do it and what rights you have. In short: we collect only what we need to reply to you, we use no advertising cookies, and we collect visitor statistics only if you agree.
Who we are
The controller of your personal data is Bocote Ltd. (Бокоте ООД), the company behind the MH Studio brand.
- Company number (UIC/EIK): 204617710
- Registered office: 12 Krali Marko St., floor 5, apt. 9, Sredets district, 1124 Sofia, Bulgaria
- Email: office@mhstudio.bg
- Phone: +359 885 955 390
What data we process and why
Enquiries sent through the website form
When you send an enquiry, we receive:
- your name;
- your phone number or email address — whichever you choose to give;
- the property type and area (m²);
- your message;
- the price plan you selected, if you send the enquiry from the price calculator;
- technical details added automatically: date and time, the page you sent it from, the site language, your country (estimated from your IP address) and your browser type.
We use this data to reply to your enquiry and to prepare a quote. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) of Regulation (EU) 2016/679, the General Data Protection Regulation or GDPR). By ticking the box on the form, you confirm that you want us to use your details for this purpose. Giving us your details is voluntary, but without a name and a way to contact you we cannot reply.
Enquiries reach us by email at office@mhstudio.bg. A backup copy is kept in Cloudflare storage in case the email does not arrive.
Contacting us directly by phone, Viber, WhatsApp, Telegram or email
You choose the channel. We receive what you send us, together with the number, profile or email address you write from, and use it only to reply and prepare a quote, on the same legal basis. The apps themselves (Viber, WhatsApp, Telegram) and your email provider process data under their own privacy policies.
Visiting the website
The website is hosted and delivered by Cloudflare, Inc. On every visit, Cloudflare processes technical data — IP address, browser type, the page requested, date and time — in short-lived server logs, to protect the site against attacks and abuse (including limiting repeated form submissions). The legal basis is our legitimate interest in keeping the site secure and available (Article 6(1)(f) GDPR).
Visitor statistics are collected only if you agree — see “Cookies” below.
What we do not do
No advertising cookies, no social-media pixels, no newsletter, no profiling and no automated decisions about you. We do not sell your data or pass it on for marketing.
How long we keep your data
- Enquiries and correspondence — up to 12 months from our last contact, then deleted. The backup copy in Cloudflare is deleted automatically 12 months after it is received.
- If we sign a contract — for as long as accounting and tax law requires.
- Cloudflare server logs — for a short period, in line with Cloudflare’s policies.
- Google Analytics data — no longer than 14 months.
- Your cookie choice — 12 months, in your browser.
Who receives your data
These providers process data on our behalf and only on our instructions:
- Cloudflare, Inc. — hosting, content delivery network (CDN), security and the backup copy of enquiries;
- our email hosting provider — stores the office@mhstudio.bg mailbox;
- Google Ireland Ltd and Google LLC — visitor statistics, only with your consent.
Public authorities receive data only where the law requires it.
Transfers outside the EU
Cloudflare and Google may process data in the United States and other countries outside the European Union. These transfers rely on the EU-U.S. Data Privacy Framework, under which both companies are certified, and on Standard Contractual Clauses approved by the European Commission.
Cookies
Cookies are small files that a website stores in your browser. Our site sets cookies only for statistics, and only after you agree.
| Name | What it does | Lifetime | When it is set |
|---|---|---|---|
mh-consent (in localStorage, not a cookie) |
Remembers whether you accepted or rejected statistics | 12 months | Always — strictly necessary |
_ga |
Google Analytics 4: distinguishes individual visitors | 13 months | Only after consent |
_ga_<ID> |
Google Analytics 4: keeps track of the session | 13 months | Only after consent |
How consent works. We use Google Consent Mode v2: by default everything is denied and the Google Analytics script does not load at all. It loads only once you click “Accept” in the cookie banner. Advertising storage and ad personalisation are always switched off.
What we see. Aggregated statistics: which pages are viewed, where visitors come from, device and browser type, approximate location (city or country), time spent on the site and whether an enquiry was sent (never its content). Your IP address reaches Google as part of the connection, but Google Analytics 4 does not log or store it. The legal basis is your consent (Article 6(1)(a) GDPR and Article 4a of the Bulgarian Electronic Communications Act).
How to change your mind. At any time, via the “Cookie settings” link at the bottom of every page. If you reject statistics, tracking stops and the _ga cookies are deleted. You can also clear cookies and site data in your browser settings.
Your rights
You have the right to:
- access your data and receive a copy;
- have it corrected or erased;
- restrict its processing, or object to processing based on our legitimate interest;
- receive it in a structured, machine-readable format (data portability);
- withdraw your consent at any time — this does not affect processing carried out before you withdrew it.
To exercise any of these rights, email office@mhstudio.bg. We reply within one month; complex requests may take up to two further months, and we will tell you if so. We may ask you to confirm your identity.
If you believe your rights have been infringed, you can complain to the Bulgarian Commission for Personal Data Protection (CPDP): 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, www.cpdp.bg, kzld@cpdp.bg. You are welcome to contact us first — that is often the quickest way to sort things out.
Children
This website is not aimed at children under 16, and we do not knowingly collect their data. If you believe a child has sent us personal data, contact us and we will delete it.
Changes
We may update this page, for example if the way the website works changes. The date at the top shows when it was last updated.