StayBurgas

Legal

Privacy notice

One email form, no cookies, no analytics, no tracking. This page says exactly what we collect and what happens to it.

Who is responsible

The data controller for this site is TO CONFIRM: registered company name, TO CONFIRM: registered address, Burgas, Bulgaria. You can reach us at hello@stayburgas.com.

What we collect, and when

This site has two ways of collecting personal data: the email signup form, and the ballot on the mascot vote page. If you use neither, we collect nothing about you directly. There is no account system, no payment processing, no comment system and no tracking pixel.

The email signup form

When you submit the form, we store:

  • Your email address.
  • Your country, only if you chose one. The field is optional.
  • The page you signed up from, and which section of the site it belongs to. We use this to send you fewer, more relevant emails: someone who signed up on a transport page cares about transport news first.
  • The language of the page you signed up from.
  • The time of the signup, recorded by our email provider.

The mascot vote

The ballot on the mascot vote page asks for an email address so that one person cannot vote repeatedly. That address is treated differently from a signup: it never reaches our storage in readable form.

When you cast a vote, we store:

  • An irreversible SHA-256 hash of your address, salted with a secret value held on the server. It is enough to recognise a second vote from the same address. It cannot be turned back into your address, so we cannot contact you off the back of a vote, and it cannot be matched against any other list.
  • The candidate you chose.
  • A count of votes per internet connection, kept for one day and then deleted automatically, purely to stop automated ballot stuffing.

The ballot also carries an optional, unticked newsletter box. Only if you tick it does your address itself leave the page, and then it goes to the email provider exactly as a signup does, double opt-in included. Voting on its own never adds you to any list.

We use this data for one purpose: sending you the email updates the form describes, which cover tickets, transport, accommodation and prices for Eurovision 2027 in Burgas. The legal basis is your consent under Article 6(1)(a) of the GDPR, given by ticking the consent box. The box is never pre-ticked.

We use double opt-in. After you submit the form, you receive one confirmation email, and you are not on the list until you click the link in it. If you never click it, your address is not used.

You can withdraw consent at any time: every email carries an unsubscribe link, and writing to hello@stayburgas.com works too. Withdrawing stops all further email immediately.

The mascot vote rests on the same basis, Article 6(1)(a), given by ticking the box on the ballot. That consent covers counting your vote and nothing else. Because only a hash is stored, we have no way to email you about the poll, which is the reason for storing a hash.

Where the data goes

Signups are stored with our email service provider, which processes them on our behalf under a data processing agreement. We send the provider only the fields listed above, in plain form, so the list can be exported and deleted cleanly.

Mascot vote records are held separately, in a hosted key-value database that stores only the hashes and the counts described above. Nothing that identifies a voter is sent to it.

The site itself is served by Vercel Inc., our hosting provider, which processes IP addresses and request logs transiently as part of serving any website. We do not use that data to identify visitors and we run no analytics on it.

We do not sell personal data, and we do not share it with anyone beyond the two processors above.

How long we keep it

  • Unconfirmed signups, where the confirmation link was never clicked, are deleted by the provider's double opt-in handling.
  • Confirmed subscriptions are kept until you unsubscribe or ask us to delete you.
  • When the list is retired, it is deleted at the provider, not archived.
  • Mascot vote records are hashes and counts, never addresses. They are deleted when the poll closes, which is at the latest the day the contest organisers announce a real mascot.
  • The per-connection vote counts expire automatically after one day.

Your rights

Under the GDPR you can ask us for access to the data we hold about you, correction of it, deletion of it, a portable copy of it, and you can withdraw consent at any time without affecting the lawfulness of what happened before. Email hello@stayburgas.com and we act on it.

You also have the right to complain to a supervisory authority. For this site that is the Bulgarian Commission for Personal Data Protection (CPDP), or the authority in your own EU country.

Cookies

This site sets none. The full statement, including what would have to change before that changes, is on the cookies page.

Changes to this notice

If what we collect changes, this page changes first, and the change is dated. Material changes are announced to the list before they take effect.