A limited number of loaves every week

Bäckerei Florian

German baking in Plovdiv

Privacy policy

This page says what happens with personal data when you visit this website or sign up through it. "Personal data" is anything that can identify you: a name, a phone number, an IP address.

Who is responsible

The controller under the GDPR is:

Florian Ionescu
ul. Presiyan 23
Plovdiv, Bulgaria

Phone: +359 89 394 2079
E-mail: hello@baeckerei-florian.com

What the site records on its own

The site sets no cookies, uses no local storage, and runs no third-party analytics. Nothing about your visit is sold or shared for advertising. The site's own server keeps no log of page visits.

Where the site runs

The site is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. I have a data processing agreement with Hetzner; their privacy policy is at hetzner.com/legal/privacy-policy.

Traffic between your browser and the server is routed through Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, which acts as a content delivery network and a filter against malicious traffic. Cloudflare may set technically necessary cookies of its own for that purpose. I have a data processing agreement with Cloudflare; the transfer to the US is covered by the European Commission's Standard Contractual Clauses, and Cloudflare is certified under the EU-US Data Privacy Framework. Their privacy policy is at cloudflare.com/privacypolicy. The legal basis for both is my legitimate interest in serving the site reliably and securely (Art. 6(1)(f) GDPR).

The sign-up form

If you fill in the form, your name, your phone or Viber number, and your neighbourhood are stored on the server described above, together with the time, the language of the page, and, if you came through the QR code on one of our bags, a note saying so. To stop automated spam, the server keeps your IP address in memory for ten minutes after you send the form; it is never written to disk. I use your details to tell you when ordering starts, and your neighbourhood to see where in Plovdiv people want deliveries. I don't pass them on. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by sending the form and can revoke at any time with effect for the future. I keep your details until you withdraw your consent or ask me to delete them.

E-mail and phone

If you contact me by e-mail or phone directly, your request and the personal data in it are stored to handle it and not passed on. I keep them until your request is dealt with and you haven't asked me to delete them, or until a statutory retention period ends where one applies. The legal basis is Art. 6(1)(b) GDPR where your message is about entering or performing a contract, and otherwise my legitimate interest in answering what you sent me (Art. 6(1)(f) GDPR).

Your rights

Under the GDPR you can, at any time and free of charge:

  • ask what personal data of yours I hold, where it came from, and what it's used for (Art. 15)
  • have it corrected (Art. 16) or deleted (Art. 17)
  • have its processing restricted (Art. 18)
  • receive it in a common machine-readable format, or have it sent to another controller where technically feasible (Art. 20)
  • object to processing based on legitimate interest, on grounds arising from your particular situation (Art. 21)
  • complain to a data protection supervisory authority, in particular in the member state where you live or work (Art. 77)

For any of these, write to the address at the top. Where I process something based on your consent, such as the sign-up form, you can revoke that consent at any time with effect for the future.