Impressum - A Bros Production

A Bros Production · abrospro.com · Last updated: 9 October 2026

1. Introduction and scope

We value your privacy. This Privacy Policy explains how we process personal data when you visit abrospro.com (the “Website”), contact us, or use our photography and video production services. It is based on Regulation (EU) 2016/679 (the “GDPR”), the Bulgarian Personal Data Protection Act, and Directive 2002/58/EC (the “ePrivacy Directive”) as implemented in Bulgarian law.

You can browse the Website without telling us who you are. We process personal data only as described in this Policy and only to the extent necessary for each purpose. Where no other legal basis applies, we ask for your consent.

We apply technical and organizational measures to protect your data. Data transmission over the internet can never be guaranteed to be completely secure, so if you prefer, you may send us information by other means, for example by telephone.

2. Controller and contact details

The controller within the meaning of Art. 4(7) GDPR is:

Controller: Daniel Ahmakov, operating under the brand “A Bros Production”
Address: Narodno Horo Str. 26, 1618 Sofia, Bulgaria
Email: info@abrospro.com
Website: www.abrospro.com
VAT ID: [BG175396130]

We have not appointed a Data Protection Officer because we are not required to do so under Art. 37 GDPR. Please send all privacy questions and requests to the email address above.

3. Key terms

Terms used in this Policy have the meaning given in Art. 4 GDPR. In particular, “personal data” means any information relating to an identified or identifiable natural person; “processing” means any operation performed on personal data, such as collecting, storing, using, disclosing or deleting it; “consent” means a freely given, specific, informed and unambiguous indication of your wishes by a statement or clear affirmative action; “processor” means a person that processes personal data on our behalf; and “recipient” means a person to whom personal data are disclosed.

4. What we process, why, on what legal basis and for how long

Activity	Data	Purpose	Legal basis	Retention
Server log files	IP address, date and time of access, pages requested, referrer URL, browser type and version, operating system, internet service provider	Delivering the Website, ensuring stability and security, detecting and defending against attacks, and providing information to law-enforcement authorities after a cyber-attack	Art. 6(1)(f) GDPR	[30 days], unless needed to investigate a security incident
Enquiries by email or other channels	Name, contact details, content of your message, project details	Answering your enquiry and preparing offers or contracts	Art. 6(1)(b) GDPR (pre-contractual steps) or Art. 6(1)(f) GDPR	Until the enquiry is resolved plus [6 months]; if a contract follows, see the next row
Client projects and contracts	Contact and billing details, project briefs, correspondence, delivery and payment records	Performing contracts, delivering productions, invoicing, accounting	Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR for tax and accounting obligations	Duration of the contract plus the retention periods required by Bulgarian accounting and tax law and applicable limitation periods for claims
Portfolio and published productions	Photographs and video in which identifiable persons appear, and related credits	Presenting our work on the Website and our social media channels	Art. 6(1)(a) GDPR (consent or release) or, where permitted by law, Art. 6(1)(f) GDPR	Until you withdraw consent or the purpose ends
Strictly necessary cookies and local storage	Technical identifiers, security tokens, your cookie choices	Operating the Website, security, remembering your consent settings	Art. 6(1)(f) GDPR; exempt from consent under the ePrivacy rules because strictly necessary	Session, or up to [12 months] for the consent record
Statistics and analytics	Online identifiers, device and browser data, pages viewed, time on site, approximate location	Understanding how the Website is used and improving it	Art. 6(1)(a) GDPR (consent), which is also the basis for storing or accessing information on your device	See the cookie settings panel; maximum [14 months]
Embedded content (e.g. Vimeo, YouTube)	IP address, device data, page visited, interaction data and, if you are logged in, account data	Displaying embedded videos and similar content	Art. 6(1)(a) GDPR (consent)	Determined by the provider (see Section 6)

Where we rely on legitimate interests (Art. 6(1)(f) GDPR), our interests are operating a secure and functional website, handling enquiries efficiently, running our business, and establishing, exercising or defending legal claims. We have balanced these interests against your rights and freedoms. You may object at any time (see Section 9).

5. Cookies and similar technologies

Cookies are small text files that your browser stores on your device. Many contain a cookie ID, a unique string that allows a website or server to recognise your individual browser. We also use similar technologies, such as local storage and tracking pixels, and everything in this Section applies to them as well.

We use three categories: strictly necessary technologies (always active), statistics, and embedded content or social media. Statistics and embedded-content technologies are used only if you consent.

When you first visit the Website, a banner lets you accept all, reject all non-essential technologies, or choose by category, with equal prominence for each option. No non-essential cookies or third-party scripts are loaded before you consent. We record your choice as proof of consent (Art. 7(1) GDPR). You can change or withdraw your consent at any time through the “Cookie settings” link on the Website. Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out before withdrawal. A current list of the cookies we use (name, provider, purpose and duration) is available in the cookie settings panel.

You can also block or delete cookies in your browser settings. If you do, some functions of the Website may not be fully available.

6. Service providers, third-party services and recipients

We do not sell personal data. We share personal data only where necessary with (i) processors acting on our instructions under agreements meeting Art. 28 GDPR, (ii) providers who act as independent controllers, and (iii) authorities where we are legally required to do so.

Hosting and infrastructure. The Website is hosted by [hosting provider and location], which processes server log data on our behalf as our processor.

Google Analytics (via Google Site Kit for WordPress). With your consent, we use Google Analytics, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies to analyse how you use the Website, for example which page you came from, which pages you view, and how often and for how long. We use this information to compile reports and improve the Website. We do not use it to identify you and do not combine it with other data about you. Data may be transferred to Google LLC and other Google group companies in the United States (see Section 7). You can withdraw your consent at any time via the cookie settings, or install Google’s opt-out browser add-on available at https://tools.google.com/dlpage/gaoptout. More information: https://policies.google.com/privacy.

YouTube. Where we embed YouTube videos, we do so only after you consent and, where available, in the extended data-protection mode. YouTube is operated for users in the EEA by Google Ireland Limited. When an embedded video loads, YouTube and Google receive the information that you visited the relevant page, your IP address and device data and, if you are logged in to YouTube, may associate this with your account. You can prevent this by logging out of YouTube beforehand. Privacy policy: https://policies.google.com/privacy.

Vimeo. Where we embed videos hosted on Vimeo, such as our showreel and project films, we do so only after you consent. The video player is provided by Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA (“Vimeo”). When you load an embedded video, your browser connects to Vimeo’s servers, and Vimeo receives technical data such as your IP address, device and browser information, the page you are viewing and your interaction with the player. If you are logged in to a Vimeo account, Vimeo may associate this information with your account. We embed Vimeo videos with the “do not track” setting enabled, which is intended to prevent Vimeo from using analytics and tracking cookies for the player. Data may be transferred to the United States (see Section 7). You can withdraw your consent at any time through the cookie settings, after which embedded videos will no longer be loaded. Vimeo’s privacy policy: https://vimeo.com/privacy.

Social media links (Facebook, Instagram, YouTube, Link.Bio). The Website contains links to our profiles on these platforms. They are ordinary hyperlinks, and no personal data is transmitted to the platforms merely by loading our pages. If you click a link, you leave our Website and the privacy policy of that platform applies. For users in the EEA, Facebook and Instagram are operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Other recipients. Where necessary, we also disclose data to accountants and tax advisers, banks and payment providers, IT service providers, legal advisers, and public authorities such as the National Revenue Agency, courts and law-enforcement bodies where required by law.

7. Transfers outside the European Economic Area

Some of our providers, notably Google, Automattic and Vimeo, may process data in the United States or other third countries. We ensure that such transfers comply with Chapter V GDPR, relying on an adequacy decision (for example the EU–US Data Privacy Framework for certified recipients) or on the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914) together with supplementary measures where needed. Where a transfer rests solely on your explicit consent (Art. 49(1)(a) GDPR), we will inform you of the possible risks beforehand. You may request a copy of the applicable safeguards by emailing us.

8. Storage period and deletion

We process and store personal data only for as long as necessary to achieve the purpose of processing, or as required by Union or Member State law to which we are subject. The criteria we apply are statutory retention duties (especially accounting and tax rules), limitation periods for legal claims, and the continuing need to perform a contract. When the purpose ceases or a retention period expires, the data are routinely deleted, blocked or anonymised in accordance with the law. Specific periods are set out in the table in Section 4.

9. Your rights

Under the GDPR you have the following rights in relation to your personal data:

Right of access (Art. 15). You may obtain confirmation of whether we process your data and, if so, access to it together with information on the purposes, categories of data, recipients (including recipients in third countries and the safeguards used), the planned storage period or the criteria for determining it, the source of the data if not collected from you, the existence of automated decision-making, and your other rights. You may also obtain a free copy of the data.
Right to rectification (Art. 16). You may have inaccurate data corrected without undue delay and incomplete data completed.
Right to erasure (Art. 17). You may have your data erased where, for example, it is no longer necessary for the purposes for which it was collected, you withdraw consent and no other legal basis applies, you successfully object, the data were processed unlawfully, or erasure is required by law, unless processing is necessary for a legal obligation or for the establishment, exercise or defence of legal claims. If we have made data public, we will take reasonable steps to inform other controllers processing it.
Right to restriction of processing (Art. 18). You may require restriction where you contest the accuracy of the data, the processing is unlawful and you prefer restriction to erasure, we no longer need the data but you need it for legal claims, or you have objected and the verification of overriding grounds is pending.
Right to notification (Art. 19). We will inform recipients of any rectification, erasure or restriction unless this proves impossible or involves disproportionate effort.
Right to data portability (Art. 20). You may receive the data you provided to us, where processing is based on consent or a contract and carried out by automated means, in a structured, commonly used and machine-readable format, and have it transmitted to another controller where technically feasible.
Right to object (Art. 21). On grounds relating to your particular situation, you may object at any time to processing based on Art. 6(1)(e) or (f) GDPR, including profiling. We will then stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You have an unconditional right to object at any time to the use of your data for direct marketing.
Right to withdraw consent (Art. 7(3)). You may withdraw any consent at any time with effect for the future.
Right not to be subject to solely automated decisions (Art. 22). See Section 10.
Right to compensation (Art. 82). You may claim compensation for material or non-material damage caused by an infringement of the GDPR.

How to exercise your rights. Email us at info@abrospro.com. We may ask for additional information to confirm your identity. We will respond without undue delay and in any event within one month, which may be extended by up to two further months for complex or numerous requests (Art. 12(3) GDPR). Handling your request is free of charge unless it is manifestly unfounded or excessive.

Right to lodge a complaint (Art. 77 GDPR). Without prejudice to any other remedy, you may lodge a complaint with the supervisory authority of the Member State of your habitual residence, place of work or the place of the alleged infringement. In Bulgaria the competent authority is the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg, kzld@cpdp.bg. You also have the right to an effective judicial remedy (Art. 79 GDPR), including by bringing proceedings before the competent Bulgarian court under the Personal Data Protection Act.

10. Automated decision-making and profiling

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Statistics collected with your consent are used in aggregated form to improve the Website and not to take decisions about individuals.

11. Obligation to provide data

The provision of personal data is partly required by law (for example tax and accounting rules) or by contract, and may be necessary to conclude a contract. If you enter into a contract with us, you must provide the data needed to conclude and perform it; otherwise we may be unable to conclude the contract. You are not obliged to provide personal data merely to visit the Website, although technical data described in Section 4 are processed automatically when you access it. Before you provide data, you may contact us to find out whether provision is mandatory in your case and what the consequences of not providing it would be.

12. Children

The Website is not directed at children. We do not knowingly collect personal data from children under 14 years of age (the age below which parental authorisation is required in Bulgaria for information-society services based on consent) without such authorisation. If you believe a child has provided personal data to us, please contact us and we will delete it.

13. Security

We implement appropriate technical and organisational measures under Art. 32 GDPR, such as encrypted (HTTPS) transmission, access controls, software updates and data minimisation. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the CPDP within 72 hours of becoming aware of it and, where the risk is high, inform affected individuals without undue delay (Arts. 33 and 34 GDPR).

14. Changes to this Policy

We may update this Policy to reflect changes in our services, the tools we use or legal requirements. The current version is always published on this page with its “Last updated” date. Where a change affects processing based on your consent, we will ask for renewed consent where the law requires it.

15. Provider information (legal notice)

Information pursuant to Directive 2000/31/EC and the Bulgarian Electronic Commerce Act:

VAT ID: BG175396130

Service provider: Daniel Ahmakov, operating under the brand “A Bros Production”

Address: Narodno Horo Str. 26, 1618 Sofia, Bulgaria

Email: info@abrospro.com

UIC (EIK): 175396130