Privacy Policy

1. Introduction

Amalgama Online ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website https://amalgama.online (the "Site"). We comply with the General Data Protection Regulation (GDPR) (EU) 2016/679 and the Bulgarian Personal Data Protection Act.

2. Data Controller

For the purposes of the GDPR, the data controller is Amalgama Online. If you have any questions about how we handle your personal data, you can contact us at kirill@digital-lamp.com.

3. Information We Collect

We may collect the following categories of information:

• Contact form data: name, email address, and message content when you use our contact form.
• Newsletter subscription data: email address when you subscribe to our newsletter.
• Technical data: IP address, browser type, operating system, and device information collected automatically.
• Usage data: pages visited, time spent on pages, and referral information, collected through Plausible Analytics (privacy-friendly, cookieless analytics).

4. Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent (Art. 6(1)(a) GDPR): when you subscribe to our newsletter or submit our contact form.
• Contract (Art. 6(1)(b) GDPR): when processing is necessary to take steps at your request prior to entering into a service contract.
• Legitimate interests (Art. 6(1)(f) GDPR): for website analytics and security, where those interests are not overridden by your rights.

5. How We Use Your Information

We use the information we collect to:

• Respond to your inquiries and provide customer support
• Send promotional communications and newsletters (with your consent)
• Analyze website usage and improve our services
• Detect, prevent, and address technical issues or fraud
• Comply with legal obligations

6. Data Sharing and Subprocessors

We do not sell your personal data. We may share your information with trusted third-party service providers who act as our subprocessors, including:

• Supabase – database hosting for form submissions and newsletter subscriptions.
• Plausible Analytics – privacy-friendly, cookieless website analytics.
• Resend – email delivery service (when configured).

Each sub-processor is bound by data processing agreements that comply with GDPR requirements.

7. International Data Transfers

Your information may be transferred to and processed in countries outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, to protect your personal data.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. Contact form submissions are retained for up to 24 months. Newsletter subscriptions are retained until you unsubscribe. You may request deletion of your data at any time.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encryption in transit (TLS), Row Level Security on our database, and access controls. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

10. Your GDPR Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: request a copy of your personal data.
• Right to rectification: request correction of inaccurate data.
• Right to erasure ("right to be forgotten"): request deletion of your data.
• Right to restrict processing: request limitation of processing.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests.
• Right to withdraw consent: at any time, without affecting the lawfulness of prior processing.

To exercise these rights, contact us at kirill@digital-lamp.com. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP).

11. Cookies and Tracking Technologies

Our Site uses Plausible Analytics, a privacy-friendly analytics service that does not use cookies or track personal data. Plausible does not require cookie consent under the GDPR. For more information, see our Cookies Policy.

12. Children's Privacy

Our Site is not intended for children under the age of 16. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child without parental consent, we will delete such information promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any significant changes by updating the date at the bottom of this policy and, where appropriate, by sending a notification to newsletter subscribers.

14. Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact us at: