Privacy and Personal Data Protection Policy of "Golden Goose Ads" Ltd

Effective Date: 20 October 2026

The protection of personal data and the privacy of visitors to our website, our clients, and business partners are of paramount importance to "Golden Goose Ads" LTD. This Privacy and Personal Data Protection Policy is intended to inform you in a transparent, clear, and comprehensible manner about what personal data we collect through the website www.goldengooseads.com and in communications with us, the specific purposes for which we use it, the legal bases on which we process it, the applicable retention periods, to whom your data may be disclosed, and what rights you have under applicable data protection law.

The processing of personal data by the Company is carried out in strict compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation – GDPR), the Bulgarian Personal Data Protection Act (BPDPA), the Bulgarian Electronic Commerce Act (BECA), and applicable acts of Bulgarian and European Union law.

1. Information About the Data Controller and the Company's Role

"Golden Goose Ads" LTD, UIC (EIK) 208869184, having its registered office and business address at: village of Ablanitsa, postal code 2932, 28 Vasil Levski Str., Republic of Bulgaria; telephone: +359 89 4299307; email: dg.digitalm@gmail.com; website: www.goldengooseads.com, is a data controller (hereinafter also referred to as the "Company", "we", "us", or "our") and is responsible for compliance with the provisions of Regulation (EU) 2016/679 (GDPR) when processing the personal data of visitors to the Site, individuals submitting inquiries, direct clients, and subscribers.

The Company's role as a Data Processor: Where, in connection with the provision of digital marketing services, advertising campaign management (PPC / Social Ads), email marketing, lead generation, or custom audience building, the Company processes contact databases or personal data on behalf of and under the instructions of its client (B2B), "Golden Goose Ads" LTD acts as a Data Processor within the meaning of Art. 4, item 8 and Art. 28 of the GDPR, while the client retains the capacity of Data Controller. In such cases, the purposes, scope, and conditions of processing shall be governed by an individual Data Processing Agreement (DPA) executed between the parties.

2. What Data Do We Process, for What Purposes and on What Legal Basis?

We process personal data only when necessary for the provision of our services and for compliance with statutory requirements, adhering to the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, and storage limitation.

For the performance of a contract or in order to take steps prior to entering into a contract (Art. 6(1)(b) of the GDPR): Data: first and last name, email address, telephone number, company name and job title, content of the submitted inquiry, project requirements, budget or estimated budget (where voluntarily provided), preferred services, and correspondence history. Purpose: to respond to your inquiry submitted via the contact form on the Site, by email, or by phone; to prepare an individual commercial proposal / Statement of Work (SOW); and to enter into and perform a contract for the provision of our digital services (including SEO, advertising campaign management, graphic and web design, video post-production, etc.).
For compliance with legal obligations (Art. 6(1)(c) of the GDPR): Data: data from accounting and payment documents (names, Personal Identification Number [EGN] / Foreigner Personal Number [LNCh] where an invoice is issued to an individual, billing address, bank account details / IBAN, payment reference and amount, order / offer number). Purpose: for compliance with legal obligations under applicable accounting and tax legislation (including issuing, reporting, and storing invoices pursuant to the Bulgarian Accountancy Act and the Tax and Social Security Procedure Code), obligations under the Bulgarian Consumer Protection Act (handling complaints and distance contract withdrawals), and assisting competent public authorities.
For our legitimate interests (Art. 6(1)(f) of the GDPR): Data: location data (IP address), server technical logs, device type and operating system, browser type and version, date and time of access, as well as business contact details of representatives and employees of our corporate clients (B2B). Purpose: to ensure website security and protection against malicious attacks; to diagnose technical issues; to establish, exercise, or defend the legal rights and claims of the Company in case of disputes; and to conduct standard commercial business communications with corporate representatives.
Based on your consent (Art. 6(1)(a) of the GDPR): Data: data collected through analytics and marketing cookies and similar tracking technologies (online identifiers, remarketing cookies, clicks, visited pages), as well as email address when subscribing to our newsletter. Purpose: to analyse website traffic and display relevant ads, as well as to send regular marketing messages and informative content (newsletter). Consent for these purposes is granted and managed via the cookie consent banner on our website pursuant to our Cookie Policy, or respectively via a dedicated subscription form.

3. Special Categories of Data and Individuals Under 18

(1) The Company does not collect or process special categories of personal data (sensitive data) within the meaning of Art. 9 of the GDPR, revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, data concerning health, or data concerning a natural person's sex life or sexual orientation. Users are kindly requested not to submit such data through the contact form or in communications with us.
(2) The services of the website are intended for legally capable individuals aged 18 and over and for legal entities. The Company does not knowingly collect personal data from minors. If a parent or legal guardian discovers that a minor under 18 has provided personal data without parental consent, please contact us immediately so that we can take prompt steps to delete such data.

4. Specific and Future Processing Activities (Applicable Upon Activation)

A. Marketing Communications and Newsletter – applicable upon activation: Where a user has expressly subscribed to receive our marketing newsletter, promotional offers, or educational materials via a subscription form, the processing of the email address is based on explicit consent (Art. 6(1)(a) of the GDPR). Consent is entirely voluntary, and refusing to grant it does not affect the ability to use the website or order services. The user may withdraw consent at any time via the unsubscribe link provided in every marketing email, or by emailing dg.digitalm@gmail.com.
B. Artificial Intelligence Platform / Processing of User Prompts – applicable upon activation: In the event that artificial intelligence functionalities (such as an AI assistant, automated text/creative generation, or interactive conversational interface) are enabled on the website or within the provided services, the Company may process: (a) text prompts entered by the user; (b) generated responses and outputs; and (c) technical session metadata and conversation history. Processing is carried out to deliver the requested functionality (Art. 6(1)(b) of the GDPR) and improve service quality under strict confidentiality standards. Users are instructed not to enter third-party personal data or confidential business information into prompts. Prompt data is not shared with third parties for independent purposes, except with technical AI model providers under strict GDPR data processing agreements.
C. Payment Service Providers and Online Payments – applicable upon activation: The primary payment method accepted by the Company is bank wire transfer. In the event that online credit/debit card payment functionalities are integrated on the website via a licensed payment service provider (payment gateway), transaction data processing is carried out for contract performance and payment settlement (Art. 6(1)(b) of the GDPR). The Company does not collect or store full payment card details (card number, CVC/CVV code, expiration date) on its servers; such data is entered and processed in an encrypted format directly within the secure environment of the licensed payment service provider in accordance with PCI-DSS standards.
D. User Account Registration: At present, the website does not support user account registration and does not require creating a profile to browse content or submit an inquiry.

5. With Whom Do We Share Your Data? (Categories of Recipients)

We do not sell or rent your personal data. We may share it only with trusted partners (data processors or independent controllers) to carry out our business operations, subject to a valid legal basis and contractual data protection safeguards:

Hosting and server infrastructure providers (SiteGround): to ensure technical reliability, performance, and cybersecurity of the website.
Accounting firms and financial/legal consultants: for compliance with statutory accounting, tax reporting obligations, and legal advisory services.
Banking institutions and payment service providers: in connection with administering, processing, and recording cashless payments via bank wire or virtual POS terminals.
Software solution, email, and technical support providers: for managing client communications, spam protection, and cybersecurity maintenance.
Analytics and digital advertising technology providers (e.g., Google LLC, Meta Platforms, Inc.): when utilizing web analytics tools (Google Analytics) and tracking tags/pixels (Google Ads Tag, Meta Pixel, etc.) for statistical evaluation and campaign performance measurement, strictly upon your prior explicit consent managed via cookie settings.
AI technology providers (upon activation): solely for the technical processing of requests under strict GDPR-compliant confidentiality terms.

Data may also be disclosed to competent state and law enforcement authorities (courts, prosecutor's office, National Revenue Agency, Consumer Protection Commission, Commission for Personal Data Protection, police) upon official request on a valid statutory legal basis pursuant to Bulgarian law.

6. International Data Transfers Outside the European Economic Area (EEA)

(1) As a general rule, the Company stores and processes personal data within the Republic of Bulgaria, European Union (EU) Member States, and the European Economic Area (EEA).
(2) Certain external providers of digital, cloud, analytics, marketing, or AI services may operate technical infrastructure or process data in third countries outside the EEA (e.g., in the United States). In such cases, international data transfers are performed strictly in compliance with Chapter V of the GDPR and on the basis of a valid legal transfer mechanism guaranteeing an adequate level of data protection: 1. an Adequacy Decision adopted by the European Commission regarding the third country (including the EU-US Data Privacy Framework); 2. executed Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented where necessary by technical and organizational security measures; 3. applicable statutory derogations under Art. 49 of the GDPR (e.g., explicit consent of the data subject).

7. For How Long Do We Store Your Data?

The Company stores personal data only for the period strictly necessary to achieve the purposes for which it was collected, or to comply with statutory retention requirements:

Data processed for contract performance – for the duration of the contract and for up to 5 (five) years following its termination (the general statutory limitation period under the Bulgarian Obligations and Contracts Act for defending against legal claims).
Data from accounting and tax records – for 10 (ten) years, starting from 1 January of the reporting period following the reporting period to which they relate, pursuant to Art. 12 of the Bulgarian Accountancy Act.
Data from contact inquiries (which did not lead to the conclusion of a contract) – for up to 12 months (1 year) after concluding correspondence.
Data for marketing newsletter subscriptions – until consent is withdrawn by the subscriber.
Data from user prompts in AI features (if activated) – for the period of service use or up to 5 years, unless the user requests earlier deletion.
Technical security logs – for a duration aligned with IT security purposes and abuse prevention.
Data collected via cookies – pursuant to the specific retention periods specified in our Cookie Policy.

Upon expiration of the applicable retention period, data is erased, securely destroyed, or irreversibly anonymized for statistical purposes.

8. Your Rights Under the GDPR and the Bulgarian LPPD

You have the following rights regarding your personal data:

Right of access: to obtain confirmation as to whether your personal data is being processed, information regarding the processing purposes, categories of data, recipients, and a copy of the data undergoing processing.
Right to rectification: to obtain the rectification or completion of inaccurate or incomplete personal data.
Right to erasure ("right to be forgotten"): to request the erasure of your personal data under certain conditions (e.g., data is no longer necessary, consent is withdrawn and there is no other legal basis, unlawful processing).
Right to restriction of processing: to obtain restriction of processing where data accuracy is contested, or during verification of legitimate grounds.
Right to data portability: to receive your personal data in a structured, commonly used, and machine-readable format and transmit it to another controller, where processing is based on consent or contract and is carried out by automated means.
Right to object: to object to data processing based on legitimate interests. Where you object to processing for direct marketing purposes, processing shall cease immediately and unconditionally.
Right to withdraw consent: you may withdraw your consent for data processing (e.g., for marketing cookies or newsletters) at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Rights in automated decision-making: right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

To exercise your rights, please contact us by email at: dg.digitalm@gmail.com or by post at the Company's registered address. The request should contain identifying information of the applicant, a description of the request, preferred form of communication, and signature, pursuant to Arts. 37b and 37c of the Bulgarian Personal Data Protection Act (LPPD). We will respond to your request free of charge and without undue delay within 1 (one) month of receipt.

9. Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of your personal data violates the provisions of the GDPR or the LPPD, you have the right to lodge a complaint with the competent supervisory authority in the Republic of Bulgaria – the Commission for Personal Data Protection (CPDP / КЗЛД), or before the competent administrative court:

Commission for Personal Data Protection (CPDP / КЗЛД), Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Republic of Bulgaria; Information and Contact Centre – Tel.: +359 2 915 3518; Email: kzld@cpdp.bg; Website: www.cpdp.bg

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access (including SSL connection encryption, strict access controls, firewalls, and regular security patching).

Access to your personal data is restricted solely to authorized personnel bound by statutory and contractual confidentiality obligations.

11. Cookies and Relationship with the Cookie Policy

The website www.goldengooseads.com uses cookies and similar technologies necessary for its secure operation, traffic analytics, and advertising content personalization. Strictly necessary cookies are loaded automatically, while analytics and marketing cookies are activated only upon explicit consent granted via the cookie consent banner. Detailed information regarding categories of cookies, their lifespan, and third-party providers is available in our Cookie Policy.

12. Amendments and Updates to This Policy

The Company reserves the right to update and amend this Privacy and Personal Data Protection Policy to reflect changes in legislation, the introduction of new technical features, or modifications in our service offering. All updates will be published on the website with an updated effective date.

Back to the homepage