How we handle your data.

The data controller under Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act is:

Big Dreams Group LTD ("BDG", "we", "us"), entered in the Commercial Register and the Register of Non-Profit Legal Entities kept by the Registry Agency under EIK 206986388, VAT No. BG206986388, registered office and address of management: 42 General Mihail D. Skobelev Blvd., floor 1, apt. 1, Sofia, Bulgaria. Contact: [email protected].

BDG is not required to appoint a Data Protection Officer (DPO) under Art. 37 GDPR. For any data-related questions, email [email protected].

We only collect what we need, and only when we have a basis to do so. Grouped by source:

Contact form

Name, email address, phone (optional), message content, inquiry type, IP address and user-agent. The data is stored and sent to the team according to the need indicated in the enquiry itself.

Gregor the Talasum (AI assistant)

The messages you type in the chat with the Talasum, the page you write from, IP address and user-agent, plus name, email and phone if you choose to leave them through the in-chat form. Conversations are stored in our database so we can respond to your inquiry. The Talasum runs on BDG's own infrastructure, and conversation content is not sent to external AI providers.

Dreamer Pond

Email address, name (optional), country, dream title and body, IP address and user-agent. Approved dreams are published publicly, with the name you chose or anonymously if you opted for that.

Job applications

Name, email address, location, skills and accomplishments, the CV and cover letter you upload, IP address and user-agent. If we invite you to the practical assignment, also your answers, the progress saved while you work and when you opened and submitted it. Only the BDG team running the selection sees them.

Meeting bookings

Name, email address, phone (optional), the topic and any notes you add, the time and language you chose, IP address and user-agent. The booking is kept in our own meeting system, which sends the confirmation and the calendar invitation.

Dreamer Portal (client area)

Name, email address, preferred language, project-related information, session cookie for sign-in. Access is invite-only.

Analytics

Anonymous usage data: page views, time on page, aggregate behaviour, and session recordings. Only activated after your consent via cookie banner. If you arrived through one of our ads, also whether the visit led to an enquiry.

Technical logs

IP address, user-agent, URL, time and HTTP status: standard server logs for security and diagnostics.

We do not collect special categories of personal data (health, biometric, political or religious beliefs, etc.) and we do not perform automated decision-making or profiling.

We process your data on one of the following legal bases under Art. 6(1) GDPR:

• Consent (Art. 6(1)(a)): submitting a contact form, chatting with the Talasum and leaving contact through it, publishing a dream in Dreamer Pond, using analytics and advertising-measurement cookies. You can withdraw consent at any time.
• Contract performance (Art. 6(1)(b)): Dreamer Portal access and client project delivery, and steps taken at your request before a contract: job applications, the practical assignment and meeting bookings.
• Legal obligation (Art. 6(1)(c)): accounting and tax documentation where a contract exists.
• Legitimate interest (Art. 6(1)(f)): site security (technical logs), anti-spam and abuse protection, infrastructure maintenance, and the establishment, exercise or defence of legal claims.

Providing your data is voluntary, but without the fields marked as required we cannot reply to your enquiry or deliver the service.

We provide data to the following recipients. Where applicable, we have concluded data processing agreements under Art. 28 GDPR with the providers that process data on our behalf, and they act only on our instructions. Where a recipient is a separate controller, this is stated expressly:

Traffic delivery and protection

Cloudflare, Inc. (USA) carries all traffic to the site, encrypts the connection (HTTPS) and protects it from attacks and automated requests. Its Turnstile check protects the Dreamer Pond, job application and meeting booking forms from spam. Cloudflare processes the IP address and the technical data of every request, and for Turnstile also browser signals. Cloudflare also uses these signals to improve its bot detection, and for that purpose it acts as a separate controller.

Email service provider

SendLayer, LLC (USA) sends our transactional email: replies to enquiries, confirmations, notifications and Dreamer Portal sign-in links. It processes the email address and the content of the message.

Web analytics

Google Ireland Limited processes the data from Google Analytics 4: pages visited, traffic source, device type and a browser identifier. It loads only with your consent.

Behaviour analytics

Microsoft Ireland Operations Limited processes the data from Microsoft Clarity: session recordings, heatmaps and statistics on how the interface is used. It loads only with your consent.

Advertising measurement

OpenAI Ireland Limited receives the data from the OpenAI pixel when a visit from one of our ads in ChatGPT leads to an enquiry: the ad click reference, a random browser identifier and a signal that an enquiry was sent. The signal may also include an irreversibly hashed (pseudonymised) version of the email and name you entered, used to match the enquiry to the ad. The content of your message is never shared. In line with OpenAI's terms for its advertising tools, BDG and OpenAI Ireland Limited each act as an independent controller: BDG for placing the pixel and sending the signal, OpenAI for its own processing of these data, under its privacy policy. It loads only with your consent.

The website and its database run on BDG's own servers in the European Union. Gregor the Talasum also runs on BDG's own infrastructure. Beyond the advertising measurement described above, we do not share your data with third parties for marketing, and we do not sell it.

We may disclose data to competent authorities when legally compelled (court order, prosecutor's or law enforcement request).

The site and its database are hosted on servers in the European Union. Traffic to the site passes through the network of Cloudflare, Inc. (USA), and transactional email is sent through SendLayer, LLC (USA). The web analytics, behaviour analytics and advertising measurement providers in §04 are European companies of the Google, Microsoft and OpenAI groups and may transfer data to their parent companies in the USA: Google LLC, Microsoft Corporation and OpenAI OpCo, LLC. Where such a transfer takes place, it is protected by one of the following safeguards, as applicable:

• EU-U.S. Data Privacy Framework: Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on its adequate level of protection, for the companies certified under the framework.
• Standard Contractual Clauses (SCCs): under Commission Implementing Decision (EU) 2021/914, for the remaining cases.

We use a minimal set of cookies and similar technologies (the browser's local and session storage). The necessary ones always work. Analytics and advertising measurement are off by default and switch on only after you consent through the banner:

• Necessary: to sign in to Dreamer Portal, to open online proposals and assignments, to store your cookie choice and to keep the interface state. No consent needed.
• Analytics (optional): Google Analytics 4 and Microsoft Clarity measure site traffic and how the site is used, including session recordings. Only activated after your explicit consent.
• Advertising measurement (optional): when you reach the site through one of our ads in ChatGPT, the OpenAI pixel keeps a reference to that click and a random browser identifier in first-party cookies, so we can tell whether the visit led to an enquiry. Only activated together with the analytics cookies, after your consent.

Each cookie, its provider, purpose and lifetime:

You can change or withdraw your consent at any time through Cookie settings at the bottom of every page, as easily as you gave it. Withdrawal stops the analytics and advertising tools from then on and does not affect the lawfulness of processing before it. Cookies that are already set can be deleted in your browser settings.

You can also manage cookies in your browser settings. Blocking them won't break the site but may limit some features (e.g. staying signed in between visits).

Contact inquiries

24 months from last communication

Job applications and assignments

Up to 6 months after the selection ends, unless you agree to a longer period (Art. 25k of the Personal Data Protection Act)

Meeting bookings

As contact inquiries: 24 months from last communication

Talasum conversations

12 months; if you leave contact, as a contact inquiry

Dreams in Dreamer Pond

Indefinitely, until you request removal

Client accounts & data

Contract duration and 5 years after it ends

Accounting & tax documents

10 years under the Accountancy Act, counted from the beginning of the following reporting year

Dreamer Portal sessions

Up to 30 days since last activity

Server logs

90 days

Analytics

Up to 14 months, per the analytics providers' policies.

Advertising measurement

Ad click reference: up to 30 days. Browser identifier: up to 12 months.

Once these periods expire, the data are deleted or anonymised, unless longer storage is needed for a legal claim or is required by law.

Under GDPR you have the following rights regarding your personal data:

• Access (Art. 15): receive a copy of the data we hold about you.
• Rectification (Art. 16): correct inaccurate or incomplete data.
• Erasure (Art. 17): the "right to be forgotten" in specific cases.
• Restriction of processing (Art. 18): in specific cases.
• Portability (Art. 20): receive your data in a structured, machine-readable format.
• Objection (Art. 21): to processing based on legitimate interest, and at any time to processing for direct marketing (Art. 21(2) and (3)).
• Withdraw consent (Art. 7(3)): at any time, without affecting the lawfulness of processing before withdrawal.
• File a complaint with the supervisory authority: Commission for Personal Data Protection (KZLD): 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg, [email protected], +359 2 915 3 518.

To exercise any of these rights, email [email protected]. We reply within one month as required by Art. 12(3) GDPR. For complex or numerous requests this period may be extended by two further months, and we will tell you if it is. If we have reasonable doubts about your identity, we may ask for additional information to confirm it.

We apply technical and organisational measures proportionate to the risks to data subjects' rights and freedoms:

• HTTPS / TLS encryption on all traffic
• Passwords stored only as an irreversible hash
• Signed session cookies
• Access to personal data only for authorised team members, according to their role
• A record of changes made to the data
• Regular database backups

If a personal data breach occurs, we notify the Commission for Personal Data Protection (KZLD) within 72 hours of becoming aware of it, as required by Art. 33 GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we also notify you without undue delay under Art. 34 GDPR.

Our services are not intended for persons under 18. We don't knowingly collect data from persons under 18. If we learn that a person under 18 has provided us personal data without parental or guardian consent, we will delete the data.

We may update this policy. Material changes will be announced on the homepage and, for Dreamer Portal accounts, by email to registered users. The date at the top always reflects the latest revision.

This policy is published in Bulgarian and English, and both versions have the same content. If they differ, or a provision is unclear, the Bulgarian version prevails.

Questions, rights requests, or feedback:

[email protected]

Big Dreams Group LTD · EIK 206986388 · VAT No. BG206986388
Entered in the Commercial Register kept by the Registry Agency
42 General Mihail D. Skobelev Blvd., floor 1, apt. 1, Sofia, Bulgaria