Privacy and data protection (GDPR)

Privacy policy

Last updated 27 October 2026

This policy explains what personal data we collect through this website, why, and what your rights are under the General Data Protection Regulation (EU) 2016/679 (GDPR) and Bulgarian law.

1. Who is responsible for your data

The controller of personal data collected through theglowingoceans.com is Coco Agency, Lavele 18A, 1000 Sofia, Bulgaria, company registration number (UIC) 202075523. For any question about your data, or to use your rights, write to dan@cocoagency.bg.

2. The short version

We use no analytics, no advertising, no tracking and no social-media plugins.
We set no cookies.
All files of this site, including its typefaces, pictures, films and music, are delivered from our own web space. Your browser does not contact other companies when you visit.
We only receive personal data when you choose to write to us.

3. What we collect, why, and on what legal basis

When you write to us (for example with the “Reserve your copy”, “Ask for a signed copy”, “Enquire privately”, “Book the exhibition” or “Ask for dates” buttons, which open an email to us): your name, email address, and what you write. We use this to answer you, to keep your reservation and to send you the price and release date you asked for. Legal basis: steps you ask us to take before a contract, and carrying out a contract (Art. 6(1)(b) GDPR); and our legitimate interest in answering messages (Art. 6(1)(f) GDPR).

If you buy from us: the details needed to deliver and invoice the order, and the records that tax and accounting law require us to keep. Legal basis: contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).

When you visit: our web host automatically records technical data that every browser sends, such as your IP address, the date and time, the page requested and your browser type, in order to deliver the site and keep it secure. Legal basis: our legitimate interest in a working and secure website (Art. 6(1)(f)). We do not use these records to identify you.

4. Storage on your device

This website stores two small settings in your browser’s local storage, never in a cookie and never sent to us: whether you switched the music on or off (oceanSound), and that you closed the privacy notice (go-notice). They exist only so that the site remembers your choice, and you can delete them at any time by clearing your browser’s website data. No consent is needed for settings that only carry out a function you have asked for, but we tell you about them here so that you know.

5. Who receives your data

We do not sell your data and do not pass it on for anyone else’s marketing. It is processed on our behalf only by the providers we need: our web host, GoDaddy; our email provider; and, for orders, the carrier and our accountant. Each is bound to protect it. Where a provider processes data outside the European Economic Area, this happens under the safeguards the GDPR requires, such as the European Commission’s standard contractual clauses.

6. How long we keep it

Messages and reservations: as long as needed to answer and complete your request, and then for up to two years after our last contact, unless you ask us to delete them sooner.
Order and invoice records: for the period required by Bulgarian tax and accounting law.
Server records kept by our host: for a short period, for security only.

7. Your rights

Under the GDPR you have the right to access your data, to have it corrected, to have it deleted, to restrict its use, to receive it in a portable form, and to object to its use based on legitimate interest. Where you gave consent, you can withdraw it at any time. Write to dan@cocoagency.bg; we will answer within one month.

You also have the right to complain to a data protection authority. In Bulgaria this is the Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg; you may also turn to the authority of the EU country where you live.

8. Children

Our book is made for readers of all ages, but this website does not knowingly collect personal data from children. If you are under 16, please ask a parent or guardian to write to us for you.

9. Security and changes

The site is delivered over an encrypted connection (https). We may update this policy when our website or the law changes; the date at the top shows the current version.