Privacy Policy

1. Introduction

This Privacy Policy describes how Dessira collects, uses, stores and protects the personal data of its users in compliance with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act. By using the platform, you agree to the terms below.

Your rights under GDPR

Under the GDPR, you have the following rights:

• Right of access — to obtain a copy of the personal data we hold about you.
• Right to rectification — to correct inaccurate or incomplete data.
• Right to erasure — “the right to be forgotten”. You may request deletion of your data at any time.
• Right to restrict processing — to ask us to temporarily stop processing your data.
• Right to portability — to receive your data in a structured, machine-readable format.
• Right to object — to object to processing based on legitimate interest.
• Right to withdraw consent — at any time, without affecting the lawfulness of prior processing.
• Right to lodge a complaint — with the Bulgarian Data Protection Commission (CPDP) — www.cpdp.bg

To exercise your rights, please contact us at privacy@dessira.net. We will respond within 30 days.

2. What data we collect

• Registration data: name, email address, password (encrypted), account type (user or creator).
• Profile data: photos, description, city, age, phone, and other information voluntarily provided by creators.
• Verification data: photo of a government-issued ID (front and back), selfie holding the document, IBAN and account-holder name — collected solely for verification and payouts.
• Payment data: token transaction history, purchases and withdrawals. Card data is processed by Verotel B.V. (FlexPay) and is not stored on our servers.
• Technical data: IP address, browser type, operating system, date and time of access.
• Communication data: messages sent through the platform.

3. How we use your data

• To provide and improve the platform's services.
• To verify creator identity.
• To process payments and payouts.
• To moderate content and profiles.
• To communicate with users about their accounts.
• To prevent fraud and abuse.
• To comply with legal requirements.

4. Data storage and security

• Personal data is stored on secure servers with encrypted connections (SSL/TLS).
• Passwords are stored hashed and never kept in plain text.
• Verification documents are stored encrypted and used only for verification purposes.
• Access to personal data is restricted to authorized administrators only.
• Data is retained for the duration of the account's activity, plus an additional period as required by law.

5. Sub-processors — third parties processing data on our behalf

We use the following sub-processors to provide the service. All have signed DPAs (Data Processing Agreements) and comply with GDPR. The data we share with each is limited to what is strictly necessary.

We do not sell, rent, or share personal data with third parties for marketing purposes. Government authorities may receive data only under a lawful basis or court order.

6. Cookies

We use three categories of cookies. You can manage your consent via the “Cookie settings” link in the footer.

• Strictly necessary — session, authentication, CSRF protection. Without these the site cannot function. No consent required.
• Analytics — Sentry for error and performance monitoring. Activated only on explicit opt-in.
• Marketing — not currently used; the option is reserved for future use.

7. How to exercise your rights

Under the GDPR and Bulgarian law you have the following rights:

• Access and portability (Art. 15 / Art. 20) — download all your data as a JSON file from Dashboard → Profile → Download my data.
• Erasure / “the right to be forgotten” (Art. 17) — delete your account from Dashboard → Profile → Delete account. Requires password and confirmation. Personal data is anonymized immediately. Financial records are kept for tax purposes (10 years per Bulgarian Tax Code art. 38).
• Rectification (Art. 16) — edit your profile directly.
• Objection / restriction (Art. 21 / Art. 18) — write to privacy@dessira.net.
• Withdrawal of consent — via the “Cookie settings” button or by deleting your account.
• Complaint to the CPDP — www.cpdp.bg

For requests that cannot be served automatically, write to privacy@dessira.net. We respond within 30 days.

8. Account deletion

• Users may request account deletion at any time.
• On deletion, personal data is removed within 30 days, unless retention is required by law.
• Published content is removed together with the account.

9. Changes to this policy

Dessira reserves the right to update this Privacy Policy. Material changes will be communicated through the platform. Continued use of the platform after a change constitutes acceptance of the updated policy.