This document covers Andrey Novakov’s public website, forms and services.
1. Who is responsible and how to contact us
Controller for processing through this website: Andrey Novakov, through the team maintaining Andrey Novakov’s website. Correspondence address: 60 rue Wiertz, B-1047 Bruxelles, Belgium. Data-protection contact: andrey.novakov@europarl.europa.eu. Use “Personal data” as the subject, or the form below. Publishing a contact does not imply appointment of a data protection officer.
2. Data, purposes and legal bases
- Enquiries and reports: name, email, subject, message and details you provide. Used to answer, coordinate and follow up your request. Basis: legitimate interest in handling communication you initiate, GDPR Article 6(1)(f); any different basis required for a specific procedure is explained separately.
- Newsletter: email, optional name, subscription date and activity. Used for the requested newsletter with consent under Article 6(1)(a).
- Security and privacy choices: session, IP address, time, actions, token and selected categories. Used to secure forms, prevent abuse and record your choices. Basis: legitimate interest in security and applicable accountability requirements.
- Rights requests: email, type, date, confirmation and outcome. Used to verify and fulfil requests under GDPR obligations.
Citizen records, case reports, visitor groups and internal work are not automatically published. Additional information is provided for a particular visit or other separate procedure. The public website does not make solely automated individual decisions producing legal or similarly significant effects.
3. Required information and what not to send
Name, email and message are needed to respond through the contact form; use another contact if you do not provide them. Newsletter names are optional. Do not submit identity numbers, identity-document details, health information, other people’s political opinions or children’s data unless genuinely needed and supported by an appropriate basis. The public form is not a specialist secure channel for sensitive documents. Agree a suitable transfer method with the team beforehand.
4. Retention periods and criteria
Data is retained only for as long as needed for its purpose. Enquiries and linked cases are reviewed after closure and retained only as needed for follow-up, accountability or legal claims. Active newsletter subscriptions are retained until withdrawal; a limited record of the choice may remain to demonstrate consent and honour opt-outs. Technical logs are periodically reviewed and limited to security needs; a specific incident may justify longer retention. Rights requests and consent records are retained as needed for accountability and protection of rights.
Sessions allow up to 60 minutes of inactivity and a maximum lifetime of 12 hours, depending on configuration; remembered office sign-in tokens last up to 30 days. Browser cookie choices are renewed after 180 days or a policy update. Recovery copies may temporarily contain deleted records; access is restricted and completed erasures should be reapplied following restoration.
5. Recipients and international transfers
Access is limited to authorised team members with a work-related need and providers handling hosting, technical maintenance and email. Information may be supplied to a competent authority under an applicable legal obligation, or to a recipient you identify when coordinating a case. We do not sell data or provide it for third-party advertising lists. External websites and social networks receive data when you visit them under their own rules. If a particular service requires transfer outside the EEA, an applicable basis and safeguards are required; ask the team about specific recipients and safeguards.
6. Security and statistics
Measures include restricted office access, protected forms, file checks, sign-in codes and encryption of chat messages and visitor identifiers. No system removes every risk. The aggregate page-load counter does not count unique people or create individual profiles. IP addresses in consent records or logs may be personal data and are not described as anonymous. See the cookie policy for browser preferences.
7. Your rights
Subject to applicable conditions, you can request information, access, rectification, erasure, restriction, objection and portability. Consent may be withdrawn at any time without affecting earlier lawful processing. For newsletter withdrawal, email the contact with “Unsubscribe”. Refusal does not restrict public website access. Erasure is not unconditional: legal retention or protection of rights may apply. A copy request does not entitle you to other people’s data.
8. Making and reviewing a request
Use the form below or contact email. Online copy or erasure requests require a single-use email confirmation and team review; confirmation does not immediately delete data. Reasonable identity doubts may require a limited additional check. Responses are provided without undue delay, normally within one month; complexity or multiple requests may justify two further months, with notice during the first month. Refusals explain the reasons and remedies. Exercising rights is normally free of charge.
9. Complaints, updates and references
You may complain to the Bulgarian Commission for Personal Data Protection or another competent supervisory authority without contacting the team first, and seek a judicial remedy. This policy is updated as services change. Legal framework: Regulation (EU) 2016/679. Practical guidance: European Commission — information for individuals.