Privacy policy
How personal data is handled when you read Worth It Shelf or contact us.
Last updated: 4 November 2026
Who is responsible for your data?
Worth It Shelf is the public-facing name of this website. The website operator and data controller is Milen Naydenov Penev, an individual based in Bulgaria. For privacy questions or to exercise your rights, email contact@worthitshelf.com.
What data we process
- Website delivery and security data: ordinary technical request data such as IP address, user agent, requested URL, timestamps, and security signals may be processed when the site is delivered through Cloudflare.
- Email correspondence: if you contact us, we receive your email address, name if supplied, message, attachments, and related correspondence.
- External and affiliate links: when you follow a link to another website, that destination may receive ordinary request and referral information and processes data under its own policy.
- Administrator data: authorised editors use a separate authenticated CMS. Its providers process login and session data needed to secure the editorial workflow. This does not apply merely because you read the public site.
The public site has no reader accounts, contact form, newsletter subscription, comments, or behavioural advertising. Our current implementation does not intentionally store public search queries or reading activity in cookies or browser storage.
Why we process data
| Purpose | Legal basis |
|---|---|
| Delivering the website, maintaining security, preventing abuse, and diagnosing faults | Our legitimate interests in operating a secure and reliable publication |
| Reading and responding to general, editorial, correction, and partnership messages | Our legitimate interests in communicating about the publication and, where relevant, taking steps requested before an agreement |
| Handling privacy requests and maintaining an appropriate record | Compliance with legal obligations and our legitimate interests in demonstrating compliance |
| Maintaining the authenticated editorial workflow | Our legitimate interests in securing and administering the publication |
Who receives data?
We use service providers only where needed to operate the site and communications. These currently include Cloudflare for hosting, delivery, security, and email routing; Google for the destination mailbox and externally served web fonts; and GitHub, Decap CMS, and Decap Turbo for the restricted editorial workflow. Providers process data under their own contractual and legal obligations. External merchants and services receive data only when you choose to follow their links.
International transfers
Some providers may process data outside Bulgaria or the European Economic Area. Where the GDPR requires a transfer safeguard, the relevant provider is responsible for using an approved mechanism, such as an adequacy decision or standard contractual clauses. Provider privacy information contains further details about its locations and safeguards.
How long we keep data
General inquiries, editorial feedback, corrections, and partnership correspondence may be retained for up to 12 months after resolution. Privacy requests and related correspondence may be retained for up to 24 months after resolution. Data may be kept longer where necessary to comply with a legal obligation, establish or defend a legal claim, or address an unresolved dispute. Infrastructure and security records are retained according to the applicable provider and account settings.
Your rights
Subject to the conditions in applicable law, you may request access to, correction of, erasure of, or restriction of your personal data; object to processing based on legitimate interests; and receive portable data where the right applies. Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing. You may also lodge a complaint with Bulgaria’s Commission for Personal Data Protection. The Commission explains its complaint procedure on its official website.
To make a request, email contact@worthitshelf.com. We may ask for information reasonably necessary to verify your identity and protect personal data from unauthorised disclosure.
Cookies and similar technologies
See our Cookie Policy for the current audit findings, strictly necessary Cloudflare cookies that may be used, and the separate administrator interface.
Changes to this policy
We may update this policy when the website, providers, or legal requirements change. The date above shows the latest revision. Material changes will be reflected here before any newly introduced processing begins where practicable.