1. Who processes your data

The controller of your personal data is [company — to be confirmed]. We process data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and the Personal Data Protection Act.

We are not required to appoint a data protection officer. For all questions about your personal data, write to us at Tsenovgroup@gmail.com.

2. What data, why and how long we keep it

We process only the data needed for the relevant purpose.

Contact form, e-mail and phone

Data	first name, surname, e-mail, phone, content of the message, the consent checkbox and the date of sending
Purpose	to reply to your enquiry and, if needed, send you a quote
Legal basis	steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR) and our legitimate interest in replying to enquiries (Art. 6(1)(f))
Retention	1 year from the last correspondence, unless the enquiry leads to a contract – in which case we keep the data for as long as needed to perform it and in accordance with the Accountancy Act

Statistics (Google Analytics) – with consent only

Data	identifiers in cookies, browser and device data, approximate location (country and city), pages visited, where you came to the site from and actions on the site
Purpose	to understand how many people visit the site, which pages they view and how to improve it
Legal basis	your consent (Art. 6(1)(a) GDPR and Art. 4a of the Electronic Communications Act), given through the cookie banner
Retention	consent is valid for 6 months, after which we ask you again; data in Google Analytics is kept for [2 or 14 months — according to the GA4 setting, to be confirmed] and is then deleted automatically; the lifetimes of individual cookies are in the Cookie Policy

Google Analytics 4 is loaded only if you click “Accept all” or enable the “Statistics” category. The service is provided by Google Ireland Limited, which processes the data on our behalf and on our instructions. Google Analytics 4 does not record or store your IP address. Data may be transferred to Google LLC in the USA on the basis of the EU–U.S. Data Privacy Framework, under which Google is certified. You can withdraw your consent at any time from Cookie settings, without affecting the lawfulness of processing before the withdrawal.

Website security

Data	IP address, date and time, address visited, browser data, login attempts to the administration area
Purpose	protecting the site from attacks, spam and abuse, and fixing technical problems
Legal basis	legitimate interest in keeping the site secure and working (Art. 6(1)(f) GDPR)
Retention	server and security logs – usually up to 90 days, unless they are needed to investigate a specific incident

Map on the “Contact” page

The “Contact” page has an embedded Google Maps map. When the page loads, your browser connects to Google's servers and Google receives your IP address and browser data. Processing by Google is governed by Google's privacy policy.

Social media profiles

If you write to us on our social media profiles (Facebook and Instagram), we process the data from the conversation in order to reply to you. For the statistics of our pages, Meta is a joint controller with us.

We do not take decisions based solely on automated processing that have legal effects for you. We do not sell personal data.

3. Who we share data with

We share data only as far as necessary, with:

• the hosting provider of the website (the servers are in the EU);
• Google (Gmail) – this service is used to send and receive the e-mails of the website and of Tsenovgroup@gmail.com;
• Google Ireland Limited – for Google Analytics, only with consent to statistics cookies;
• Google – for the map on the “Contact” page;
• the website security provider (the site's security plugin) – IP addresses in case of attack attempts;
• public authorities (the National Revenue Agency, the CPC, courts, etc.), where we are required to by law.

Providers that process data on our behalf are bound by a contract and by our instructions.

4. Transfers outside the EU

Some providers (Google, Meta) or their affiliates are in the USA. Transfers are made on the basis of the European Commission's adequacy decision under the EU–U.S. Data Privacy Framework, for companies certified under it, or on the basis of standard contractual clauses approved by the European Commission.

5. Your rights

To exercise your rights, write to us at Tsenovgroup@gmail.com or by letter to our address. We reply within 1 month; for complex requests the period may be extended by a further 2 months, and we will let you know. We may ask you to confirm your identity. Exercising your rights is free of charge.

6. Are you required to give us data

You do not need to give us personal data in order to browse the website.

The mandatory fields in the contact form are needed so that we can reply to you.

Any consent we ask of you is voluntary, and refusing it does not limit your use of the website.

7. Security

The website works entirely over a secure connection (HTTPS). Only authorised persons have access to personal data. We use a firewall, login attempt limiting and regular backups. Nevertheless, no method of transmission over the internet is completely secure. In the event of a security breach that creates a high risk for you, we will notify you without delay.

8. Children

The website is not intended for persons under 14 and we do not knowingly collect their data. If you believe a child has given us data, write to us and we will delete it.

9. Cookies

How we use cookies and how to change your choice is described in the Cookie Policy.

10. Changes

We may change this policy when we change the way we process data or when the law changes. The current version is always on this page, with the effective date at the top.