Privacy Policy — Balkanova Global

1. Data controller

The controller of your personal data is “Balkanova Global” EOOD, a single-member limited liability company incorporated under Bulgarian law, UIC 208868246, VAT ID BG208868246, entered in the Commercial Register and Register of Non-Profit Legal Entities kept by the Registry Agency of Bulgaria, with registered office at 42 G. S. Rakovski St., entrance A, Oborishte district, 1202 Sofia, Bulgaria (“Balkanova Global”, “we”, “us”).

For any question about this policy or the processing of your personal data, please write to info@balkanovaglobal.com. Given the nature and scale of our processing, we are not required to appoint a Data Protection Officer (Art. 37 GDPR); all privacy requests are handled at the address above.

2. Personal data we process and where it comes from

Contact form: full name, company, business email address, country, area of interest, the content of your message and your confirmation that you have read this policy. The form also contains technical anti-spam fields (a timestamp and a hidden field that must stay empty) that do not identify you.
Email and business correspondence: your email address, name, the details in your signature (such as position, company and telephone number), the content of your messages and any attachments you choose to send us.
Business relations: identification and contact details of representatives and employees of our customers, suppliers and partners (name, position, business email and telephone), together with the information needed to prepare offers, orders, deliveries and invoices.
Technical data: when you visit the website, our hosting provider automatically records standard server log data (IP address, date and time of the request, requested page, browser type and version, referring page and HTTP status code). When you submit the contact form, a pseudonymised (hashed) form of your IP address is kept temporarily to prevent abuse.
Your cookie choice: your consent preferences are stored only in your own browser (see our Cookie Policy) and are not sent to us.

We collect these data directly from you. Where you act on behalf of an organisation, we may also receive your business contact details from your employer or colleagues, or obtain them from public sources such as commercial registers and company websites. Please do not send us special categories of personal data (for example, data concerning health) – we do not need them.

3. Purposes and legal bases

Replying to your request and preparing offers – taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR). Where you contact us on behalf of a company, the legal basis is our legitimate interest in communicating with business contacts and developing commercial relations (Art. 6(1)(f) GDPR).
Managing business relations (negotiation, orders, deliveries, invoicing, after-sales communication) – performance of a contract (Art. 6(1)(b)) or, for representatives of our business partners, our legitimate interest in running the business relationship (Art. 6(1)(f)).
Security of the website and prevention of spam and abuse (server logs, rate limiting of the contact form) – our legitimate interest in keeping our systems secure and available (Art. 6(1)(f)).
Compliance with legal obligations, for example accounting and tax obligations if a contract follows, and responses to lawful requests from public authorities – Art. 6(1)(c) GDPR.
Establishment, exercise or defence of legal claims – our legitimate interest (Art. 6(1)(f)).
Remembering your cookie choice – our legitimate interest in respecting your preferences (Art. 6(1)(f)); this storage is strictly necessary and exempt from consent under Art. 5(3) of Directive 2002/58/EC.
Optional analytics – no analytics tool is currently in use. Should we introduce one, it would only run after your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time, and this policy would be updated beforehand.

Where we rely on legitimate interests, we have balanced them against your rights and freedoms; you may ask us for more information about this assessment. We do not send newsletters or marketing communications without a valid legal basis, and you can always ask us to stop.

4. Is providing your data mandatory?

Providing personal data is neither a statutory nor a contractual requirement. However, the fields marked as required in the contact form are necessary for us to handle and answer your request: if they are missing, we will not be able to reply. Technical log data are processed automatically when you use the website. If a contract is concluded, certain data are required by law (for example, for invoicing).

5. Recipients of the data

Your data are accessible only to authorised staff of Balkanova Global who need them for the purposes above. They may be disclosed to:

Aruba S.p.A. (Italy, EU), our website hosting and email service provider, acting as data processor under Art. 28 GDPR;
external accountants and legal or tax advisors, bound by professional secrecy or contractual confidentiality obligations;
banks, carriers and other service providers, only where this is necessary to perform a contract you have requested;
public authorities and courts, where we are legally required to do so.

We never sell or rent your personal data and we do not share them with third parties for their own marketing purposes.

6. Transfers outside the EEA

Your personal data are processed within the European Union / European Economic Area. We do not transfer them to countries outside the EEA. Should this become necessary in the future, we will do so only in compliance with Chapter V GDPR (for example, on the basis of an adequacy decision or standard contractual clauses) and we will update this policy.

7. Retention periods

Requests and correspondence: up to 24 months after our last contact, unless a contract follows.
Contract-related data: for the duration of the business relationship and then for the periods required by Bulgarian accounting and tax legislation (currently up to 10 years for accounting documents), or longer if needed for pending legal claims.
Anti-abuse rate-limit data (hashed IP address): used for 1 hour. Entries older than 1 hour are deleted automatically when the next valid form submission is processed, so an entry may remain stored until then; the hashing key is replaced on the first submission of each new day (UTC), after which earlier entries can no longer be linked to any IP address.
Server logs: kept by our hosting provider for security purposes for a limited period, in accordance with its retention policy.
Cookie choice: 12 months in your browser, after which we ask you again.

When the retention period expires, the data are deleted or irreversibly anonymised.

8. Your rights

Under the GDPR you have the right to:

access your personal data and receive a copy (Art. 15);
obtain rectification of inaccurate or incomplete data (Art. 16);
obtain erasure of your data (“right to be forgotten”) (Art. 17);
obtain restriction of processing (Art. 18), and be informed of any rectification, erasure or restriction notified to recipients (Art. 19);
data portability – receive the data you provided in a structured, commonly used and machine-readable format, or have them transmitted to another controller (Art. 20);
object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, and to object at any time, without giving reasons, to processing for direct marketing (Art. 21);
withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3));
not be subject to a decision based solely on automated processing (Art. 22).

Right to object (Art. 21 GDPR). Where we process your personal data on the basis of our legitimate interests, you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing is needed for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing, you may object at any time, without giving reasons, and we will stop that processing. To object, write to info@balkanovaglobal.com.

9. How to exercise your rights

Send your request to info@balkanovaglobal.com. We may ask you for information to confirm your identity before acting on your request. Exercising your rights is free of charge, unless requests are manifestly unfounded or excessive.

We will reply without undue delay and in any case within one month of receipt. This period may be extended by two further months where necessary, taking into account the complexity and number of requests; in that case we will inform you of the extension and the reasons within the first month (Art. 12(3) GDPR).

10. Right to lodge a complaint

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg.

You may also complain to the supervisory authority of the EU Member State of your habitual residence, place of work or place of the alleged infringement – for example, in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it). This is without prejudice to any other administrative or judicial remedy. We would appreciate the chance to address your concerns first, so please feel free to contact us.

11. Automated decision-making and profiling

We do not carry out automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

12. Minors

Our website and services are intended exclusively for businesses and professionals. They are not directed at minors and we do not knowingly collect personal data of persons under 18. If you believe a minor has sent us personal data, please contact us and we will delete it.

13. Security

We apply appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS/TLS), security headers, self-hosted fonts and scripts with no third-party trackers, data minimisation (the contact form collects only what is needed and does not store requests in a database – they are delivered by email to a protected mailbox), pseudonymisation of IP addresses used for rate limiting, and access limited to authorised staff. In the event of a personal data breach, we will act in accordance with Articles 33 and 34 GDPR.

14. Cookies

For information on cookies and similar technologies used on this website, please see our Cookie Policy.

15. Changes to this policy

We may update this Privacy Policy to reflect legal, technical or organisational changes. The date of the latest update is shown at the top of this page. Material changes will be highlighted on the website.