Privacy Policy

Brief explanation

This Policy explains, in a clear and accessible manner, how ‘SOLISFERADOME’ Ltd processes personal data when you visit the website, submit an enquiry, engage in preliminary communication and receive services via SOLISFERADOME ANALYTICS.

We process only data that is necessary for a specific lawful purpose. We do not sell personal data. We do not use data from the contact form for automated decision-making that produces legal effects or significantly affects the individual.

1. Who is the data controller?

The data controller is:

“SOLISFERADOME” EOOD, UIC 208485123, VAT registration number BG208485123, with its registered office and place of business at: Republic of Bulgaria, Sofia 1510, Poduyane district, Hadzhi Dimitar residential estate, hereinafter referred to as ‘the Company’, ‘we’ or ‘SOLISFERADOME ANALYTICS’.

SOLISFERADOME ANALYTICS is the trading name of the Company’s analytical division, and not a separate legal entity or a separate data controller.

Contact for enquiries regarding personal data: [email protected].

Correspondence address: the registered office address stated above.

Requests and enquiries regarding personal data should be sent to the email address or correspondence address provided.

2. Who this Policy applies to

This Policy applies to individuals whose data we process in connection with our website and our activities. This includes website visitors; individuals who submit enquiries; representatives, employees and contact persons of potential or existing clients, suppliers and partners; as well as other individuals whose data has been lawfully provided in connection with a specific assignment.

Where our client is a legal entity or a public institution, the organisation’s own data does not constitute personal data. However, the name, work email address, telephone number, job title and actions of a specific representative of that organisation may constitute personal data.

3. What personal data do we process?

3.1. Data provided via the contact form or direct communication

We may process: name; organisation and job title; work or personal email address; telephone number; the content of the message; details of the person being represented; as well as any subsequent correspondence and documents that the person voluntarily provides.

In the contact form, the name, email address and message are required in order for us to receive and review the enquiry. Organisation and telephone number are optional, unless the nature of the specific communication requires otherwise.

Please do not send your personal identification number (EGN), identity document numbers, bank details, health information, biometric or genetic data, data relating to political opinions, religion, trade union membership, sex life or sexual orientation, data on convictions and offences, classified information or third-party confidential data via the general contact form. If a specific project requires data subject to special rules, the necessity, legal basis, method of transfer and safeguards must be agreed in advance and in writing.

3.2. Data relating to contracts and analytical services

We may process identification and contact details of representatives and contact persons; details of power of representation; contractual and payment information; correspondence; meeting minutes; instructions; access information and other personal data contained in the materials provided by the client.

With regard to personal data in the client’s materials, our role is determined by the specific activity. Where we independently determine the purposes and means of processing, we act as the data controller. Where we process data solely in accordance with the client’s documented instructions, we may act as a data processor, and the relationship is governed by a contract pursuant to Article 28 of Regulation (EU) 2016/679. This Policy does not replace such a contract.

3.3. Technical data when using the website

When accessing the website, the servers and security systems may process the IP address, the date and time of the request, the page visited, the browser and device type, the operating system, the referrer URL, technical identifiers, security events and error data. This data is used to deliver the website, maintain its security, perform diagnostics and prevent misuse.

The contact form uses Google reCAPTCHA, which serves to distinguish real users from automated requests and abuse. When the form is loaded and used, Google may receive technical data about the device and interaction with the website. Further information is provided in Google’s privacy policy and terms and conditions, to which there must be active links directly next to the form.

4. Why and on what legal basis do we process data

We do not consider that simply ticking a box constitutes ‘consent’ under the GDPR. Ticking the box to accept the Terms and Conditions confirms acceptance of them; it does not, in itself, create a legal basis for any processing of personal data. Where we do rely on consent, it is sought separately, for a specific purpose, and may be withdrawn at any time, without affecting the lawfulness of any previous processing.

5. Legitimate interests

Where we rely on a legitimate interest, this may include: conducting professional communications; handling and documenting enquiries; managing relationships with representatives of corporate and institutional clients; ensuring network and information security; preventing spam, fraud and abuse; protecting confidential information; and establishing, exercising or defending legal claims.

Prior to such processing, we assess whether the purpose is lawful, whether the processing is necessary and whether the interests or fundamental rights and freedoms of the individual take precedence. The individual has the right to object to the processing under the terms of Article 21 of the GDPR.

6. Is the provision of data mandatory?

The data marked as mandatory in the contact form is necessary for us to consider your enquiry and respond. If this data is not provided, the form cannot be submitted or we may not be able to process your request.

When preparing and performing a contract, certain data may be required by law or for the conclusion and performance of the contract. Refusal to provide such data may make it impossible to draw up a quotation, verify authority to act, or conclude or perform the contract. Non-mandatory data is clearly distinguished, or the need for it is explained in the specific communication.

7. From which sources do we obtain data

We obtain data directly from the individual; from the organisation they represent; from a client who lawfully provides it to us for a specific project; from public registers, official sources and professional public websites; and automatically from the systems that ensure the operation and security of the website.

Where we receive personal data not directly from the data subject and we are the data controller, we provide the information under Article 14 of the GDPR within the applicable timeframe, unless a legal exception applies.

8. To whom we may disclose data

Access is granted only to individuals who require the data in connection with their official duties or a specific assignment, and who are bound by confidentiality and security requirements.

We may use providers of hosting and technical support; email and communication services; spam and abuse protection, including Google reCAPTCHA; archiving and information security; accounting, legal and other professional services; as well as external experts or subcontractors, where this is necessary for a specific assignment and is permitted by contract and law.

We may provide data to a court, regulatory or other competent authority where required by applicable law or where necessary to protect legitimate rights. We do not supply personal data in return for payment, nor do we disclose it to third parties for unrelated purposes of their own.

Where a data processor processes data on our behalf, we select them following a reasonable due diligence process and regulate our relationship in accordance with Article 28 of the GDPR. Where the recipient is an independent controller, they are responsible for their own processing.

9. Transfer of data outside the European Economic Area

Some of the technology providers we use may process data or provide access to data from countries outside the European Economic Area. This is possible in particular when using Google reCAPTCHA.

Such transfers are only carried out where an applicable mechanism under Chapter V of the GDPR is in place, such as a European Commission decision on an adequate level of protection, standard contractual clauses, another admissible safeguard or an applicable exception. When we use standard contractual clauses, we assess the need for additional measures based on the nature of the data and the risk involved.

Information on the specific mechanism and a copy or description of the applicable safeguards may be requested at [email protected], provided that the provision of such information does not compromise trade secrets, security or the rights of other persons.

10. How long do we retain data?

We retain personal data for no longer than is necessary for the relevant purpose, unless a longer period is required or permitted by law.

Enquiries that do not result in a contract, and the associated correspondence, are retained for up to 12 months following the final conclusion of the communication, unless a longer retention period is necessary to defend against a specific claim or the individual requests earlier deletion and there are no grounds for retention.

Data relating to quotations, contracts, the provision of services and business correspondence are retained for the duration of the relationship and, as a rule, for 5 years following its final conclusion, unless an applicable limitation period, accounting, tax, public procurement or other statutory period requires longer retention.

Accounting and tax documents are retained for the periods specified in the applicable accounting and tax legislation.

Technical logs and security data are retained for a period determined by their purpose, the risk, the system’s capacity and the need to investigate incidents, after which they are deleted or anonymised, unless a specific record is required as evidence.

Where data is required for a pending dispute, audit or legal claim, it may be restricted and retained until the relevant proceedings have been finally concluded and the applicable time limits have expired.

11. Cookies and similar technologies

The website may use strictly necessary cookies and similar technologies for core functionality, security, session management and form submission. They are not used for behavioural advertising simply because they are technically available.

Non-essential analytical, marketing or profiling technologies may only be activated following valid prior consent, where such consent is required. Opting out must be as easy as opting in, and the option to withdraw consent must be available at any time. Detailed categories, providers, purposes, retention periods and methods for changing preferences should be set out in a separate Cookie Policy or settings panel.

Google reCAPTCHA must not be described solely as a ‘necessary cookie’. Prior to publication, the Company should document which identifiers and technologies are actually loaded, the legal basis for their use, and whether prior consent is required depending on the specific technical configuration.

12. Automated decision-making and profiling

We do not use data from the website and the contact form for decisions based solely on automated processing which produce legal effects concerning the data subject or similarly significantly affect them within the meaning of Article 22 of the GDPR.

reCAPTCHA carries out an automated assessment to determine whether a request is likely to have been generated by a human or an automated system. This serves as a technical safeguard for the form and does not constitute a decision regarding the customer’s eligibility, the conclusion of a contract or the provision of a service. If a request is blocked, the individual may contact us directly at [email protected].

13. How we protect data

We implement appropriate technical and organisational measures, taking into account the nature, scope, context and purposes of the processing, as well as the likelihood and severity of the risk. These measures may include access control, individual rights, confidentiality, protection of communications and devices, archiving, vulnerability and incident management, restriction of access to project materials, and contractual obligations towards processors and external experts.

No system can guarantee absolute security. This does not relieve us of our obligation to implement proportionate safeguards, to respond in the event of an incident and, where required by law, to notify the competent supervisory authority and the data subjects concerned.

14. Your rights

Under the terms of the GDPR, you have the right to request access to your personal data and information regarding its processing; to have inaccurate data rectified or incomplete data completed; to have data erased; to restrict processing; to receive and transfer your data where the right to data portability applies; object to processing based on a legitimate interest; withdraw consent where processing is based on consent; and request human intervention and contest an automated decision where applicable.

These rights are not absolute. For example, erasure may be refused for data that we are required by law to retain or that is necessary for the establishment, exercise or defence of legal claims. Data portability applies only to automated processing based on consent or a contract, and to data provided by the individual.

You may exercise your rights by emailing [email protected] or writing to our correspondence address. Please provide sufficient information to enable us to understand your request and identify the data to which it relates. We may request additional information to verify your identity where this is necessary and proportionate. We do not request more data than is necessary for the verification.

We will respond without undue delay and, as a rule, within one month of receipt. In the event of complexity or a large number of requests, the deadline may be extended by a further two months, in which case we will notify you of the extension and the reasons for it within the first month. Requests are generally free of charge, except where they are manifestly unfounded or excessive in the cases provided for by law.

15. Complaints to a supervisory authority and judicial redress

If you believe that your personal data is being processed unlawfully, you may contact us first, without this affecting your other rights.

You have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP) or with the competent supervisory authority in the Member State of your habitual residence, place of work or where the alleged infringement occurred. The current contact details and the procedure for lodging a complaint with the CPDP are published at https://cpdp.bg.

You also have the right to effective judicial redress under the terms of the applicable law.

16. Data relating to other individuals

If you provide us with personal data relating to another individual, you must have a lawful basis for doing so and must provide that individual with the necessary information regarding the processing, unless a statutory exception applies. Do not provide more data than is necessary for the specific purpose.

The customer cannot, by means of a contractual declaration alone, transfer their own responsibility for the lawful collection and provision of data to the Company. Each party is responsible for the obligations imposed on it by law in accordance with its actual role.

17. Minors

The SOLISFERADOME ANALYTICS website and services are aimed at professional and institutional clients, not at children. We do not knowingly collect personal data from children via the contact form. If we discover that such data has been submitted without a lawful basis and is not necessary, we will take steps to delete it.

18. External links and social media

The website may contain links to external pages and profiles, including Facebook, LinkedIn and Instagram. When an external link is opened, the relevant provider processes data in accordance with its own terms and conditions and privacy policy. The Company does not determine the purposes and means of the processing carried out independently by these providers outside our website.

The mere presence of a link does not mean that we automatically transfer data from the contact form to the relevant social media platform.

19. Changes to the Policy

We may update the Policy in the event of changes to the law, our business, the website, the service providers used or the method of processing. The current version is published on this page with the date of entry into force and the date of the last update.

Where the change is substantial and the law so requires, we will provide additional notice in an appropriate manner. A new version of the Policy cannot, with retroactive effect, render unlawful processing lawful or alter a valid consent.

20. Applicable law

Processing is carried out in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), the Personal Data Protection Act and other applicable law of the European Union and the Republic of Bulgaria.