Privacy policy

1. Who processes your data

The controller of your personal data is Info Service Ltd., UIC 203436930, registered office: 43 Aleko Konstantinov St., entr. B, office 1, 5000 Veliko Tarnovo, Bulgaria.

For any question about your personal data or to exercise your rights, write to office@itsm.bg or call +359 889 007 796. We are not required to appoint a data protection officer and have not done so.

2. Enquiries through the contact form

When you write to us through the form on the Contact page, we receive:

• required — name, email, topic and message;
• optional — company and phone;
• automatically — the site language, the date and time of sending and, if you came from a specific page, which one.

Why: to answer your enquiry and, if you ask, to send you an offer.

Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) and, for general questions, our legitimate interest in answering people who write to us (Art. 6(1)(f)).

How long: up to 12 months from sending, after which the enquiry is deleted automatically. If it leads to a contract, the data is kept for the term of the contract and for the periods required by law (e.g. accounting).

The same applies if you email or call us directly.

We do not store your IP address.

3. Spam protection — Google reCAPTCHA

The contact form is protected by Google reCAPTCHA v3. It loads only on the Contact page and assesses whether the form is filled in by a person or by an automated program. For this, Google receives technical data about your browser and device and about how you interact with the page, and may set a cookie.

Legal basis: our legitimate interest in protecting the form and our mailbox from abuse and spam (Art. 6(1)(f) GDPR). The result has no legal effect on you — at most we may ask you to email us directly.

The provider is Google Ireland Limited. The Google Privacy Policy and Terms of Service apply.

4. Visit statistics — Google Analytics

With your consent we use Google Analytics 4 to understand which pages are read and how people find the site. Google Analytics loads only after you click “Accept” in the cookie window. If you reject, nothing is sent to Google.

The data includes pages visited, visit duration, approximate location (country/city), device and browser type. Google Analytics 4 does not log IP addresses in the EU.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time from the “Cookie settings” link at the bottom of every page; withdrawal does not affect the lawfulness of processing before it.

How long: Google Analytics data is kept for 14 months.

5. Cookies and technical data

The site uses a few necessary cookies — for the session, for form protection and to remember your cookie choice. The full list and their durations are in the Cookie policy.

The server keeps technical error logs. They are kept for up to 14 days and are used only to maintain and secure the site.

6. Who we share data with

We do not sell your personal data or share it with third parties for marketing. Data reaches only:

• our hosting and email providers, which run the site and our mailbox — as processors acting on our behalf under contract;
• Google Ireland Limited — for reCAPTCHA and, only with your consent, for Google Analytics;
• public authorities — only when the law requires us to.

7. Transfers outside the European Union

Google may also process data in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, covered by an adequacy decision of the European Commission; standard contractual clauses apply in addition.

8. Your rights

Under the GDPR you have the right:

• of access — to know whether and what data of yours we process and to receive a copy;
• to rectification of inaccurate data;
• to erasure (“to be forgotten”);
• to restriction of processing;
• to data portability — to receive your data in a machine-readable format;
• to object to processing based on legitimate interest;
• to withdraw your consent at any time, without affecting processing before the withdrawal.

To exercise your rights, write to office@itsm.bg. We reply within one month. We may ask you to confirm your identity so that we do not hand data to someone else.

If you believe we are infringing your rights, you can lodge a complaint with the Bulgarian Commission for Personal Data Protection — 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg, or with the supervisory authority in your EU country. We would appreciate hearing from you first — we may be able to resolve it faster.

9. Children

The site is aimed at businesses and is not intended for children under 14. We do not knowingly collect children’s data.

10. Changes

When we change how we process data, we will update this policy and the date of the last revision at the top of the page.