Privacy policy

1. Who we are

Ес енд Ди Консултинг ООД (S and D Consulting Ltd.), UIC 208062600 Registered office: 36 Slavyanska Street, floor 1, apt. 2, 1000 Sofia, Bulgaria VAT number: BG208062600 Email: office@sdconsulting.bg

2. What we process and why

The contact form. When you write to us, we receive your name, email address and message, and your answer to how you heard about us if you give one. We use them to reply to your enquiry and, where relevant, to discuss working together; your answer to how you heard about us also shows us which channels bring us enquiries.

Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in answering business enquiries and in knowing how people find us (Article 6(1)(b) and (f) of Regulation (EU) 2016/679, the GDPR).

You are not obliged to give us this information, but without your name, email address and message we cannot reply. The answer to how you heard about us is optional.

Visiting the site. To serve the pages and protect them from abuse, our hosting provider Vercel processes technical data on every visit: IP address, browser type, the address requested and the time. This is how, for example, the form accepts no more than five messages an hour from one IP address. In our Vercel account, request logs are kept for one hour.

Legal basis: our legitimate interest in a secure, working website (Article 6(1)(f) GDPR).

Visitor statistics. We use Vercel Web Analytics to see how many people visit the site and which pages they read. It sets no cookies and does not follow visitors across other websites. For each visit it records the page opened, the site the visitor came from, approximate location (country, region, city), device type, operating system and browser. We see totals only. The temporary visit identifier is deleted after 24 hours.

Legal basis: our legitimate interest in knowing how the site is used (Article 6(1)(f) GDPR).

3. Cookies and browser storage

The site uses no cookies, advertising tools or social media plugins. Fonts are served from our own site, not from an outside service.

The only thing the site stores in your browser is a technical marker (sdi-seen), so that the opening animation is not shown twice in the same tab. It is not a cookie, it is never sent to us, and it disappears when you close the tab. If you have blocked websites from storing data in your browser, the site works normally, just without the opening animation.

4. Who receives your data

• Within the company, enquiries are read only by the managing director.
• Vercel Inc. (USA): hosting for the site and the visitor statistics. The contact form runs on Vercel servers in Frankfurt, Germany.
• Jump.BG (Джъмп.БГ ООД, Bulgaria): the mail server that receives and stores the messages from the form.
• Partner companies, only when this is needed to answer your enquiry, for example the manufacturer or distributor you are asking about.
• Public authorities, only where the law requires it.

Vercel and Jump.BG process the data on our behalf, as processors.

5. Transfers outside the EU

Vercel Inc. is a US company and may process data in the United States. Vercel is certified under the EU–US Data Privacy Framework, so these transfers rely on the European Commission's adequacy decision for that framework (Article 45 GDPR). Vercel's certification can be checked at dataprivacyframework.gov.

If your enquiry concerns a partner outside the EU, we pass your details to that partner only as far as needed to answer your request (Article 49(1)(b) GDPR).

6. How long we keep data

• Enquiries: up to two years after our last contact with you, then deleted. If our correspondence leads to a contract, the documents relating to it are kept for as long as the law requires.
• Request logs: one hour.
• Statistics: the visit identifier for 24 hours; after that, only totals that cannot identify anyone.

7. Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, and to data portability. Write to us at office@sdconsulting.bg. We will reply within one month, free of charge.

Right to object. Where we rely on our legitimate interest (section 2), you can object to that processing at any time, on grounds relating to your particular situation. We will then stop, unless we can show compelling legitimate grounds that override your interests, or we need the data for legal claims (Article 21 GDPR).

8. Complaints

If you believe we have broken data protection law, you can complain to the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, kzld@cpdp.bg, www.cpdp.bg, or to the supervisory authority of the EU country where you live or work.

9. Automated decisions

We make no decisions about you by automated means and do no profiling.

10. Changes

If we change this policy, we will publish the new version on this page with a new date.