Privacy policy

1. Who processes your data

The data controller is Engin Badzhakla — a natural person operating under the name “Orvionis Solutions”.

For any question about the processing of your personal data, and to exercise the rights set out below, contact us at office@orvionis-bg.com.

2. What data we collect

We collect only what we need, in three situations:

• When you submit the enquiry form: your name, email address and message, and optionally your phone number, company name, the service you are interested in and an approximate budget.
• When you visit the site: technical data that any web server records — IP address, browser and device type, pages visited and time of access.
• When you consent to analytics or marketing cookies: behavioural data collected by those services. Without your consent these services are not loaded at all.

3. Why we process it, and on what basis

• To answer your enquiry — the basis is your consent, given through the checkbox in the form (Art. 6(1)(a) GDPR).
• To keep the site secure and working — the basis is our legitimate interest in preventing abuse and technical faults (Art. 6(1)(f)).
• To measure how the site and our advertising perform — the basis is your consent, given through the cookie banner (Art. 6(1)(a)).
• To meet legal obligations, such as accounting — the basis is legal obligation (Art. 6(1)(c)).

4. How long we keep it

• Enquiries that did not lead to a contract: up to 12 months from our last correspondence.
• Client data under a signed contract: for the term of the contract and 5 years after it ends.
• Accounting records: 10 years, as required by Bulgarian accounting law.
• Server logs: up to 30 days.
• Analytics and marketing cookie data: for the periods set by each service, described in the Cookie policy.

5. Who we share it with

We do not sell or rent personal data. We share it only with providers who help us operate and who act on our instructions:

• Vercel Inc. — site hosting.
• Neon Inc. — database and uploaded-image hosting. The servers are in Frankfurt, Germany.
• Resend — email delivery.
• Google Ireland Ltd. — traffic analytics, only where consent is given.
• Meta Platforms Ireland Ltd. and TikTok Technology Ltd. — advertising measurement, only where consent is given.
• Competent public authorities, where we are required by law.

6. Transfers outside the European Union

Some of the providers listed are based in the United States. Where data is transferred outside the EU, this happens under the European Commission's Standard Contractual Clauses or under an adequacy decision (the EU–US Data Privacy Framework).

7. Your rights

Under the GDPR you have the right:

• To access the data we hold about you.
• To have inaccurate data corrected.
• To have your data erased.
• To have processing restricted.
• To receive your data in a machine-readable format and transfer it to another controller.
• To object to processing based on legitimate interest.
• To withdraw your consent at any time — withdrawal does not affect processing carried out beforehand.

8. How to exercise your rights

Write to us at office@orvionis-bg.com. We respond within one month of receiving the request. There is no charge, unless the request is manifestly unfounded or excessive.

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, kzld.bg.

9. Security

The site runs entirely over an encrypted connection (HTTPS). Access to the database is restricted and protected by passwords stored only in hashed form. Only people who need it for their work can see enquiries.

10. Automated decision-making and profiling

We do not make automated decisions that produce legal effects concerning you.

11. Changes to this policy

We may update this policy. The date of the last change is shown at the top of the page. Where changes are material, we will ask for your consent again.