Privacy Policy

1. Who is responsible for your data

The controller of the personal data described in this policy is «ФИРМА», UIC «ЕИК», with registered seat and address of management «седалище и адрес на управление».

For questions about personal data and to exercise your rights: «имейл за защита на данните».

2. An important distinction: the website and the application

This policy applies to this website and to the enquiries you send through it.

The data inside the platform — teachers, students, exams, answers, grades — is processed on a different basis. There the controller is the school: it decides why and how the data of its teachers and students is processed. We are a processor acting on its instructions.

That processing is governed by the Data Processing Agreement we sign with each school, not by this policy.

3. What data we collect through the website

When you send a request for a demonstration, a request for an offer or a message through the contact form, we collect the data you yourself enter in the form:

— email address;

— name of the school or organisation;

— country and city;

— number of teachers and number of students, and for an offer request also the disk space per teacher, the desired start date and your role at the school;

— name — only in the contact form, so that we know whom to address in our reply;

— the subject and text of the message.

We do not ask for any other data about natural persons. If you enter such data in the free text, we process it as part of the enquiry.

To protect against automated submissions, the form also sends the time it took to fill in and one field that is not shown to people. They serve only to filter out automated requests and are not stored.

The server that runs the website keeps technical logs of requests, needed for maintenance and security.

From the address a request comes from, we derive the country and region, so that we know which markets interest in the platform comes from. The address itself is truncated before the record is stored and is not kept in full. We do not try to establish who the visitor is.

This derivation is done entirely on our own server, with a database downloaded in advance. Your address is not sent to any third party.

4. Why we process it and on what basis

Requests for a demonstration and an offer — to reply and to hold the pre-contractual conversation. Basis: taking steps at the request of the data subject prior to entering into a contract, Art. 6(1)(b) GDPR. Messages through the contact form that are not related to a contract — to reply to the enquiry addressed to us. Basis: our legitimate interest, Art. 6(1)(f).

Technical logs, security measures and visit statistics — to keep the website working and secure and to understand which countries interest in the platform comes from. Basis: our legitimate interest, Art. 6(1)(f).

Compliance with legal obligations, where they arise — for example accounting obligations. Basis: Art. 6(1)(c).

Filling in the form is voluntary, but without an email address we cannot reply to the enquiry.

5. Who has access to it

Enquiries arrive by email at our business addresses and are handled by the employees responsible for sales and support.

The website and email run on infrastructure provided by «хостинг доставчик и държава». This provider acts as a processor on our instructions.

We do not sell your data or make it available to third parties for their own purposes. We disclose it to a public authority only when we are required to by law.

6. How long we keep it

An enquiry that did not lead to a contract — up to 12 months from the last correspondence, after which we delete it.

An enquiry that led to a contract — for the term of the contract and for the period in which claims under it may arise.

Technical logs — for a short period, as needed for diagnostics and security.

Aggregated visit statistics — without a time limit. That is the very reason they are kept: a school year only means something if it can be compared with the previous ones, and those do not end after a set number of days. The record contains a truncated address — for IPv4 the last group is zeroed, for IPv6 the first 48 bits are kept — from which the country and region are derived. A full address is not recorded anywhere.

What really expires is not the numbers but the possibility of linking them to a person. The pseudonym is computed with a random value that is replaced every 30 days and irreversibly deleted after 60 days; after that nobody, including us, can restore the link between pseudonym and address. In other words, old statistics remain statistics and stop being about anyone.

Documents of tax and accounting significance — for the periods set by law.

7. Cookies and tracking

The website does not use cookies — neither its own nor third-party ones — does not embed advertising scripts or third-party analytics services and does not build visitor profiles.

Visits are counted by our own script, loaded from our own domain, and the numbers stay on our server. It writes nothing to your device: no cookie, no localStorage, no sessionStorage. The only thing it reads is an opt-out marker you have set yourself — and that exists only if you have set it.

That is why counting requires no consent: Art. 5(3) applies when data is written to or read from your device, and there is no such data here.

A visitor is recognised by a temporary pseudonym computed from the address, the browser and the domain with a random value that is replaced every 30 days and irreversibly deleted after 60 days. After that, the link between the pseudonym and the address cannot be restored by anyone, including us. The address itself is used to determine the country and city and is truncated immediately afterwards — a full address is not recorded.

The fonts are delivered from our own server, not from a third-party content delivery network. Loading a page therefore sends no request to a third party.

If this changes, we will update this policy and ask for consent where the law requires it.

8. Transfers outside the European Union

We do not transfer personal data outside the European Economic Area.

Should this become necessary in the future, we will do so only on an appropriate basis under Chapter V GDPR and will update this policy.

9. Your rights

With regard to the data for which we are the controller, you have the right:

— of access to it and to a copy (Art. 15);

— to rectification of inaccurate data (Art. 16);

— to erasure (Art. 17);

— to restriction of processing (Art. 18);

— to portability in a machine-readable format (Art. 20);

— to object to processing based on legitimate interest (Art. 21).

The rights are exercised by a request to «имейл за защита на данните». We reply within one month; for complex requests the period may be extended, in which case we will let you know.

If the question concerns data inside the platform, contact your school — it is the controller. We will help the school to respond.

10. Right to lodge a complaint

If you believe that we process your data in breach of the law, you can lodge a complaint with the Commission for Personal Data Protection.

Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, tel. +359 2 915 3518, email kzld@cpdp.bg, website cpdp.bg.

You also have the right to apply to the competent court.

11. Changes to this policy

We may update this policy. The date of the last change is shown at the top of the page.

In the event of a material change, we notify our customer schools in writing.