Privacy notice
Last updated: 16 August 2026
Controller and scope
ZLATIA EOOD, UIC/EIK 204316492, with its registered office in Sofia, Bulgaria, is the controller of personal data processed through this website. This notice explains how we process the personal data of website visitors and people who contact us through the website. To contact us about privacy or to exercise your rights, use the contact form and state that your request concerns personal data.
Personal data we process
When you submit the contact form, we process your name, email address and the content of your message. We also process limited technical data generated when you use the website or form, such as IP address, request date and time, requested URL, browser or device information and security or rate-limit information. We do not ask for special-category data; please do not include it in your message unless it is necessary.
Why we use your data
We use contact-form data to receive, assess and answer your enquiry, including discussing a possible engagement. The legal basis is our legitimate interest in communicating about our services and managing business enquiries (Article 6(1)(f) GDPR), or, where relevant, taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). Providing your name, email address and message is necessary if you want us to reply; if you do not provide them, we cannot respond through the form.
We use technical and security data to provide the website, prevent abuse of the contact form, protect our systems and investigate incidents. The legal basis is our legitimate interest in operating a secure and reliable website (Article 6(1)(f) GDPR). We may also retain or disclose information where necessary to comply with a legal obligation or establish, exercise or defend legal claims.
Recipients and service providers
Access to personal data is limited to authorised people at ZLATIA and to service providers that need it to provide the website or contact service. Our hosting infrastructure is operated on a Contabo server. Contact-form messages are transmitted through Brevo, which processes them on our behalf to deliver the message. Brevo states that its customer databases are hosted in the European Union. We require processors to handle personal data only on our documented instructions and with appropriate security measures.
This website also loads typefaces from Google Fonts. When a font is requested, Google receives the visitor’s IP address, the requested URL and certain browser headers in order to deliver the font. Google states that the Google Fonts Web API does not set or log cookies. Google may process this data outside the European Economic Area; where a transfer of personal data is made, it is subject to the safeguards required by Chapter V of the GDPR, such as an adequacy decision or the European Commission’s standard contractual clauses, as applicable.
Retention
We keep contact-form messages for up to 24 months after our last meaningful correspondence, then delete or anonymise them, unless a longer period is necessary to comply with a legal obligation or to establish, exercise or defend legal claims. Technical and security logs are retained only for the period needed for security, troubleshooting and abuse prevention, normally no longer than 30 days unless an incident requires longer retention.
Cookies and similar technologies
We do not use analytics, advertising, profiling or social-media tracking technologies, and this website does not set its own cookies. The contact form includes a technical anti-spam field and rate limiting; these operate without storing information on your device.
Automated decision-making
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
Your rights
Subject to the conditions and limits in the GDPR, you may request access to your personal data, correction of inaccurate data, deletion, restriction of processing, or data portability. You may object at any time to processing based on our legitimate interests; we will stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed for legal claims. To make a request, use the contact form. We may ask for information needed to verify your identity.
You also have the right to lodge a complaint with the Bulgarian supervisory authority, the Commission for Personal Data Protection, or with the supervisory authority in your habitual residence, place of work or place of the alleged infringement.
Changes to this notice
We may update this notice when our processing changes or the law requires it. We will publish the updated version on this page and change the “Last updated” date.