--- title: "Privacy Policy | KONDEVS" description: "KONDEVS privacy and data-protection policy: what we collect when you contact us, the GDPR legal bases we rely on, cookies, your rights and how to reach us." canonical: "https://www.kondevs.com/privacy-policy/" language: "en" type: "website" image: "https://www.kondevs.com/images/og-default.png" --- > For the complete index of this site, see [llms.txt](https://www.kondevs.com/llms.txt); the whole site in one file: [llms-full.txt](https://www.kondevs.com/llms-full.txt). # Privacy Policy **Effective date:** 13 November 2026 ## 1. Controller KONDEVS Ltd. (КОНДЕВС ЕООД) UIC 203436971, VAT BG203436971 Akad. Petar Dinekov 23, 1415 Sofia, Bulgaria Email: [info@kondevs.com](mailto:info@kondevs.com) ## 2. Data we collect ### Enquiries by email or phone When you write to us or call us, we process your name, contact details and the content of your message to respond to your enquiry and to prepare any offer you ask for. We keep this correspondence only as long as needed for that purpose and any follow-up, or as long as the law requires us to keep business records. ### Contact form When you submit our contact form, we collect: - Name - Email address - Company name (optional) - Phone number (optional) - Message content This data is processed solely to respond to your enquiry. We retain it only as long as necessary to handle your request and any related follow-up correspondence, after which it is deleted. ### Website analytics We use Cloudflare Web Analytics, a privacy-first analytics service that does not use cookies and does not collect personal data. Only aggregate, anonymous traffic statistics are produced; no individual visitor is identified. If you accept analytics cookies in the banner, we also use **Google Analytics 4** to see which pages are visited, how visitors reach the site and which links they follow. Google Analytics then receives the request data of your browser (including your IP address, which Google Analytics 4 does not store), the pages you view and the links you click, under a random identifier kept in a cookie. Google Signals and the advertising features are switched off. Without your consent, Google Analytics is not loaded at all. Google keeps this event data for 2 months. ### Server logs Our hosting provider (Cloudflare) collects standard server access logs, which may include IP addresses, browser type and pages visited. These logs are used for security and performance purposes and are retained according to Cloudflare's data retention policies. To protect the contact form and our APIs from abuse, we count requests per IP address. We keep only a one-way hash of the address, never the address itself, and each count is deleted after at most one hour. ## 3. Legal basis for processing We process personal data on the following legal bases under the GDPR: - **Steps before a contract** (Article 6(1)(b)) and **legitimate interest** (Article 6(1)(f)): to answer your enquiry and to prepare an offer you ask for. - **Consent** (Article 6(1)(a)): when you submit the contact form and agree to this policy. You may withdraw your consent at any time (see Section 6). - **Consent** (Article 6(1)(a) GDPR and, for visitors in Germany, Section 25(1) TDDDG): for Google Analytics, only if you accept it in the cookie banner. You can withdraw your consent at any time under “Cookie settings” at the bottom of every page; the withdrawal does not affect the processing before it. - **Legitimate interest** (Article 6(1)(f)): to operate, secure and maintain the website, prevent abuse, and keep server logs. ## 4. Data sharing (processors) We do not sell, rent or trade your personal data. We share it only with the service providers (processors) needed to operate the site: - **Cloudflare**: hosting, CDN, security and bot protection. - **Resend**: email delivery, used to forward contact-form submissions to us. - **Google Ireland Limited** (Gordon House, Barrow Street, Dublin 4, Ireland): Google Analytics, only with your consent. These processors act on our instructions under data processing agreements and process data in accordance with the GDPR. ## 5. International transfers Some of our processors (Cloudflare and Resend) are based in the United States and may process personal data outside the European Economic Area (EEA). Where data is transferred outside the EEA, it is protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the processor's certification under the EU-US Data Privacy Framework. You can request more information about these safeguards using the contact details below. If you accept analytics cookies, Google may also process the data in the United States; Google LLC is certified under the EU-US Data Privacy Framework. ## 6. Your rights Under the GDPR, you have the right to: - **Access** your personal data - **Rectify** inaccurate data - **Erase** your data ("right to be forgotten") - **Restrict** processing - **Data portability** - **Object** to processing - **Withdraw consent** at any time, without affecting the lawfulness of processing carried out before withdrawal (Article 7(3)) - **Lodge a complaint** with a supervisory authority: in Bulgaria, the Commission for Personal Data Protection (Комисия за защита на личните данни), [cpdp.bg](https://cpdp.bg/) To exercise any of these rights, contact us at [info@kondevs.com](mailto:info@kondevs.com). ## 7. Cookies **Analytics cookies** (only if you accept them): Google Analytics sets `_ga` and `_ga_0WMXK0PT0E` to tell visits apart; both expire after 2 years. Your choice in the banner is kept in your browser's local storage (`kondevs-consent`), not in a cookie, and you can change it at any time under “Cookie settings” at the bottom of every page. If you withdraw your consent, the site deletes these cookies. The contact page also sets one strictly necessary, first-party cookie (`csrf-token`). It protects form submissions against cross-site request forgery, contains no personal data and expires within one hour. We do not use cookies for advertising or profiling. Cloudflare, which hosts the site, may set its own strictly necessary cookies for security and bot protection. They are not used for tracking. ## 8. Data security We implement appropriate technical and organisational measures to protect your personal data, including HTTPS encryption, secure email transmission, and access controls. ## 9. Changes to this policy We may update this privacy policy from time to time. Changes will be posted on this page with an updated effective date. ## 10. Contact For privacy-related enquiries, contact us at: Email: [info@kondevs.com](mailto:info@kondevs.com)