Privacy Policy
Effective date: 13 November 2026
1. Controller
KONDEVS Ltd. (КОНДЕВС ЕООД)
UIC 203436971, VAT BG203436971
Akad. Petar Dinekov 23, 1415 Sofia, Bulgaria
Email: info@kondevs.com
2. Data we collect
Enquiries by email or phone
When you write to us or call us, we process your name, contact details and the content of your message to respond to your enquiry and to prepare any offer you ask for. We keep this correspondence only as long as needed for that purpose and any follow-up, or as long as the law requires us to keep business records.
Contact form
When you submit our contact form, we collect:
- Name
- Email address
- Company name (optional)
- Phone number (optional)
- Message content
This data is processed solely to respond to your enquiry. We retain it only as long as necessary to handle your request and any related follow-up correspondence, after which it is deleted.
Website analytics
We use Cloudflare Web Analytics, a privacy-first analytics service that does not use cookies and does not collect personal data. Only aggregate, anonymous traffic statistics are produced; no individual visitor is identified.
If you accept analytics cookies in the banner, we also use Google Analytics 4 to see which pages are visited, how visitors reach the site and which links they follow. Google Analytics then receives the request data of your browser (including your IP address, which Google Analytics 4 does not store), the pages you view and the links you click, under a random identifier kept in a cookie. Google Signals and the advertising features are switched off. Without your consent, Google Analytics is not loaded at all. Google keeps this event data for 2 months.
Server logs
Our hosting provider (Cloudflare) collects standard server access logs, which may include IP addresses, browser type and pages visited. These logs are used for security and performance purposes and are retained according to Cloudflare's data retention policies.
To protect the contact form and our APIs from abuse, we count requests per IP address. We keep only a one-way hash of the address, never the address itself, and each count is deleted after at most one hour.
3. Legal basis for processing
We process personal data on the following legal bases under the GDPR:
- Steps before a contract (Article 6(1)(b)) and legitimate interest (Article 6(1)(f)): to answer your enquiry and to prepare an offer you ask for.
- Consent (Article 6(1)(a)): when you submit the contact form and agree to this policy. You may withdraw your consent at any time (see Section 6).
- Consent (Article 6(1)(a) GDPR and, for visitors in Germany, Section 25(1) TDDDG): for Google Analytics, only if you accept it in the cookie banner. You can withdraw your consent at any time under “Cookie settings” at the bottom of every page; the withdrawal does not affect the processing before it.
- Legitimate interest (Article 6(1)(f)): to operate, secure and maintain the website, prevent abuse, and keep server logs.
4. Data sharing (processors)
We do not sell, rent or trade your personal data. We share it only with the service providers (processors) needed to operate the site:
- Cloudflare: hosting, CDN, security and bot protection.
- Resend: email delivery, used to forward contact-form submissions to us.
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland): Google Analytics, only with your consent.
These processors act on our instructions under data processing agreements and process data in accordance with the GDPR.
5. International transfers
Some of our processors (Cloudflare and Resend) are based in the United States and may process personal data outside the European Economic Area (EEA). Where data is transferred outside the EEA, it is protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the processor's certification under the EU-US Data Privacy Framework. You can request more information about these safeguards using the contact details below. If you accept analytics cookies, Google may also process the data in the United States; Google LLC is certified under the EU-US Data Privacy Framework.
6. Your rights
Under the GDPR, you have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase your data ("right to be forgotten")
- Restrict processing
- Data portability
- Object to processing
- Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Article 7(3))
- Lodge a complaint with a supervisory authority: in Bulgaria, the Commission for Personal Data Protection (Комисия за защита на личните данни), cpdp.bg
To exercise any of these rights, contact us at info@kondevs.com.
7. Cookies
Analytics cookies (only if you accept them): Google Analytics sets _ga and _ga_0WMXK0PT0E to tell visits apart; both expire after 2 years. Your choice in the banner is kept in your browser's local storage (kondevs-consent), not in a cookie, and you can change it at any time under “Cookie settings” at the bottom of every page. If you withdraw your consent, the site deletes these cookies.
The contact page also sets one strictly necessary, first-party cookie (csrf-token). It protects form submissions against cross-site request forgery, contains no personal data and expires within one hour. We do not use cookies for advertising or profiling.
Cloudflare, which hosts the site, may set its own strictly necessary cookies for security and bot protection. They are not used for tracking.
8. Data security
We implement appropriate technical and organisational measures to protect your personal data, including HTTPS encryption, secure email transmission, and access controls.
9. Changes to this policy
We may update this privacy policy from time to time. Changes will be posted on this page with an updated effective date.
10. Contact
For privacy-related enquiries, contact us at:
Email: info@kondevs.com