Privacy Policy

1. Introduction

This Privacy Policy describes how VVM Digital Solutions EOOD ("we", "us") collects, uses, and shares personal data when you visit our website at https://vvmdigital.com or communicate with us by email about our services.

We are an engineering practice based in Varna, Bulgaria. This Policy is written to comply with the European General Data Protection Regulation (GDPR) and the Bulgarian Personal Data Protection Act.

If you have questions about anything in this Policy, reach us at info [at] vvmdigital [dot] com.

2. Data controller

The data controller responsible for your personal data is:

Email for privacy-related requests: info [at] vvmdigital [dot] com

3. What data we collect

We collect the minimum data we need to run the site, respond to inquiries, and understand how the site is used.

a) Inquiries sent by email

When you email us (for example at [email protected]), we receive whatever you put into that email — typically your name, your email address, and the content of your message. We use this to reply to you.

b) Server logs

Our web server and Cloudflare, our CDN and DDoS protection provider, automatically log standard request metadata: IP address, user-agent string, referrer, timestamps, and the paths of the resources you fetch. This is standard web-server behaviour; we use it to keep the site online, diagnose issues, and protect against abuse.

c) Analytics

We use two analytics tools:

• Google Analytics 4, provided by Google Ireland Limited. GA4 collects information about how visitors interact with the site — which pages they visit, how long they stay, device type, and rough geography derived from IP. GA4 transfers this data to Google's infrastructure, including servers in the United States.
• Yandex Metrica, provided by Yandex LLC (Russian Federation). Yandex Metrica collects similar usage data and may record aggregated session interactions.

Both tools set cookies — see the Cookies section.

d) Cookies

We set or allow a small number of cookies, listed in the Cookies section below.

We do not collect biometric data, health data, payment details, or any special categories of personal data defined in GDPR Article 9.

4. Legal basis for processing

Under GDPR Article 6, we process personal data on one of the following bases:

• Legitimate interest (Art. 6(1)(f)) — for server logs, security monitoring, and aggregate analytics. We have balanced our legitimate interest against your privacy, taking into account the limited and non-sensitive nature of the data.
• Consent (Art. 6(1)(a)) — for non-essential cookies set by Google Analytics 4 and Yandex Metrica. You are asked to accept or reject these cookies through our cookie banner, and you may withdraw consent at any time.
• Contract performance (Art. 6(1)(b)) — when we engage with you as a client under a written service agreement, we process the personal data necessary to deliver that service.
• Legal obligation (Art. 6(1)(c)) — where Bulgarian law requires us to retain specific records, such as tax and accounting data.

5. How long we keep data

We keep personal data only as long as we need it.

6. Who we share data with

We share personal data only with providers we rely on to run the site and the business. We do not sell personal data. We do not share it with advertisers or data brokers.

• Hosting and CDN: Cloudflare, Inc. (edge, DNS, and origin certificate provider) and Google Cloud Platform (GCP) for origin hosting.
• Email provider: Google Workspace, provided by Google Ireland Limited. Email correspondence between you and us is stored on Google infrastructure, with data transfer to the United States under the EU-US Data Privacy Framework.
• Analytics: Google Ireland Limited (Google Analytics 4) and Yandex LLC (Yandex Metrica).
• Legal or regulatory requests: we disclose personal data if required by Bulgarian law or a valid legal process.

7. International transfers

Some of our providers process personal data outside the European Economic Area:

• Google Analytics 4 transfers data to Google infrastructure, including servers in the United States. Google relies on the EU-US Data Privacy Framework as the mechanism for lawful transfer.
• Yandex Metrica processes data on Yandex infrastructure in the Russian Federation, under its own terms and Russian data protection law.
• Cloudflare operates a global edge network; data may transit through Cloudflare points of presence outside the EEA on its way to our origin servers. Cloudflare relies on Standard Contractual Clauses for international data transfer.

By continuing to use the site while accepting non-essential cookies, you understand that your data may be processed in these jurisdictions.

8. Your rights under GDPR

Under GDPR Articles 15 to 22, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectify — ask us to correct data that is incomplete or inaccurate.
• Erase — ask us to delete personal data (the "right to be forgotten"), subject to legal retention obligations.
• Restrict — ask us to stop processing your data while a concern is investigated.
• Object — object to processing based on our legitimate interest.
• Port — request your data in a structured, commonly used format.
• Withdraw consent — for any processing based on consent (primarily cookies).

To exercise these rights, write to info [at] vvmdigital [dot] com with a clear description of your request. We respond within the GDPR-mandated one-month window.

You also have the right to lodge a complaint with the Commission for Personal Data Protection of Bulgaria (CPDP) — the Bulgarian supervisory authority. Their website is https://www.cpdp.bg.

9. Cookies

Cookies set through this site:

Strictly necessary cookies (such as cookie_consent and __cf_bm) are set without requiring consent. Non-essential cookies (GA4 and Yandex Metrica) are set only after you accept in the cookie banner, and you can withdraw consent at any time via the banner's settings link.

10. Contact

For any question about this Privacy Policy or your personal data:

Email: info [at] vvmdigital [dot] com