Privacy Policy

01Who is responsible for the data

The controller of personal data collected through this website is the provider operating under the Maina trading name.

Trading name

Maina

Provider / controller

MEGACOMP 2018 EOOD

UIC / registration

205162944

VAT status

VAT registered, VAT No. BG205162944; listed prices include 20% VAT

Registered office and address

Bulgaria, Plovdiv 4015, Zapaden district, 24B Bitolya Street

Business address

Plovdiv, 1A Skopie Street

Email

hello@builtbymaina.com

Telephone

+359 889 536 185

Company email

office@megacomp.bg

Company telephone

+359 32 580 988

02Data we process

We process only the information needed to understand and answer a project enquiry.

• name, email and any voluntarily provided company, store and current website address;
• selected project stage, services, budget range, timeframe and enquiry message;
• follow-up correspondence, proposals and notes connected with the requested service;
• limited technical server-log data such as IP address, date, time, requested resource and browser where generated by the hosting infrastructure for security and diagnostics.
• through Matomo, which we host ourselves: pages viewed, website interactions, time spent, approximate location and device/browser information - plus, only if you allow cookies, a first-party identifier that lets us tell a returning browser from a new one. The server truncates your IP address before storing it, and form content, names and personal email addresses are never sent as analytics parameters.
• We do not request special-category data, passwords or payment information. Do not include them in the form.

03Purposes and legal bases

Data is used only for these specific purposes:

• assessing and answering the enquiry, clarifying scope and preparing a proposal - steps requested before a contract under Article 6(1)(b) GDPR;
• protecting the form, preventing abuse, diagnostics and security - legitimate interests under Article 6(1)(f) GDPR;
• meeting applicable accounting, tax or other legal obligations if the relationship becomes contractual - Article 6(1)(c) GDPR.
• measuring website use through our own Matomo, on two different bases. Without cookies - before you answer the banner, and permanently if you decline - nothing is stored on or read from your device and your IP address is truncated before it is written, so this rests on the legitimate interest of understanding which pages are useful, Article 6(1)(f) GDPR, and you may object at any time at the address below. With cookies, it rests on your consent, Article 6(1)(a) GDPR, which you can withdraw whenever you like through "Cookie settings" in the footer without affecting the lawfulness of what came before.
• Acknowledging that the policy has been read does not make consent the legal basis for processing an enquiry. Form data is not used for newsletters or advertising without a separate valid basis.

04Recipients and processors

Access is limited to people at Maina working on the enquiry and the hosting and email providers to the extent needed to provide those services. Analytics data is shared with no one: Matomo runs on our own server in the EU and no third-party analytics provider receives it. Data may be disclosed to accounting or legal advisers and public authorities only where necessary or legally required. We do not sell personal data.

05International transfers

The website and email run on our own server rented from Hetzner Online GmbH, in its Helsinki data centre in Finland. A transfer outside the European Economic Area will take place only under an applicable adequacy decision or appropriate safeguards under Article 46 GDPR. Information about those safeguards may be requested from the controller.

06Retention

An enquiry that does not lead to a contract and its correspondence are deleted within 12 months of the last substantive contact, unless earlier deletion is requested and no retention ground applies. If a contract is signed, necessary data moves into the client record and is kept for the contract term and applicable legal, accounting and limitation periods. Technical logs follow the short security-retention period of the hosting provider. In analytics, your IP address is truncated at the moment the record is written; those raw records are deleted after 25 months, and the aggregate reports built from them carry no personal data and are kept.

07Your rights

Subject to the GDPR, you may request access, correction, erasure, restriction and portability and object to processing based on legitimate interests. Send requests to the controller's listed email. Reasonable identity verification may be requested.

• You may complain to the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, kzld@cpdp.bg, www.cpdp.bg.
• A complaint does not restrict your right to seek a judicial remedy.

08Security and automated decisions

We use reasonable technical and organisational safeguards, restricted access and protected communications. The form does not profile visitors or make decisions producing legal or similarly significant effects solely through automated processing.

09Changes and contact

This policy is updated when the form, providers or legal requirements change. The current date appears above. Use the controller's email for questions or rights requests.