Controller and contact
Controller: „Е-КУИТИ“ ЕООД, identification number: 201503615, address: България, гр. София 1680, район Красно село, бул. „България“ №56А, ет. 10, ап. 17. For privacy questions and rights requests, use the postal address stated above.
Data, purposes and legal bases
When the website loads, its technical infrastructure processes the IP address, date and time, requested resource and technical request data, such as browser and operating-system information and, when transmitted, the referring page address. These are used to deliver content, keep the website reliable and prevent abuse. The operator's basis for this processing is its legitimate interest in providing and protecting the website, subject to your rights.
When an enquiry is submitted, the form processes the name, reply details (email or telephone), selected complex or property and message you provide. The purpose is to reply and arrange the communication you request. General correspondence relies on the legitimate interest in handling enquiries, subject to your rights; where you expressly request specific steps before a contract, the pre-contractual basis applies to processing necessary for those steps. Rights requests are processed to meet applicable data-protection obligations. Send only information needed for your enquiry.
Browsing is not treated as consent to advertising. You do not need to send personal information to view the gallery; without information needed to respond, we may be unable to handle a particular enquiry. The form's checkbox acknowledges that you have read this policy. It is not blanket consent to processing or consent to advertising. An enquiry does not enrol you in a marketing list.
Hosting and recipients
The website is delivered through Vercel infrastructure. Hosting processes technical requests and related operational and security data. Vercel also describes processing of certain service-generated data for its own purposes in its notice: https://vercel.com/legal/privacy-notice . Roles and access depend on the particular service and agreement.
The planned flow submits the form through a server-side POST handler on Vercel and AgentMail to forward the enquiry to an authorised recipient for the operator. The recipient address is not published in the page or client code. Activation, settings and delivery through this flow have not yet been verified. Data may be accessible to authorised persons and necessary communication and technical-service providers; disclosure to an authority occurs only on an applicable legal basis. We use no advertising or analytics code of our own.
Location and international transfers
Vercel uses international infrastructure. This does not mean that all data is processed only in Bulgaria or the European Economic Area. Specific information about transfers outside the EEA, the applicable mechanism and how to obtain a copy of relevant safeguards is set out below:
Vercel's DPA for the Pro service used provides for processing by Vercel Inc. in the United States and other countries where Vercel or its subprocessors operate. For transfers within their scope, section 13 and Schedule 3 incorporate the European Commission's 2021 Standard Contractual Clauses, using the module appropriate to the parties' roles. The public text and safeguards are available at https://vercel.com/legal/dpa ; you may also request a copy and clarification of safeguards relevant to your data by post at България, гр. София 1680, район Красно село, бул. „България“ №56А, ет. 10, ап. 17. For Vercel's processing as an independent controller, also see its privacy notice. For the planned sending through AgentMail, the specific contractual roles, processing locations, subprocessors and safeguards for international transfers have not yet been verified. This part of the draft remains incomplete and requires confirmation before activation; Vercel's safeguards are not automatically attributed to AgentMail.
Retention
Hosting's technical records are managed by Vercel. For service-generated personal data, Vercel states a minimum-necessary-period criterion based on processing purposes, contractual and legal obligations, dispute resolution and protection of rights; when no longer required, data is deleted or anonymised under its DPA and privacy notice. Those public documents do not specify one number of days for all such records. For form data and sending through AgentMail, specific settings and retention periods have not been verified; this Vercel criterion does not establish them.
Correspondence is retained for as long as necessary to handle and close the enquiry. Longer retention is allowed only for a specific applicable legal obligation or a need to establish, exercise or defend legal claims, with a separate applicable legal basis and limited to the data and period necessary. When that basis no longer applies, the data is deleted or anonymised.
Your rights, including erasure
Subject to applicable law, you may request access, rectification, erasure or restriction of processing. You may object to processing based on legitimate interests. Portability applies where its legal conditions are met; if processing relies on consent, you may withdraw it for the future. Erasure is not unconditional, for example where lawful retention is necessary for a legal obligation or legal claim.
Send your request by post to България, гр. София 1680, район Красно село, бул. „България“ №56А, ет. 10, ап. 17, stating what you request and enough information to identify the relevant data. Once the website's own contact form is actually activated, it may also be used for rights requests by stating this in the message. That channel and its delivery have not yet been verified; external spa/gym forms are not a channel for these requests. Do not send an identity document by default. If there are reasonable doubts, we may request necessary additional information. There are no user accounts to close.
We respond without undue delay and normally within one month. Where the legal conditions are met, this may be extended by up to two further months; we will explain the reasons within the first month. You may complain to the Bulgarian Commission for Personal Data Protection (https://cpdp.bg/) or another competent supervisory authority, including in the country of your habitual residence, workplace or alleged infringement. You do not have to contact us first.
Profiling and external websites
The gallery's own code does not profile users or make automated decisions producing legal or similarly significant effects. Links to other websites, including the spa and gym pages, do not embed their forms here. After opening them, the respective website's privacy information applies.
Updates
Changes to processing and this policy are reflected by an updated date. Information about technologies on your device is provided separately on the cookies and similar technologies page.