1. Data controller
LOD Corporation Ltd., company ID (EIK) 204881820, with registered office and address 67 Georgi Benkovski St., Pazardzhik, Bulgaria, email info@lod.bg, phone +359 897 414 350.
For any questions about personal data and exercising your rights, you can contact us at info@lod.bg with the subject “Personal data”.
2. What data we process and why
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| Contact form and enquiries | Name, email, phone, company, message content, IP address | Replying to the enquiry, preparing a quote, protection against abuse | Art. 6(1)(b) (pre-contractual steps) and (f) (legitimate interest) GDPR |
| Client contracts | Contact details of the client’s representatives and employees, billing data | Performance of the contract, invoicing, support | Art. 6(1)(b) and (c) (legal obligation) |
| Visit statistics | Page visited, referring website, device type, browser and operating system; a one-day anonymous identifier | Improving the website | Art. 6(1)(f) (legitimate interest) |
| Server logs | IP address, time, requested URL, browser | Security and attack detection | Art. 6(1)(f) (legitimate interest) |
| Google Analytics (only with consent, if enabled) | Identifiers in cookies, on-site behaviour data | Traffic analysis | Art. 6(1)(a) (consent) |
3. Statistics without cookies
Our own statistics do not use cookies and do not store IP addresses. To count unique visitors we create a one-way hash of the IP address and browser combined with a random key that changes every day and is not kept. This makes it impossible to track a visitor from one day to the next or to identify them.
4. Retention period
- enquiries that did not lead to a contract – up to 2 years from the last communication;
- contract data and accounting documents – according to the periods set by the Bulgarian Accountancy Act and tax legislation;
- visit statistics – up to 400 days;
- server logs – up to 90 days, unless needed to investigate an incident.
5. Recipients of the data
We do not sell or share your personal data with third parties for marketing. The data may be accessible to:
- our employees and subcontractors bound by confidentiality, only to the extent necessary;
- accountants, auditors and legal advisers;
- infrastructure providers that process data on our behalf under a contract pursuant to Article 28 GDPR;
- public authorities, where required by law.
The website is hosted in our own data centres in the Republic of Bulgaria. By default we do not transfer data outside the European Union. If Google Analytics is enabled and you give consent, data may be transferred to Google LLC in the USA on the basis of the EU–US Data Privacy Framework.
6. Your rights
Under the GDPR you have the right to:
- access the personal data we process about you (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure (“right to be forgotten”) (Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal;
- lodge a complaint with the Bulgarian Commission for Personal Data Protection – 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg, or with the supervisory authority of your EU country of residence.
We respond to requests within one month. How to submit a request is described on the page GDPR – data subject rights.
7. Security
We apply appropriate technical and organisational measures: encrypted connections (HTTPS), firewalls, access control, two-factor authentication for administrative access, regular updates and backups, and staff training.
8. Children’s data
The website is not intended for persons under 16 and we do not knowingly collect their data.
9. Changes
We may update this policy. The date of the last update is shown at the end of the page.