Privacy policy
In short: We collect only the data you send us so that we can reply to your enquiry, plus the technical data needed to keep the website secure. Everything is stored on our own servers in Bulgaria. We do not use tracking cookies, we do not sell data and we do not use it for advertising.
About this translation
This is an English translation provided for convenience. The Bulgarian version is the authoritative text; in case of any discrepancy, the Bulgarian version prevails.
Who processes your data
The controller of your personal data is NodePoint EOOD (НодПойнт ЕООД, trade name NodePoint), UIC 208955441, VAT No. BG208955441, with its registered office at 47 Tsar Kaloyan St., 3rd floor, 8000 Burgas, Bulgaria. The customer premises are at 47 Tsar Kaloyan St., ground floor, Burgas. Managing director: Todor Karachorbadzhiev.
Contact for personal data matters: office@nodepoint.bg · phone +359 887 975 180.
NodePoint EOOD has not appointed a data protection officer. The managing director is responsible for all personal data matters — write to office@nodepoint.bg.
What data we process, why and for how long
| When | What data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| You send an enquiry through the form | Name; phone or email; selected service; message; optionally, how you heard about us; the page you are writing from; campaign parameters in the address (UTM), if any | To reply to your enquiry and prepare a quote | Art. 6(1)(b) — steps taken at your request before entering into a contract; for general questions — Art. 6(1)(f), our legitimate interest in replying | 6 months after the last communication if no contract follows; if one does — as for the contract documents |
| The form shows an error or a confirmation | The values entered in the form, under a random identifier | So that you do not lose what you wrote if there is an error, and so that you see a confirmation | Art. 6(1)(f) — legitimate interest | up to 15 minutes, then deleted automatically |
| You send an enquiry | A pseudonymised IP address (an irreversible keyed hash) and the time of the attempts | Protection against spam and abuse (limiting the number of submissions) | Art. 6(1)(f) — legitimate interest in security | 1 hour after the last attempt |
| You send an enquiry | Form log: date and time, pseudonymised IP, selected service, page, result (sent, error, spam) — without your name, contact details or message | Security and detection of technical errors | Art. 6(1)(f) — legitimate interest | 30 days |
| You write to us by email, phone or WhatsApp | The data you give us | Replying and communicating with you | Art. 6(1)(b) or (f) | As for enquiries through the form |
| You browse the website | Server log: IP address, date and time, page address, browser (User-Agent), the referring page | Security, detection of attacks and errors, year-on-year comparison of visits (including from search engines and AI assistants) | Art. 6(1)(f) — legitimate interest | 13 months — so that the same month can be compared across two consecutive years; then deleted |
| You browse the website | Aggregated statistics (Umami): pages visited, referring page, device type and browser, country — without cookies and without storing your IP address | To understand which pages are useful | Art. 6(1)(f) — legitimate interest | The statistics are aggregated and do not identify you |
You use the NIS2 check (/en/nis2/check/) | Your answers. With JavaScript they stay in your browser and are not sent to us. Without JavaScript each step goes through the page address and ends up in the server log (row above). The statistics (Umami) do not record the answers. | To show you the result | Art. 6(1)(f) — legitimate interest | Not stored separately; server log — 13 months. If you send the result as an enquiry, the enquiry rows apply |
| You commission a computer forensic examination or analysis | The data on the devices and storage media you hand over to us, and the handover records | Carrying out the commissioned examination | Art. 6(1)(b) — contract; for third-party data on the device — Art. 6(1)(f), the client's legitimate interest in protecting their rights | The device is returned with a handover record after the examination; working copies — up to 6 months after the report is delivered (or another period set in the brief), after which they are destroyed with a record or handed over to you |
| You become a client | Contract, quote and invoice data | Performance of the contract, accounting and tax obligations | Art. 6(1)(b) and (c) (legal obligation) | For the periods required by Bulgarian accounting and tax legislation; other contract documents — until the limitation periods for possible claims expire |
Enquiries about computer forensics: please do not send evidence, documents or third-party data through the form, by email or on WhatsApp. If a message nevertheless contains such data, we use it only to reply and delete it if no assignment follows.
We do not make automated decisions and do not carry out profiling.
Who receives the data
Only the managing director of NodePoint EOOD has access to enquiries. The website, email, form, server logs and statistics (Umami) run on servers managed by NodePoint in Bulgaria. We do not use external hosting, email or analytics providers that would receive your data.
If you choose to write to us on WhatsApp, your messages also pass through the WhatsApp service (Meta) and are processed under its terms as well.
We do not sell data or share it for marketing. Data is disclosed to public authorities only when the law requires it.
Transfers outside the EU: we do not transfer your data outside the European Union. The only possible exception is if you yourself choose WhatsApp as a channel — in that case WhatsApp's terms apply.
Your rights
You have the right:
- of access to your data and to a copy of it;
- to rectification of inaccurate data;
- to erasure ("right to be forgotten") where there is no ground for keeping it;
- to restriction of processing;
- to data portability for the data you have provided to us;
- to object to processing based on legitimate interest;
- to lodge a complaint with the Bulgarian Commission for Personal Data Protection — 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg.
To exercise a right, write to office@nodepoint.bg. We reply within one month (Art. 12(3) GDPR). We may ask you to confirm your identity so that we do not disclose data to someone else.
How we protect the data
The website works only over HTTPS. Enquiries arrive in a business mailbox that only the managing director can access. IP addresses in the spam protection and the form log are kept only as an irreversible keyed hash. We do not use third-party scripts, fonts from external servers, embedded maps or videos that would send data about you to third parties. The servers are backed up daily and the backups are kept in a separate room.
Links to other websites
nodepoint.bg contains links to sentinel.nodepoint.bg, news.nodepoint.bg, Google Maps and our profiles on Facebook, Instagram, LinkedIn, YouTube and TikTok. These websites have their own policies. The links to Sentinel and News contain parameters (UTM) that only show that you came from nodepoint.bg — they contain no personal data.
Changes
When the policy changes, we update the date at the top. If there is a significant change in the way we process data, we will also mention it on the home page.