Privacy policy

Effective from 16 September 2026

This policy explains how WEBTACT EOOD processes the personal data of visitors to webtact.bg, of people who write to us, of our clients and of job applicants. It complies with Regulation (EU) 2016/679 (GDPR), the Bulgarian Personal Data Protection Act (ЗЗЛД) and the Bulgarian Electronic Communications Act (ЗЕС).

1. Data controller

We are not required to appoint a data protection officer. For any questions about personal data, write to office@webtact.bg.

2. What data we process

When you write to us through the form

• Name and phone number (required fields).
• Email, company, selected service, approximate budget and message text (optional).
• The page the form was sent from, the website language, and the date and time.
• The IP address the form was sent from. We keep it with the enquiry as protection against abuse. To limit the number of submissions, we also keep an irreversibly encoded (hashed) form of the IP address for one hour.

Enquiries are stored in the website's admin panel, which only authorised staff can access. We also receive them by email. If you have given an email address, we send you an automatic confirmation that we have received your enquiry.

When you email us, call us or write to us on Viber

Your name, phone number, email and the content of the correspondence.

When you are our client

• Details of representatives and contact persons: names, position, phone, email.
• Invoicing and payment details.
• Access to systems you give us for the work (website, hosting, ad and analytics accounts).
• Personal data of your customers and visitors that we come across during the work. We process this data on your behalf (see section 8).

When you apply for a job

The data in the CV, cover letter and work samples you email us, and our notes from your interview.

When you browse the website

• Technical data in the server logs: IP address, browser, device, page visited, date and time.
• Data about the visit and interactions (for example clicking a phone number or email, sending a form), collected by Google Analytics, Google Ads, Meta and OpenAI, only if you have given consent in the cookie banner. The details are in section 4 and in the Cookie policy.
• If you have not given consent, Google may receive anonymised cookieless signals, as described in section 4.

When you interact with us on social media

Your profile name, and your messages and comments on our Facebook page. For the page statistics (Page Insights), we are joint controllers with Meta Platforms Ireland Limited.

When you use the free SEO tools

The email address you enter, the address of the site or page you are analysing, the data you fill in on the relevant tool's form, your IP address and a record of your consent (the consent text, date and time). We use them to generate the report and send it to you by email.

3. Purposes, legal bases and retention periods

Once the retention periods expire, we delete the data or anonymise it so that it can no longer be linked to you.

Your name and phone number are needed for us to reply to your enquiry. All other data is provided voluntarily. The tick box in the form confirms that you have read this policy. The basis for processing your enquiry is your request, not a separate consent.

4. Advertising, statistics and measurement

The website loads its statistics and advertising tools through Google Tag Manager. Until you make a choice in the banner, all categories are switched off. The Meta and OpenAI tools run only after you allow the “Advertising” category. You can change your choice at any time from “Cookie settings” at the bottom of every page.

Google (Google Tag Manager, Google Analytics 4, Google Ads)

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC, USA.
• Google Analytics 4 shows us how many visitors the website has, where they come from and which pages they view. IP addresses are not stored in Google Analytics 4.
• Google Ads measures which ads lead to enquiries (conversions) and lets us show ads to people who have visited the website (remarketing).
• Enhanced conversions: when you send the form and have allowed advertising, your email and phone number are irreversibly encoded (SHA-256) in the browser and sent to Google to establish whether the form was sent after an ad click.
• Google Consent Mode v2: Google's tags receive a signal about your choice for four types of data: statistics, advertising cookies, sending data for advertising, and personalised ads. Until you allow them, Google neither sets nor reads cookies. It may receive anonymised cookieless signals (browser type, time, page, whether a conversion took place), which it uses for statistical modelling. If you refuse, the website carries the ad click identifier in the page address instead of storing it in a cookie, and removes advertising identifiers from requests.
• For measurement, Google acts as our processor, and for its own purposes (for example improving ads) as an independent controller, under Google's data processing terms. More information: policies.google.com/privacy and how Google uses information from sites.

Meta (Facebook and Instagram)

• Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Data may be transferred to Meta Platforms, Inc., USA.
• The Meta Pixel in the browser and the Conversions API from the server send Meta which pages you visited and whether you sent a form or clicked a phone number or email, together with your IP address, browser and the identifiers from the _fbp and _fbc cookies. If you sent the form, a hashed email and phone number may also be sent (advanced matching). The two channels are used together, and duplicate events are removed.
• We use the data to measure our ads, to show ads to website visitors (custom audiences) and to people with similar interests (lookalike audiences). Lookalike audiences are created by Meta. We do not receive data about the people in them.
• For the collection and transmission of data from the website to Meta, we are joint controllers with Meta under Art. 26 GDPR, in accordance with the Meta Controller Addendum. We are responsible for informing you and asking for your consent. Meta is responsible for further processing and for handling your rights regarding the data it stores.
• Meta's policy: facebook.com/privacy/policy. Ad preferences: facebook.com/adpreferences.

OpenAI (ads in ChatGPT)

• Provider: OpenAI Ireland Limited, Ireland. Data may be transferred to OpenAI OpCo, LLC, USA.
• The OpenAI pixel is loaded from bzrcdn.openai.com and sends data to bzr.openai.com. It stores the click identifier from an ad in ChatGPT in the __oppref cookie and tells OpenAI whether an enquiry was sent after the click.
• The data sent is the page visited, the event type, the click identifier, IP address and browser. If the feature is enabled, the email and phone number from the form are irreversibly encoded (SHA-256) in the browser before being sent.
• We use the data only to measure whether our ads in ChatGPT lead to enquiries. OpenAI's policy: openai.com/policies/privacy-policy.

How to limit advertising

• Switch off the “Advertising” category in “Cookie settings” at the bottom of the website.
• Google ad settings: myadcenter.google.com.
• Browser add-on that blocks Google Analytics: tools.google.com/dlpage/gaoptout.

5. Who we share data with

We do not sell personal data. We share it only when needed, and only as far as needed, with:

• The hosting provider where the website and database are located: Jump.BG, Bulgaria.
• The email service provider we use to receive and send emails: Jump.BG.
• Google, Meta and OpenAI, as described in section 4 and only with your consent.
• Providers of AI tools we use in our work, under the conditions in section 9.
• Our accountant, banks, lawyers and auditors, when necessary.
• Public authorities, when required by law.
• Ninorai (Navia System DPK, UIC 208893566) – processes the free SEO tools data on our behalf and generates the reports. Ninorai uses its own sub-processors, listed in section 6.

Providers who process data on our behalf are bound by a contract with us under Art. 28 GDPR, which obliges them to protect the data and use it only on our instructions.

6. Transfers of data outside the European Union

Google, Meta and OpenAI may transfer data to the USA. Such transfers are based on the European Commission's adequacy decision of 10 July 2023 under the EU-U.S. Data Privacy Framework, where the recipient is certified under it. You can check this at dataprivacyframework.gov. Where this does not apply, the transfer is based on the standard contractual clauses approved by the European Commission and on additional safeguards.

For the free SEO tools, Ninorai processes the data on servers in Germany (Hetzner Online GmbH). In order to produce the report, the address of the analysed site and the data entered on the form are shared with: Anthropic PBC (USA) – generating the report text; DataForSEO LLC (USA) – keyword and ranking data; Ahrefs Pte. Ltd. (Singapore) – domain rating; Google (PageSpeed Insights) – speed measurement. Your email address is not used for these lookups. Transfers outside the EU are based on the European Commission's standard contractual clauses.

7. How we protect data

• The website works only over a secure connection (HTTPS).
• Access to the admin area is limited to authorised staff, with personal accounts and protection against repeated login attempts.
• The website software is updated regularly, and backups are stored separately from the website.
• Our staff are bound by confidentiality.
• In the event of a security breach that poses a risk to you, we notify the Commission for Personal Data Protection within 72 hours and, when the risk is high, the people affected as well.

8. When we process data on behalf of our clients

When we build or maintain a website, store or ad campaigns for a client, the data of the client's visitors and customers is processed on the client's behalf. In that case, our client is the controller and we are the processor. If you are a visitor to such a website, please contact its controller first.

9. Artificial intelligence and automated decisions

• We do not make decisions based solely on automated processing that produce legal effects for you or similarly significantly affect you (Art. 22 GDPR).
• We use AI tools for draft texts, analysis and automating our work. We do not enter personal data into them, unless it is necessary for a specific task and the provider is bound by a contract that does not allow it to use the data to train models. The results are checked by a person.
• Advertising platforms use their own algorithms to decide who to show an ad to. The platforms themselves are responsible for that processing.
• If we add a chat or another AI assistant to the website, we will clearly tell you that you are interacting with AI, in accordance with Regulation (EU) 2024/1689 (the Artificial Intelligence Act).
• Reports from the free SEO tools are generated automatically, including by language models. They are advisory, do not constitute professional advice and produce no legal effects for you.

10. Your rights

• Access to the data we process about you, and a copy of it (Art. 15 GDPR).
• Rectification of inaccurate or incomplete data (Art. 16).
• Erasure of the data when we no longer have grounds to keep it (Art. 17).
• Restriction of processing (Art. 18).
• Portability: receiving your data in a machine-readable format or asking us to transfer it to another controller (Art. 20).
• Objection to processing based on legitimate interest, and to direct marketing always and without giving reasons (Art. 21).
• Withdrawal of consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3)). For cookies, you can do this from “Cookie settings”.
• Complaint to a supervisory authority (Art. 77) and judicial remedy (Art. 79).

To exercise your rights, write to office@webtact.bg or to our correspondence address. We may ask you for information to confirm your identity. We reply without undue delay and within one month at the latest. For complex or numerous requests, this period may be extended by a further two months, and we will let you know. Exercising your rights is free of charge.

For the data that Meta, Google and OpenAI store as independent controllers, you can also contact them directly through the links in section 4.

11. Complaint to the Commission for Personal Data Protection

If you believe your rights have been infringed, you can file a complaint with the Commission for Personal Data Protection (КЗЛД): 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, email kzld@cpdp.bg, website cpdp.bg. We would be glad if you wrote to us first, so we can try to resolve the matter.

12. Children

Our website and services are intended for adults and for businesses. We do not knowingly collect data from people under 18. If we find out that we have received such data, we will delete it.

13. Changes to this policy

We may update this policy when we change the way we work or the tools on the website. The current version is always on this page with the date from which it applies. If we add a new statistics or advertising tool, we will ask for your consent again.

14. Contact

For questions about personal data: office@webtact.bg, phone +359 878 466 939, 15 Odrin St, Burgas 8000. See also the Cookie policy and the Terms and conditions.