Privacy Policy

1. Who We Are

Ynnovative is a trading brand of Ynnovative Consulting Ltd, registered in the Republic of Bulgaria. We are the data controller for personal data collected through this website.

Registered address: 56A Yanko Sakazov Blvd, 1504 Sofia, Bulgaria
Company registration number (EIK): [PLACEHOLDER: to be confirmed]
Email: email us

We are committed to protecting your personal data and processing it in accordance with the General Data Protection Regulation (GDPR) and applicable Bulgarian data protection law.

2. What Data We Collect

When you use this website or contact us, we may collect the following personal data:

• Identity data: first name, last name, job title, company name
• Contact data: email address, phone number
• Enquiry data: the content of messages or questions you submit to us
• Communication preferences: whether you have consented to be contacted by email or phone
• Technical data: IP address, browser type, device type, pages visited, and time of visit, collected automatically by our website hosting infrastructure

This website is directed at business professionals. We do not knowingly collect personal data from individuals under the age of 18. If you are under 18, please do not submit any personal information through this website. If we become aware that we have inadvertently collected data from someone under 18, we will delete it promptly.

3. How We Collect It

Contact & Enquiry Forms

When you submit a form on this website, your data is transmitted to us via Web3Forms (web3forms.com), a third-party form processing service. Web3Forms acts as a data processor on our behalf and delivers your submission to our team by email. Your data is not stored permanently by Web3Forms beyond the transmission process.

By submitting a form, you confirm that the information you provide is accurate and that you have read this Privacy Policy.

Automatic Collection

When you visit our website, certain technical data is collected automatically by our hosting infrastructure and analytics tools. This includes IP address, browser type, and pages visited. This data is used solely for security monitoring and aggregate performance analysis, it is not used to identify you personally.

Direct Communications

If you contact us directly by email or phone, we will retain a record of that communication and any personal data included within it.

4. Why We Use It

We use the personal data we collect for the following purposes:

• To respond to your enquiry or contact request
• To assess whether our services are a fit for your organisation
• To send you information about our services where you have consented to this
• To contact you by email or phone in accordance with your stated preferences
• To maintain records of communications for our legitimate business operations
• To improve the performance and usability of this website
• To comply with legal and regulatory obligations

We do not use your personal data for automated decision-making or profiling.

5. Legal Basis for Processing

Under GDPR, we rely on the following legal bases to process your personal data:

• Consent: where you have explicitly agreed to be contacted by email or phone via our contact form. You may withdraw consent at any time by emailing email us.
• Legitimate interests: to respond to unsolicited enquiries and manage our business relationships, where our interests are not overridden by your rights.
• Contract: where processing is necessary to take steps at your request prior to entering into a consulting engagement, or to perform an existing engagement.
• Legal obligation: where we are required to process or retain data to comply with applicable law.

6. Who We Share Data With

We do not sell your personal data. We may share it with the following categories of recipients:

• Web3Forms: our contact form processor, used to transmit enquiry submissions to our team. See web3forms.com/privacy.
• Microsoft: we use Microsoft 365 (including Outlook and Teams) for internal communication and client management. Data processed within these tools is subject to Microsoft's data processing terms.
• Professional advisers: legal, financial, or compliance advisers where necessary and subject to confidentiality obligations.
• Regulatory or law enforcement bodies: where we are legally required to disclose information.

Any third party we share data with is required to handle it securely and only for the specified purpose.

7. How Long We Keep It

• Enquiry data (form submissions where no engagement follows), retained for up to 18 months, then deleted.
• Client engagement data: retained for the duration of the engagement and for 6 years thereafter, in line with standard commercial limitation periods under Bulgarian law.
• Email correspondence: retained for up to 3 years from the date of last contact, unless part of an active engagement.
• Technical/log data: retained for up to 90 days for security and performance purposes.

After the applicable retention period, data is securely deleted or anonymised.

8. Cookies & Tracking

This website uses a small number of cookies to support basic functionality and performance analysis. We do not use advertising or behavioural tracking cookies.

• Strictly necessary cookies: required for the website to function (e.g. session state). These cannot be disabled.
• Analytics cookies: used to understand aggregate traffic patterns and improve the site. No personally identifiable information is collected.

You can control or disable cookies through your browser settings. Note that disabling cookies may affect certain website functionality.

We do not use Facebook Pixel, Google Ads remarketing, or other third-party advertising trackers on this website.

9. Your Rights

Under GDPR, you have the following rights regarding your personal data:

To exercise any of these rights, email us at email us. We will respond within 30 days.

10. Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• HTTPS encryption across all pages of this website
• Access controls limiting who within our team can access personal data
• Use of reputable, GDPR-compliant third-party processors

No method of transmission over the internet is 100% secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by law.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we use. The "Last updated" date at the top of this page will always reflect the most recent version.

We recommend reviewing this page periodically. For material changes, we will make reasonable efforts to provide notice.

12. Contact & Complaints

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP) at cpdp.bg.