This policy explains what personal data ASLET Ltd. processes in connection with the aslet.net website and the inquiries sent to us, for what purposes and on what legal basis, and what your rights are under Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and the Bulgarian Personal Data Protection Act.
1. Data controller
- Controller
- ASLET Ltd. (АСЛЕТ ООД), company ID (EIK) 208845678
- Registered office and management address
- 32 Aleksandar Stamboliyski St., floor 1, apt. 2, Vazrazhdane residential district, Burgas, Bulgaria
- Privacy contact e-mail
- [email protected]
- Telephone
- +359 888 637 121
2. Scope of this policy
This policy applies to visitors of aslet.net and to people who contact us through the contact form or by e-mail, whether on their own behalf or as representatives of a company or organisation.
The website presents our services, prices and projects. No services are sold and no payments are made through it. Processing of personal data when performing a specific contract with a client is also governed by that contract.
3. What personal data we process
Contact form data
When you send us an inquiry or a request for a consultation or quotation, we process your full name, e-mail address, telephone number, the selected project type, the content of your message and the language of the page it was sent from. Please do not include information in your message that is not needed for the inquiry.
E-mail correspondence
If you e-mail us, or the conversation continues after an inquiry, we process your contact details and the content of the correspondence, including the information you share about your project.
Technical data and security logs
With every visit your browser sends technical data needed to load and protect the website: IP address, date and time of the request, the page requested, and the browser and device type. This data is processed by us and by the infrastructure providers listed in section 6, including to limit how often the contact form can be submitted and to prevent abuse.
Statistics and analytics (only with your consent)
If you allow analytics cookies, we use Google Analytics 4 and Microsoft Clarity, loaded through Google Tag Manager. They collect online identifiers (such as a browser identifier), information about the pages you visit and your actions on the site, device data and approximate location. Microsoft Clarity also creates session recordings: clicks, scrolling and mouse movements. Without your consent these tools are not loaded.
Advertising features (only with your consent)
If you also allow marketing cookies, Google Analytics may use Google’s advertising features, such as building advertising audiences and ad measurement. Without your consent, advertising signals are sent as denied.
Your settings
We store your cookie choices (which categories you allowed, the date and the policy version), your preferred language and theme. See the Cookie Policy for details.
4. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Reviewing and answering an inquiry, preparing a quotation | Contact form data, correspondence | Art. 6(1)(b), where you contact us as a prospective contracting party (e.g. an individual or a sole trader). Art. 6(1)(f), where you write on behalf of a company or organisation: our legitimate interest in answering business inquiries. |
| Concluding and performing a contract | Contact details and correspondence | Art. 6(1)(b); for client representatives, Art. 6(1)(f) (legitimate interest in performing the contract with the company they represent) |
| Compliance with legal obligations (accounting, tax) | Data in contracts, invoices and related documents | Art. 6(1)(c) |
| Website security, preventing spam and abuse | IP address, technical data, number of submissions | Art. 6(1)(f): legitimate interest in protecting our website and services |
| Establishing, exercising or defending legal claims | Data relevant to the specific matter | Art. 6(1)(f) |
| Website statistics and usage analysis | Online identifiers, usage and device data, session recordings | Art. 6(1)(a) (consent) and Art. 4a of the Bulgarian Electronic Commerce Act |
| Google advertising features | Online identifiers and usage data | Art. 6(1)(a) (consent) |
| Remembering your cookie choices | Allowed categories, date and version | Art. 6(1)(c) in conjunction with Art. 7(1) (obligation to be able to demonstrate consent) |
Where we rely on legitimate interests, you have the right to object (section 10). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before the withdrawal.
5. Do you have to provide personal data?
The contact form fields marked with an asterisk (*) are needed to review your inquiry and get back to you. The form cannot be sent without them. If you prefer to share less information, you can write to us directly at [email protected].
Allowing analytics and marketing cookies is entirely voluntary. If you refuse, you can use the website without any restriction.
6. Recipients and processors
We do not sell personal data. We share it only with providers that help us run the website and our communication, and only to the extent necessary:
| Provider | Service | Data |
|---|---|---|
| Cloudflare, Inc. | Content delivery and website protection, DNS, the service that sends contact form messages (Cloudflare Workers), e-mail forwarding | Technical data for every request; the content of inquiries when they are sent |
| Hosting provider | The servers that run the website | Technical data and logs; inquiries while they are processed |
| E-mail service provider | The [email protected] mailbox | Inquiries and correspondence |
| Google Tag Manager, Google Analytics 4 and Google’s advertising features — only with consent | Online identifiers, usage and device data | |
| Microsoft | Microsoft Clarity — only with consent | Online identifiers, usage data, session recordings |
For Google’s advertising features and for Microsoft Clarity, the providers may also process data for their own purposes, as independent or joint controllers, under their own terms. More information: Google Privacy Policy and Microsoft Privacy Statement.
Data may also be disclosed to accountants and legal advisers bound by confidentiality, and to public authorities and courts where we are legally required to do so.
7. Transfers outside the EEA
Cloudflare, Google and Microsoft belong to groups headquartered in the United States. Personal data may therefore be transferred to or accessed from outside the European Economic Area.
Such transfers rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795), for recipients certified under it, and/or on standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914). You can request information about the applicable safeguards at [email protected].
8. Retention periods
- Inquiries that do not lead to a contract: up to 24 months after the last correspondence, after which they are deleted.
- Inquiries and correspondence related to a contract: for the term of the contract and afterwards for the limitation period for possible claims, and for the periods required by accounting and tax legislation.
- Technical logs: up to 30 days, unless needed to investigate a specific incident.
- Google Analytics: up to 14 months (Google Analytics data retention setting). Microsoft Clarity: according to Microsoft’s retention periods.
- Your cookie choices: up to 6 months, after which we will ask you again.
9. Security measures
We apply appropriate technical and organisational measures, including:
- an encrypted connection (HTTPS) across the whole website;
- website protection and limiting automated abuse;
- server-side validation of all form data, limits on how often the form can be sent and protection against automated spam;
- inquiries are not stored in a website database: they are delivered as e-mail, and the connection to the sending service is protected;
- access to the mailbox only for authorised persons;
- analytics and advertising tools are loaded only after your consent.
No system is entirely free of risk, but we review our measures when necessary.
10. Your rights
Under the GDPR you have the right:
- of access to your personal data and to a copy of it (Art. 15);
- to rectification of inaccurate data (Art. 16);
- to erasure (“right to be forgotten”) (Art. 17);
- to restriction of processing (Art. 18);
- to data portability for data you provided to us, where processing is based on consent or a contract and carried out by automated means (Art. 20);
- to object to processing based on legitimate interests (Art. 21);
- to withdraw your consent at any time; for cookies, via the “Cookie Settings” button at the bottom of every page (Art. 7(3)).
To exercise your rights, write to us at [email protected]. We will respond without undue delay and within one month at the latest; for complex or numerous requests this may be extended by two further months, and we will tell you if so. We may ask for information to confirm your identity.
11. Right to lodge a complaint
If you believe that we process your data unlawfully, you have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, www.cpdp.bg, or with the supervisory authority of the EU Member State where you live or work. We would appreciate the chance to resolve the matter with you first.
12. Automated decision-making and profiling
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). If you allow marketing cookies, Google may include your browser in advertising audiences, which constitutes profiling for advertising purposes.
13. Children
The website is intended for business clients and is not directed at children. We do not knowingly collect personal data of children.
14. Changes to this policy
We may update this policy when we change how we process data or when the law requires it. The current version and its date are published on this page. If significant changes affect your cookie consent, we will ask you again.