1. Data Controller

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and the Bulgarian Personal Data Protection Act (PDPA, amended in 2018), we inform you:

Field	Data
Controller	Deseo Web Services OOD
Address	12 Emil Bersinski Str., 5th Floor, Sofia, Bulgaria
UIC	208590875
VAT	BG208590875
Contact email	petya@deseolab.com

2. Data We Collect

Depending on the requested service, we may collect the following categories of personal data:

Identification data: first name, last name, company
Contact data: email, phone
Browsing data: IP address, browser type, pages visited (via cookies)
Billing data: tax address, tax ID (in case of contracting services)
Communication data: content of messages sent via contact forms
Other data: any information that the user voluntarily decides to share

3. Purposes and legal bases of the processing

Purpose	Legal basis (Art. 6 GDPR)
Manage requests and inquiries received via form or email	Data subject consent (Art. 6.1.a)
Provision of contracted services	Performance of a contract (Art. 6.1.b)
Sending commercial communications and newsletters	Data subject consent (Art. 6.1.a)
Compliance with tax and legal obligations	Legal obligation (Art. 6.1.c)
Website improvement through statistical analysis	Legitimate interest (Art. 6.1.f)
Fraud prevention and site security	Legitimate interest (Art. 6.1.f)

4. Data retention period

Personal data will be retained for the strictly necessary time for each purpose:

Contact details and inquiries: up to 3 years from the last communication
Contractual data: during the term of the contract and an additional 5 years for tax obligations
Newsletter data: until the user withdraws their consent
Browsing data: as established in the Cookie Policy

5. Recipients and data transfers

Data will not be transferred to third parties except under legal obligation. However, we may share data with the following data processors providing services to Deseo Web Services OOD:

Provider	Service	Location
[Hosting provider]	Web hosting	[EU / EEA]
Google LLC	Analytics, G Suite tools	USA (EU SCCs)

All data processors have signed the contractual safeguards required by the GDPR.

6. International data transfers

In the event of data transfers to countries outside the European Economic Area (EEA), Deseo Web Services OOD ensures that such transfers are carried out under the appropriate safeguards provided for in the GDPR, specifically through Standard Contractual Clauses (SCCs) approved by the European Commission or, where applicable, on the basis of an adequacy decision.

7. Data subject rights

In accordance with the GDPR and Bulgarian legislation, the user has the right to:

Access (Art. 15 GDPR): know what data we process about you
Rectification (Art. 16 GDPR): correct inaccurate or incomplete data
Erasure (Art. 17 GDPR): request the deletion of your data ("right to be forgotten")
Restriction of processing (Art. 18 GDPR): request the restriction of processing in certain scenarios
Portability (Art. 20 GDPR): receive your data in a structured, commonly used format
Objection (Art. 21 GDPR): object to processing based on legitimate interest
Withdrawal of consent: at any time, without retroactive effect

How to exercise your rights?
You can exercise your rights by sending an email to hello@deseolab.com with the subject line "GDPR Rights Exercise", attaching a copy of your ID.

We will respond within a maximum period of 30 calendar days.

8. Competent supervisory authority

If you consider that the processing of your data does not comply with the GDPR, you have the right to lodge a complaint with the competent supervisory authority in Bulgaria:

Commission for Personal Data Protection (CPDP)
Address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
Web: www.cpdp.bg
Email: kzld@cpdp.bg

9. Minors

In accordance with the Bulgarian Personal Data Protection Act, the minimum age of consent for data processing is 14 years. If we are notified that we have collected data from a minor without appropriate parental consent, we will proceed to delete it immediately.

10. Data security

Deseo Web Services OOD has adopted the necessary technical and organizational measures to guarantee the security of personal data, preventing its alteration, loss, unauthorized access, or unauthorized processing, in accordance with the provisions of Art. 32 of the GDPR.

11. Updates to this policy

This Privacy Policy may be updated to reflect legislative, jurisprudential, or service changes. The "last updated" date at the beginning of the document indicates when the most recent review took place. In the event of substantial changes, we will notify you through available channels.