Privacy Policy

1. Data controller

The controller of personal data is „СС Херитидж" ООД (SS Heritage Ltd.), UIC 208752366, with registered office at 39 Parva St., Dabnitsa village, Bulgaria (hereinafter “the Company”, “we”).

For questions related to the processing of personal data, you can contact us at: privacy@ssheritage.com.

2. What personal data we collect

Depending on how you interact with the Website, we may collect the following categories of personal data:

• Contact form data: name, email address, phone number (if provided), message content
• Data when concluding a contract: name/company name, UIC (for legal entities), address, billing details, bank information (for payment purposes)
• Technical data: IP address, browser type, device — collected automatically when visiting the Website through the hosting provider and/or CDN service
• Cookies: The Website uses cookieless analytics — see section 7 for details

3. Legal basis for processing

We process personal data on the following legal bases under Article 6 of the GDPR:

• Consent — when you fill in the contact form, you consent to your data being processed so that we can reply to you
• Performance of a contract — when a service contract is concluded, we process the data necessary for its performance (invoicing, communication)
• Legitimate interest — for the purposes of improving the Website, security and preventing abuse

4. Purposes of processing

Personal data is processed for the following purposes:

• Replying to inquiries submitted through the contact form
• Concluding and performing service contracts
• Issuing invoices and accounting in accordance with Bulgarian law
• Communication related to ongoing services
• Improving the functionality and security of the Website

5. Third parties and data processors

In order to provide the Services, we use the following third-party providers, who may have access to certain data in their role as “data processors”:

• Hosting provider — provides the Website’s technical infrastructure
• CDN and website protection provider (incl. cookieless traffic analytics — does not set cookies, but temporarily processes IP addresses for statistical purposes)
• Email communication provider — for business correspondence
• Client inquiry management system — for organizing communication with clients
• Invoicing provider — for issuing invoices; invoicing communication is handled from billing@ssheritage.com

These providers process data solely on our instructions and under data processing agreements (DPAs) concluded with them, including safeguards for data transfers outside the EEA, where applicable.

We do not sell or rent personal data to third parties for marketing purposes.

6. Retention period

• Contact form data — up to 12 months from the last contact, unless it develops into a contractual relationship
• Contract-related data — for the term of the contract and an additional 10 years in accordance with Bulgarian accounting and tax law
• Technical/log data — according to the retention policies of the hosting/CDN provider (usually up to 30 days)

7. Cookies

The Website uses cookieless analytics for traffic analysis. It does not set cookies and does not store information on the user’s device — it does not require separate consent within the meaning of the ePrivacy Directive. However, the analytics temporarily process IP addresses for statistical purposes, which constitutes processing of personal data under the GDPR (see sections 3-5 above).

The Website may use technically necessary cookies related to the operation of the CDN/protection provider (e.g. to protect against automated attacks), which do not require consent as they are strictly necessary for the secure operation of the Website.

8. Rights of the data subject

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — to request information about what data we process about you
• Right to rectification — to request correction of inaccurate data
• Right to erasure (“right to be forgotten”) — to request deletion of your data, under certain conditions
• Right to restriction of processing
• Right to data portability
• Right to object to processing based on legitimate interest
• Right to withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal

To exercise these rights, contact us at privacy@ssheritage.com.

You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP):

• Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
• Website: https://www.cpdp.bg

9. Data security

The Company applies appropriate technical and organizational measures to protect personal data, including SSL encryption, restricted access to data, and secure hosting with active protection against malicious attacks.

10. Changes to this policy

This Privacy Policy may be updated periodically. Changes take effect from the date of their publication on the Website.

11. Contact

For any questions about this Privacy Policy:

• Email: privacy@ssheritage.com
• Address: 39 Parva St., Dabnitsa village