Privacy policy

1. Controller and contact

Tech Innovation Holding LTD is responsible for this website. Please use the following company contact details for privacy enquiries and to exercise your rights. Group companies are separate legal entities; this notice concerns the Holding website.

• Tech Innovation Holding LTD
• ТЕЧ ИНОВЕЙШЪН ХОЛДИНГ ЕООД
• EIK / UIC: 207650465
• ul. Aleksandar Veliki 13, floor 0 / ground floor, 8000 Burgas, Bulgaria
• tech@holding-ltd.bg
• +359 87 79 78 973

2. Website delivery and security

When a page is requested, connection and request data are processed to deliver it, maintain reliable operation and detect misuse. They include the IP address, date and time, requested address and HTTP request information; browser information and a referring address may be included if your browser sends them. The provider's exact access, error and security log fields are still being confirmed.

The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a secure, reliable and usable information website. The connection data required for delivery are necessary to open the site. This does not require a visitor account.

3. Contact form, email and telephone

The contact form sends your enquiry to an endpoint on holding-ltd.bg. General enquiries require first name, last name, email address, subject or topic, a message of at least 20 characters and acknowledgement of the privacy notice. Telephone and company are optional. For marked privacy requests, first name, last name and a free-text subject are optional. You may mark a privacy request. Acknowledging this notice is not consent to advertising. Email and telephone links open your own application.

A submitted form is first stored in a private SQLite queue. A separate worker hands it to an internal Holding mailbox through the local mail transport. Acceptance by the local mail transport does not prove arrival in that mailbox. After a confirmed transport handoff, the message content is cleared from the active queue while a technical receipt and duplicate-prevention record remains. If the handoff is uncertain, the queued content remains for manual review. The mailbox and backups are separate storage locations; please provide only the information needed for your enquiry. To limit misuse, the server derives a pseudonymous HMAC value from the client IP address using a secret key and stores it in a private rate-limit table. Expired entries can be removed on later requests. A separate cleanup job is also configured every five minutes for rate-limit entries older than 60 seconds; its first scheduled run was verified on 29 September 2026. The form queue does not store the raw IP address; the hosting provider's separate logs may do so. Cloudflare Turnstile additionally protects the form; its processing is described in the form-protection section.

For steps requested by you before entering a contract, the basis is Article 6(1)(b) GDPR where you are the prospective contracting party. General enquiries and communication with business contacts are based on Article 6(1)(f), our legitimate interest in responding and organising business communication. Article 6(1)(c) applies where a specific statutory obligation requires processing. Contact is voluntary; without the information necessary to understand or answer a request, we may be unable to deal with it.

4. Hosting, recipients and international processing

Hosting and email services are supplied by SuperHosting.BG EOOD, Bulgaria, UIC 131449987. Authorised company personnel and the hosting or email provider may have access as needed for their tasks. Disclosures to public authorities or other entitled recipients may occur where required by applicable law.

On 9 October 2026 the provider confirmed that our hosting services use no external subprocessors for hosting, hosted email or the associated technical support and involves no related transfers outside the EEA. This provider statement covers that hosting scope; it does not cover separate services for cloud storage or bot checks.

To restore website, form and email operations, we create full backups of the hosting account technically shared with FusionIT and also store copies in Google Drive. The account archive may contain Holding mailbox contents, contact enquiries and historical form-queue data; it also technically includes FusionIT data. The terms applicable to the Google account in use, access to the archives, processing locations and any transfers to third countries are still being checked.

5. Retention and deletion

The required retention period for correspondence depends on the purpose and progress of the enquiry, a resulting contract, applicable statutory retention duties and the need to establish, exercise or defend legal claims. Data may be retained only as long as the relevant basis requires; statutory retention and restricted retention for claims must be distinguished from active use.

Clearly linked contact-form enquiries and their replies are automatically deleted from the company mailbox by a daily job twelve calendar months after the last message. A new message restarts the period; no manual case closure is required. At most ten mail objects are permanently deleted per day. Unclear links, protected cases, attachments and identified contractual, tax, privacy and security records are excluded from this automatic process and handled according to their purpose and applicable statutory duties. Twelve months is our retention rule for contact-only enquiries. IMAP synchronises the mailbox change with connected mail clients; it does not guarantee secure physical deletion of all offline caches. Existing backups expire under their own retention period; deleted messages may reappear after a restore. According to the provider’s reply of 9 October 2026, server logs are handled through rotation and cleanup; in some cases they are retained for 13 months, or longer where statutory or authority requirements apply. The provider did not specify a firm maximum or a verifiable normal final-deletion criterion. Website Raw Access logs rotate monthly and may be retained longer depending on the account setting. SuperHosting backups are made several times a week and retained for at most 21 days.

Removing a message from the active Holding mailbox or content from the active form queue does not automatically remove existing account archives in Google Drive. Archive generations, access rules, retention and deletion periods, and the handling of data restored from an archive have not yet been conclusively verified.

6. Local settings and search

Privacy choices and a manually selected light or dark appearance are handled in your browser. Persistent storage of the appearance requires your permission. The cookie and local-storage notice describes the keys, expiry checks and withdrawal. To the extent personal data are involved, the optional persistent preference relies on Article 6(1)(a) GDPR; remembering your privacy choice and providing a requested temporary setting rely on Article 6(1)(f), our interest in respecting your choice and providing the requested function. Rules on access to terminal equipment apply independently.

The topic search filters the list already loaded in the browser. Search terms are not submitted to our server or an external search provider and are cleared when the search dialog closes. Opening a result makes the normal request for the selected page, without submitting the search term.

7. External services and automated decisions

This information website does not integrate analytics, advertising tracking, external fonts, embedded maps, videos or social widgets. Ordinary links to another website establish a connection to that service when opened; its own privacy information then applies. There is no visitor profiling or automated decision-making producing legal or similarly significant effects in the website functions described here.

8. Your rights

Subject to the statutory conditions, you may request access, rectification, erasure and restriction, object to processing based on legitimate interests and, where applicable, receive or transfer data under the right to portability. Consent may be withdrawn at any time with future effect; this does not affect the lawfulness of earlier processing. Refusing optional appearance storage does not prevent access to the website.

Use the controller's contact details above. We may request proportionate information needed to verify identity. GDPR requests must normally be answered within one month. If a lawful extension is needed because of complexity or the number of requests, you must be informed of it and its reasons within that month.

9. Complaints

You may lodge a complaint with a supervisory authority, in particular in your habitual residence, place of work or the place of the alleged infringement. In Bulgaria this is the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592; email: kzld@cpdp.bg.