Privacy policy

1. Data controller

Controller: “ISKREV CONSULTING” Ltd., UIC 207509557, registered office and address of management: bl. 457, entr. 1, fl. 13, apt. 75, Mladost 4 housing estate, Mladost district, 1715 Sofia, Bulgaria.

Email for data protection questions: [email protected]. The company has not appointed a data protection officer.

2. What data we collect

Through the contact and quote forms we collect only the data needed to respond to your inquiry:

• full name;
• company name;
• business email address;
• phone number (optional);
• the selected service and the project description;
• the website language in which you sent the inquiry;
• the date and time of the inquiry and the version of this policy you acknowledged;
• a cryptographic hash of your IP address — used only to protect against abuse; the IP address itself is not stored.

3. AI Managed Services inquiries

For an inquiry about operating an AI system we also collect: industry, type of AI solution, approximate number of agents or workflows, the name of the AI model provider and the hosting type (if you provide them), a description of the operational problems, the support you are looking for and your preferred communication language.

We explicitly ask you not to send passwords, API keys, access tokens, customer records or confidential documents. The form rejects text that looks like such data. Access to your systems is agreed separately, after an assessment and under a signed contract.

4. AI Automation Advisor

The AI advisor does not require personal data. Email addresses, phone numbers and links are removed from the description before it is processed. Unless you untick the save option, the assessment is kept for 30 days and then deleted automatically; if you request a consultation, it is attached to your inquiry and follows that inquiry's retention period.

When an AI model is enabled, the description (without the removed data) is sent to the model provider solely to generate the assessment. Without a configured provider the advisor runs in demonstration mode and sends no data outside our infrastructure.

5. Purposes and legal bases

Responding to your inquiry and preparing a quote — taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR).

Protecting the website from spam and abuse — legitimate interest (Art. 6(1)(f) GDPR).

Sending information about services and useful materials — only on the basis of separate, explicit consent (Art. 6(1)(a) GDPR). Consent is not a condition for sending an inquiry and can be withdrawn at any time.

6. Retention

Inquiry data is kept for up to 24 months after the last communication, unless a contractual relationship arises, in which case the periods under that contract and the law apply. After that, the data is deleted automatically.

The administrative action log does not contain the content of inquiries and is kept for up to 36 months for security purposes. Database backups are kept for up to 14 days and then overwritten.

7. Recipients, processors and transfers outside the EU

The data is accessible only to authorized staff of the controller. We use hosting and infrastructure providers as processors: Hetzner Online GmbH (hosting, Germany) and Cloudflare, Inc. (content delivery, protection and email forwarding, USA).

If we use an AI model provider or an email service, it is named in this list, processes data only on our instructions and under a data processing agreement. If data is transferred outside the European Economic Area, this happens only with appropriate safeguards under Chapter V GDPR, such as standard contractual clauses.

8. Customer data in AI Managed Services

Under an AI Managed Services contract we process data from your AI systems (for example logs, metrics and sample conversations) as a processor on your behalf, under a separate data processing agreement. Scope, retention and security measures are set out in that agreement.

We apply data minimization: we monitor technical metrics where that is sufficient, and use conversation content only where agreed, where necessary and with restricted access. Using our services does not by itself make your processing GDPR-compliant — responsibility for your own AI systems remains with you as the controller.

9. Your rights

You have the right to:

• access your personal data;
• rectify inaccurate data;
• erasure (the "right to be forgotten");
• restriction of processing;
• data portability;
• object to processing based on legitimate interest;
• withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal;
• lodge a complaint with the Bulgarian Commission for Personal Data Protection (www.cpdp.bg) or the supervisory authority in your country.

10. How to request access or deletion

Send a request to [email protected] from the email address you used for the inquiry, or quote the inquiry's reference number. We may ask for additional information to confirm your identity.

We respond within one month. On deletion, the inquiry, its notes and any attached AI assessment are removed; the action log keeps only a record that a deletion took place, without the personal data.

11. Security

We apply technical and organizational measures: encrypted connections, controlled access with individual accounts, an action log, minimal data collection and automatic deletion when the retention period ends.

12. Changes to this policy

When the policy changes, we publish the current version on this page with a new date. The version you acknowledged when sending an inquiry is stored with it.