Privacy policy

1. Who we are

The controller responsible for your personal data is HTML Pet Ltd, VAT number BG203233937, with registered address ul. Mirela Freni 23, 1700 Sofia, Bulgaria.

For privacy enquiries and requests concerning your personal data, email privacy@htmlpet.com. For project enquiries and other correspondence, email contact@htmlpet.com.

2. Information we collect

• Project enquiries: the name, email address, optional company name, service selection, message and privacy-notice acknowledgement you submit.
• Correspondence: information you provide in emails and our responses, including information needed to consider your request.
• Website operation and security: IP addresses, request times, requested URLs, browser information and technical errors may be recorded in hosting or application logs. The contact form uses a keyed hash of your IP address to limit repeated submissions. This is pseudonymous data, not necessarily anonymous data.
• Essential cookies: security and session identifiers described in section 7.

You can browse without submitting an enquiry. The form identifies required fields; we need sufficient contact details and a message to respond. Company name is optional. Providing enquiry information is not a statutory obligation, but we may be unable to answer an incomplete request.

Please provide only information relevant to your enquiry and avoid including sensitive personal data or unnecessary details about other people. This website is intended for business enquiries and is not directed at children.

3. Purposes and legal bases

• Considering a project or preparing an offer: where you are the prospective contracting party, we process necessary information to take steps at your request before a contract, under Article 6(1)(b) GDPR.
• Business correspondence: for general questions or when you represent an organisation, we rely on our legitimate interests in responding to requests and maintaining business relationships, under Article 6(1)(f).
• Operating and protecting the website: we rely on our legitimate interests in reliable service, preventing abuse and investigating technical incidents, under Article 6(1)(f).
• Meeting legal duties: where necessary, we process information to comply with applicable legal obligations, including responding to data protection requests, under Article 6(1)(c). Relevant information may also be needed for establishing, exercising or defending legal claims under Article 6(1)(f).

When relying on legitimate interests, we consider your rights and reasonable expectations. You may object as explained in section 8.

The form checkbox acknowledges this notice. It does not subscribe you to marketing or serve as consent for unrelated uses. We do not sell personal data or use it for solely automated decisions producing legal or similarly significant effects, including such profiling.

4. How long we keep information

• Enquiries: we retain enquiry correspondence for 30 days, then delete it.
• Logs: we retain server and application logs for 30 days, then delete them.
• Abuse prevention: the contact-form rate-limit window lasts 15 minutes. Expired entries stop counting and are removed when a subsequent submission triggers cleanup; they may remain on disk until then.
• Sessions: session and security cookies have a configured lifetime of two hours. Expired server-side session files are removed through the hosting session-cleanup process.

Contact submissions are delivered to our email inbox and are not stored in a separate application database. If information becomes part of a project contract or a record we are legally required to retain, that separate record may be kept for the applicable contractual or statutory period. Where a specific legal duty or dispute requires longer retention, we limit further use to that purpose and delete the information when it is no longer required.

5. Who receives information

Information is accessible to people authorised to handle your enquiry and to the providers supporting the website and email service:

• Website hosting: SuperHosting.
• Email services: Microsoft 365 (Microsoft Ireland Operations Ltd), which sends and stores contact enquiries in the European Union/EFTA data location.

Providers acting as processors process information on our behalf under applicable data protection arrangements. Where necessary, relevant information may also be shared with professional advisers or competent authorities to comply with law or protect legal rights. Access is limited to information needed for the relevant purpose.

6. International transfers

Website hosting and contact enquiries are processed and stored within the European Union/EFTA. Our email provider, Microsoft, operates under the Microsoft EU Data Boundary but may in limited cases access data from outside the EEA, for example for security operations or support. Such transfers are protected by the European Commission's Standard Contractual Clauses and the EU–US Data Privacy Framework, or rely on an adequacy decision where one applies.

If these arrangements change, we will update this policy and put in place any legally required safeguards before making a transfer. You can ask about processing locations and any applicable safeguards at privacy@htmlpet.com.

7. Cookies

The website uses essential first-party cookies for security and the contact form:

• ci_session: maintains the form session and submission feedback. The configured lifetime is two hours.
• csrf_cookie_name: helps prevent forged form submissions. The configured lifetime is two hours; it may be refreshed when you use the website.

These cookies support functions you request and are not used for advertising. Blocking them may prevent the contact form from working; you can still email contact@htmlpet.com.

The website does not include analytics or advertising trackers. Fonts and images are served locally. If optional cookies or tracking are introduced, we will provide updated information and obtain consent where required before enabling them.

8. Your rights

Subject to the conditions and exceptions in the GDPR, you may request access to your personal data, correction of inaccurate information, erasure, or restriction of processing. Portability applies to qualifying data you have provided where automated processing is based on consent or a contract.

Right to object: where we rely on legitimate interests, you may object on grounds relating to your particular situation. We must stop that processing unless we demonstrate compelling legitimate grounds overriding your interests and rights, or the processing is needed for legal claims.

If a particular activity relies on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.

Send requests to privacy@htmlpet.com. We normally respond within one month of receipt. Where permitted because of complexity or the number of requests, we may extend this by up to two further months and will explain the extension within the first month.

We may ask for proportionate additional information if we have reasonable doubts about your identity. Requests are generally free of charge; statutory exceptions may apply to manifestly unfounded or excessive requests.

9. Complaints

You may complain to a competent data protection authority, particularly in the EU Member State where you habitually live or work, or where the alleged infringement occurred. You do not have to contact us first.

In Bulgaria, the authority is the Commission for Personal Data Protection (CPDP / КЗЛД), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria. See its complaint procedures and submission requirements.

10. Changes to this policy

We update this notice when our processing practices or legal requirements change. The revision date identifies the current version. Where required, we will inform you of material changes before using your information for a new purpose.