Privacy and data protection

1. Data controller

The controller under Regulation (EU) 2016/679 (GDPR) is IFKEES LTD, registration number (EIK) 208715371, VAT number BG208715371, registered at Skat Blvd. 1, fl. 5, ap. 13 E, 8256 Sveti Vlas, Bulgaria. You can reach us by email at info@ifkees.com, which is the only contact channel this site offers.

2. What we process and why

Personal data is collected only when you contact us by email:

• Contact details: your email address, name, telephone number if you choose to give one, company name, and any project material you send us.
• Purpose: answering your question, preparing a quotation, drafting contracts, and pre-contractual communication.
• Legal basis: Article 6(1)(b) GDPR, performance of a contract or steps taken before entering one, and Article 6(1)(f) GDPR, legitimate interest.

3. Cookies, analytics and locally hosted fonts

• No tracking cookies: this site sets no advertising, profiling or other non-essential cookies. Under Article 5(3) of the ePrivacy Directive, no cookie consent banner is required.
• Locally hosted fonts and scripts: all font files (Sofia Sans) and scripts are bundled and served from our own server. No IP address or visitor data is passed to an external font CDN such as Google Fonts.
• Privacy-respecting analytics: we use Cloudflare Web Analytics, which is measurement without cookies. Traffic statistics are collected by a small script that the Cloudflare network injects into the page; it stores no persistent identifier in your browser, does not follow you across sites, and processes aggregated data only. Traffic also passes through the Cloudflare protection layer, which may set the technical cookie __cf_bm, and in some cases cf_clearance, solely to tell automated traffic from human traffic and to keep the site secure. Those are strictly necessary cookies within the meaning of Article 5(3) of the ePrivacy Directive, so they need no consent and are never used for marketing.

4. How long data is kept

Correspondence about an enquiry is kept for the duration of the exchange and for up to 3 years afterwards for business purposes. For contracted clients, accounting records and invoices are kept for the period required by European and Bulgarian tax law, which can be up to 10 years.

5. Processors and third-party services

We work only with established infrastructure providers that meet EU data protection standards:

• Cloudflare, Inc.: web infrastructure, security firewall, CDN and traffic measurement. It processes the IP address and technical browser data while serving a request.
• Business email provider: encrypted business email correspondence.

Transfers outside the EU: Cloudflare, Inc. is a company based in the United States. Transfers are covered by the European Commission standard contractual clauses and by the provider's participation in the EU to US Data Privacy Framework. Requests are served from European network nodes wherever possible.

We never sell, rent or trade your personal data with third parties for marketing purposes.

6. Your rights under the GDPR

As a data subject in the EU you have the following rights under Chapter III of the GDPR:

• Access (Article 15): to be told what data about you we process.
• Rectification (Article 16): to have inaccurate personal data corrected.
• Erasure (Article 17): to have personal data deleted when it is no longer needed.
• Restriction (Article 18) and objection (Article 21).
• Data portability (Article 20).

Any of these can be exercised by writing to info@ifkees.com. You also have the right to complain to a supervisory authority. That is either the Bulgarian Commission for Personal Data Protection (cpdp.bg), where the controller is registered, or the authority in your own country of residence (list of national authorities).