Privacy notice

Scope of this notice

This notice explains how personal data is processed when you browse the VERAKRISS EOOD website at verakriss.eu and its technical Firebase App Hosting address. It covers the website under the General Data Protection Regulation (GDPR) and applicable Bulgarian law.

The site introduces our services. It has no user accounts, enquiry forms, document uploads, online orders or payments. This notice does not cover client records processed during accounting engagements or correspondence outside the website.

Controller and contact

The controller is VERAKRISS EOOD (ВЕРАКРИС ЕООД), UIC 030250038, registered at: Bulgaria, Sofia 1612, Krasno selo district, Hipodruma, 2 Aleksandar Makedonski Street, ground floor.

For privacy questions or to exercise your rights, contact office@verakriss.eu, telephone 0876886558, or write to the registered address above.

Data, purposes and legal bases

When you open a page, your browser sends technical data to the hosting infrastructure: your IP address, the requested page or resource address, access date and time, browser and operating-system information and, where supplied by your browser, the referring page address. The infrastructure may also record response status, processing time and technical errors.

This data is used to deliver pages, maintain availability, diagnose errors and protect against abuse and attacks. The legal basis is our legitimate interest in a secure, accessible website under Article 6(1)(f) GDPR. Transmission of basic technical data is necessary to open the website.

Google Analytics and advertising technologies are disabled in this release. The site does not build advertising profiles or make automated decisions with legal or similarly significant effects on visitors. You do not need to provide your name, telephone number or other identifying details to browse its pages.

Hosting, recipients and international processing

The site uses Google Firebase App Hosting and associated Google Cloud infrastructure for hosting, content delivery and technical logs. Necessary technical data may be accessed by authorised people maintaining the site, Google and its subprocessors providing these services. Data may also be disclosed to competent authorities when required by law.

Google uses international infrastructure and subprocessors, so processing may involve countries outside the European Economic Area, including the United States. Using a European hosting region does not mean that all processing takes place exclusively in the EEA.

The applicable Google Cloud terms include a data processing addendum and international-transfer mechanisms. They provide for European Commission standard contractual clauses for restricted transfers or an applicable recognised alternative mechanism. Links to the terms, clauses and subprocessor list appear below. You can request further information or a copy of applicable safeguards using our privacy contact.

Retention of technical data

Data used to serve an individual request is processed to fulfil that request. Technical-log retention depends on the type of record, hosting settings and the time needed to detect and resolve errors or incidents. The criteria are diagnostic needs, security investigation and applicable legal obligations.

Records needed for a particular incident or legal dispute may be retained until the investigation or dispute concludes and the relevant period for protecting legal rights expires. Data should be deleted or anonymised when its retention basis ends. For information about technical records relating to your visit, contact us with the approximate date, time and page.

The site does not create new browser records of analytics consent. Accessible preference records and analytics cookies from an earlier version are removed on a subsequent visit where the browser allows this. The cookie policy explains this further.

Your rights

Subject to the conditions in the GDPR, you can request access, correction, deletion or restriction of processing. You may object, on grounds relating to your particular situation, to processing based on legitimate interests. Processing must then stop unless there are lawful grounds for it to continue.

Data portability applies to automated processing based on consent or contract; this site's ordinary technical logs are processed on legitimate-interest grounds. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. This release does not ask for analytics consent because analytics is disabled.

Send a request to office@verakriss.eu or the registered address. We may ask only for the additional information necessary to verify your identity and locate the relevant records. We respond without undue delay, normally within one month. Complex or numerous requests may require an extension of up to two further months; we will explain the extension and its reasons within the first month.

You may complain to Bulgaria's Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592, https://cpdp.bg/, or the competent supervisory authority where you usually live, work or where the alleged infringement occurred. You do not have to contact us before making a complaint.

External links and changes

Google Maps, Carica Web and other external websites open only when you select their links. There is no embedded map or external form. Those websites apply their own privacy rules after you open them.

Updates to this notice are published here with a date and version. Before introducing analytics or advertising technologies, we will update the information and provide the required choices before those technologies load.