Privacy

Who is responsible for your data

Elysium Soft is a trading name of Elysium Soft EOOD, a company registered in Bulgaria.

That company is the data controller for anything you send through this site. Write to the address above about any of the rights listed below and we will deal with it.

What we collect

The enquiry form asks for your name, your email address, your current website address, a description of what you need and a budget range. Only the name, email and description are required — the rest exist because they make our first reply more useful.

Our hosting provider keeps standard server logs, which include IP addresses, for a short period. These are used to keep the site running and secure, not to build a picture of you.

There is no analytics, no advertising pixel, no session recording and no embedded third-party content on this site.

Why we are allowed to hold it

When you send an enquiry you are asking us to take steps before entering into a contract, which is the legal basis under Article 6(1)(b) of the GDPR. Keeping the correspondence afterwards — so we know who we quoted and what we said — rests on our legitimate interest in running the business, under Article 6(1)(f).

We do not send marketing email, and your address is never sold, rented or passed to anyone for their own purposes.

Cookies

We set none of our own. No analytics cookie, no advertising cookie, nothing that remembers you between visits.

The site sits behind Cloudflare, which protects it from automated traffic. Where that protection is active, Cloudflare sets a short-lived security cookie named __cf_bm on your device. It expires after about thirty minutes of inactivity, it is generated separately for every site so it cannot follow you between them, and its contents are encrypted so only Cloudflare can read them. It exists to tell people apart from bots, not to profile you.

Because that cookie is strictly necessary for the security of a service you asked for, it does not require your consent — which is why there is no banner in your way. Fonts are served from this site rather than a third-party font network, so loading the page does not announce your visit to anyone else.

Who else sees it

The site is hosted and served by Cloudflare, which means Cloudflare processes the technical data involved in delivering pages to you — including your IP address — and may process it outside the EU. That processing is covered by Cloudflare's data processing terms and the standard contractual clauses.

Our email provider necessarily handles enquiries as part of delivering and storing messages. Nobody else has access.

How long we keep it

Enquiries that do not turn into work are deleted after twelve months. Where we do work together, we keep the correspondence and the invoices for as long as accounting and tax law requires, and no longer.

Your rights

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, ask for it in a portable format, and object to us keeping it on legitimate-interest grounds. Email the address above and we will respond within one month.

If you think we have handled your data badly you can complain to the supervisory authority where our company is established — the Commission for Personal Data Protection (CPDP)in Bulgaria — or to the authority in the country where you live. You can reach the Commission for Personal Data Protection (CPDP) atwww.cpdp.bg.

Changes

If this notice changes, the date at the top changes with it. We do not make changes retroactively — data collected under an earlier version is handled under the terms you were given at the time.