1. Who processes your data

The controller of your personal data is Struktura Expo EOOD, a company registered in Bulgaria.

Address: Sofia, Bulgaria
Email: [email protected]
Phone: +359 88 611 7447

The company is not required to appoint a data protection officer. For any question about your personal data, write to the email address above.

2. What data we collect and why

Enquiry form

When you send an enquiry, we process the data you enter yourself: name, phone, email (optional), type of event, date, venue, details and any attached photos or plans.

Purpose: to answer your enquiry and prepare an offer.
Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) of the General Data Protection Regulation – GDPR).
Is it required: no. Without a name and phone number, however, we cannot contact you.

Please do not send sensitive data (for example about health), or photos in which other people can be clearly seen without their consent.

To protect the form from spam, Cloudflare Turnstile automatically checks that the enquiry is sent by a person while you fill it in. Legal basis: legitimate interest – protecting the website from abuse (Article 6(1)(f) GDPR).

Correspondence

If you email or call us, we process the data in that correspondence on the same basis and for the same purpose.

Technical data when you visit

On every visit, the hosting provider's server automatically processes technical data – IP address, browser type, date and time of the request. This is needed to load the website and to protect it from attacks and abuse. The country your connection comes from is also used, at that moment only, to show you the Bulgarian or the English version of the website; it is not stored.

Legal basis: legitimate interest – security and proper operation of the website (Article 6(1)(f) GDPR).

We do not use your data for advertising, we do not build profiles and we do not make automated decisions.

3. How long we keep data

Enquiries that do not lead to a contract: up to 2 years from the last contact, after which we delete them.
Enquiries that lead to a contract: as long as the law requires – for example, accounting documents are kept for up to 10 years under the Bulgarian Accountancy Act.
Technical data: for the short period in which the hosting provider keeps security logs.

4. Who receives the data

We do not sell your data or pass it to third parties for their own purposes. We use providers who process it only on our instructions (processors):

Cloudflare – website hosting, protection from attacks and the spam check on the enquiry form (Turnstile);
Resend – delivers enquiries from the form to our company email (sent from servers in the EU, Ireland);
Google (Google Workspace) – company email, where enquiries arrive.

Some of them are based in, or have servers in, the United States. Data is transferred there on the basis of the EU–U.S. Data Privacy Framework or standard contractual clauses approved by the European Commission.

We may disclose data to public authorities only where the law requires us to.

5. Your rights

You have the right:

to information about and a copy of your data (access);
to have inaccurate data corrected;
to have your data erased (the "right to be forgotten");
to restrict processing;
to receive your data in a convenient format and pass it to someone else (portability);
to object to processing based on legitimate interest.

To exercise your rights, write to [email protected]. We reply within one month.

If you believe your rights have been infringed, you can lodge a complaint with the Bulgarian Commission for Personal Data Protection – 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg – or with the data protection authority of the EU country where you live.

6. Cookies

The website does not use cookies for analytics, advertising or tracking, and it does not load external services such as Google Fonts, Google Analytics, embedded maps or social media buttons. Fonts and photos are served directly from our own website. The only exception is the enquiry form: once you start filling it in, the Cloudflare Turnstile spam check is loaded from Cloudflare's servers. It is used only for that check, not for advertising or tracking.

Our hosting provider (Cloudflare) may set strictly necessary security cookies that recognise automated traffic. They contain no personal information about you, are not used for tracking and do not require consent.

That is why the website shows no cookie banner. If we ever add cookies that need consent, we will ask you before setting them.

7. Security

The website works only over a secure connection (HTTPS). Only the company's staff who answer enquiries have access to them.

8. Changes

If this policy changes, we will publish the new text on this page and update the date at the top.

Privacy