Privacy.

This explains what personal data we collect when you browse the site or write to us, why we use it, and what rights you have. The site uses no cookies and does not track you. The only thing stored in your browser is your language choice, and only if you press the switch; that is why there is no cookie banner.

1. Who is responsible for your data

Controller

АМАРАНТ ЛАБ ООД (“AMARANT LAB” Ltd.); on this site we work under the name Amarant Labs

Company ID / VAT

208856361 / BG208856361

Address

5 Han Asparuh St., Triaditsa district, Sofia 1463, Bulgaria

Email

office@amarantlabs.com

Phone

+359 878 940 990

The company is not required to appoint a data protection officer (Art. 37 of Regulation (EU) 2016/679, “GDPR”), so there is none. For anything about your personal data, write to the email above.

2. What data we process

• The meeting form: name, company, email, optionally phone, a description of your task or problem, the message you wrote, and the tick confirming you want us to contact you. Required fields are marked on the form.
• Calls and meetings: if we meet or talk, we note name, company, role, contact details and notes from the conversation. We get them from you, from the company you represent, or from the public Commercial Register.
• Anonymous visit statistics: which page you open, which site you came from (the site name only, not the full address), the page language, how long the page was visible, how far you scrolled, whether you used a mouse, finger or keyboard, and a random number for that page view. The number lives only while the page is open and is not saved in your browser. Your IP address and browser details are used only to compute a short-lived daily code for counting unique visitors; the address itself is not kept.
• Spam protection: when you submit the form we also keep a code computed from your IP address (not the address itself), together with the enquiry. We use it only to limit automated requests.
• Technical data when the page loads: our hosting provider (Cloudflare) sees the IP address of the request in order to deliver and protect the site.

We collect no sensitive data. We do not build profiles and take no automated decisions about you. We do not sell data or use it for advertising.

3. Why we use it, and on what legal basis

• To reply, arrange a meeting and prepare a proposal: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). With the tick on the form you confirm that you have read this notice and want us to contact you. You can ask us to stop at any time.
• To keep in touch with business contacts and track enquiries and conversations: legitimate interest (point (f)): not losing an enquiry and answering on time.
• Anonymous statistics (how many real people and how many bots visit) and protection against abuse: legitimate interest (point (f)): knowing whether the site works and keeping it safe. The statistics do not build a profile of any one person.
• Working with clients: performance of a contract (point (b)) and accounting and tax obligations (point (c)).

You give the form data voluntarily. No law or contract obliges you to do so; we need it to reply to you and to prepare a proposal before any contract exists. If you do not give it to us, we cannot reply to you. For the statistics you submit nothing.

4. How long we keep it

• Companies we work with or have discussed a project with: we keep enquiries, conversations and prepared materials as the record of our work with the company, for as long as the relationship lasts and afterwards for as long as we need them to continue the work or to protect our rights.
• Enquiries that did not become work: for as long as there is a real chance we will return to them. On request we delete them straight away.
• Clients: for as long as the work lasts, plus the periods the law requires (for example, accounting documents under the Bulgarian Accountancy Act).
• Statistics: the daily code is mixed with a random “salt” that is deleted every day. After that the records cannot be linked to a device and remain as aggregated statistics.
• On request we delete your personal data (name, phone, email and notes about you), even where we keep the work on the company's project, unless the law obliges us to keep it.

5. Who sees the data

• The company’s managers and the people working on your enquiry.
• Cloudflare — hosting and delivery of the site, and briefly stores form submissions until they reach our system.
• Google Workspace — our work mailbox (office@amarantlabs.com), when you write to us by email.
• Our own server — the system where we keep enquiries and conversations. Access is password-protected, and the connection to it runs through Tailscale, which carries only encrypted traffic.
• Technology providers that help us process enquiries — they receive only what is needed for that purpose and act on our instructions.
• Telegram — used only for an internal notice that reads “New inquiry from the website” plus a link to the system. Telegram receives none of your personal data.

Beyond this, we disclose data only where a law or an authority entitled to do so requires it.

6. Transfers outside the EU

Cloudflare, Google and some of our technology providers are based in the US, so data may be processed in the US and other countries outside the EU. The basis is the European Commission’s adequacy decision for the EU–US Data Privacy Framework. Where it does not apply, we rely on the Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914) in the processing agreements. You can ask for a copy of the Standard Contractual Clauses at office@amarantlabs.com. You can check whether a provider takes part in the Framework in the official Data Privacy Framework List. The provider of the connection to our server may also be outside the EU, but it sees only encrypted traffic.

7. Your rights

You can ask for access to your data, correction, deletion, restriction of processing and a copy in a readable format, and you can object to processing based on legitimate interest. You can ask us to stop contacting you at any time. Write to office@amarantlabs.com; we reply within one month.

If you believe we are breaching your rights, you can complain to the Commission for Personal Data Protection (КЗЛД, CPDP): 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg, kzld@cpdp.bg. You can also go to court.

8. Cookies and data in your browser

We use no cookies, advertising, tracking pixels, external fonts or third-party analytics. The only thing the site can save is your language choice (BG or EN) in your browser’s memory, and only if you press the switch. It stays on your device, is sent nowhere and does not identify you.

Effective 27 October 2026.