Privacy Policy

1) Who we are (Data Controller)

This website is operated by FSB Web Solutions, a trade name of GALACTICA 24 LTD, a company registered in Bulgaria (Unified Identification Code / UIC: 207635239). We are the "data controller" responsible for your personal data under the EU General Data Protection Regulation (GDPR).

For any privacy-related question or request, you can reach us at [email protected]. We are a small business and are not legally required to appoint a Data Protection Officer, but privacy requests are handled directly by us at that address.

2) What data we collect

• Contact requests — your name, email address, phone number (if you provide it), and the message you send us.
• Client data — if you become a client: billing details, VAT/company number where applicable, and project-related content you share with us (such as logos, text, and images).
• Basic technical data — your IP address, browser/device information, and pages you visit. This is typically collected through standard server logs for security and performance.

We do not knowingly collect special-category ("sensitive") data, and we do not buy contact lists or profile visitors for advertising.

3) How we use your data

• To reply to your messages and provide quotes or information about our services.
• To deliver our services, if you become a client.
• To issue invoices and keep accounting records as required by law.
• To protect the website from spam, abuse, and security incidents.
• To comply with legal obligations, where required.

We will never sell your personal data.

4) Legal basis (GDPR)

We process personal data on one or more of the following legal grounds under Article 6 GDPR: (a) to take steps at your request before entering a contract; (b) to perform a contract; (c) to comply with a legal obligation (for example, tax and accounting records); (d) our legitimate interests (for example, running a secure website); and/or (e) your consent, where it applies (for example, non-essential cookies or marketing emails). Where we rely on consent, you can withdraw it at any time.

5) Cookies

Strictly necessary cookies keep the website working (for example, remembering your cookie choice) and do not require consent. Analytics cookies, if used, are only set after you actively give consent, and you can withdraw that consent at any time. We do not use advertising or third-party tracking cookies. You can also block or delete cookies through your browser settings.

6) Sharing your data

We do not sell your personal data. We may share limited data with trusted service providers — for example, website hosting, email, anti-spam, invoicing, or payment services — only when necessary to operate the website or deliver our services. Each such provider acts as a "processor" bound by a data processing agreement under Article 28 GDPR, and may only use your data on our instructions.

7) International transfers

We aim to keep your data within the European Economic Area (EEA). If any of our service providers process data outside the EEA, we use appropriate safeguards under Chapter V GDPR — such as an EU adequacy decision, the EU–US Data Privacy Framework, or Standard Contractual Clauses — where applicable.

8) Data retention

We keep contact requests for up to 24 months, client project files for the duration of the project plus 3 years, and invoices and accounting records for as long as required by law (up to 10 years under Bulgarian tax and accountancy rules). Server logs are kept for up to 12 months. When a retention period ends, data is securely deleted or anonymised.

9) Security

We apply reasonable technical and organizational measures to protect your information, including HTTPS/TLS encryption, restricted access, and regular backups. No method of transmission over the internet is 100% secure, but we work to reduce risks. If a data breach is likely to affect your rights, we will notify the competent supervisory authority within 72 hours and, where the risk is high, inform you directly.

10) Your rights

Under the GDPR, you have the right to access, correct, delete, restrict, or object to the processing of your data, as well as the right to data portability. You can also withdraw consent at any time where consent is the basis for processing. To exercise any of these rights, email us at [email protected] and we will respond within one month, as required by Article 12 GDPR.

11) Right to complain (EU-wide)

As an EU data subject, you have the right to lodge a complaint with a supervisory authority in any EU Member State — in particular the one where you live, where you work, or where the issue occurred (Article 77 GDPR).

Because our company is registered in Bulgaria, our lead supervisory authority is the Commission for Personal Data Protection (CPDP), Sofia, Bulgaria — www.cpdp.bg. You may equally contact your own national data protection authority; a full list of EU authorities is available from the European Data Protection Board at edpb.europa.eu.

12) Automated decisions and children

We do not use automated decision-making or profiling that produces legal or similarly significant effects (Article 22 GDPR) — all decisions are made by a person. Our services are aimed at businesses and adults, and we do not knowingly collect data from children under 16. If you believe a child has provided us data, contact us and we will delete it.

13) Changes and contact

We may update this policy from time to time; the "Last updated" date above shows the latest version, and material changes will be highlighted where they significantly affect your rights.

For privacy-related questions or requests, contact us at: [email protected]

FSB Web Solutions — Fixed price. Real work.