1. Who processes your data (controller)
The controller of your personal data is:
- Pro Website EOOD (Про Уебсайт ЕООД, brand Pro Website)
- Company ID (ЕИК) 207221537
- VAT No. BG207221537
- Registered office and address of management: apt. 19, floor 2, bl. 82, entr. B, Vazrazhdane 4 residential area, Mladost district, Varna 9020, Bulgaria
- Email: [email protected]
- Phone: +359 894 23 52 23
- Working hours: every day, 9:00 AM - 8:00 PM Bulgarian time
We are not required to appoint a data protection officer, so for any question about your personal data, write to[email protected]. We reply within one month.
2. What data we collect
2.1. Through the inquiry form
When you fill in a form on the website, we receive the following by email and record it in our CRM system:
- Name - whatever you have written in the field. Required.
- Phone - so we can call you. Required.
- Email - optional, if you prefer a reply by email.
- Service - your choice from the "What do you need" list.
- Message - the "Business and city" field, optional.
- Page - the address of the page from which the form was sent.
- Advertising identifiers - gclid and UTM parameters, if you came from an ad or a campaign. They show which ad brought the inquiry, not who you are.
- IP address - recorded automatically by the server for protection against spam and abuse.
- Date and time of the inquiry.
The form has a hidden anti-spam field (honeypot) and a limit on the number of submissions from one IP address. We do not ask you for a Bulgarian personal identification number (ЕГН), card details or any sensitive data, and we do not process them.
2.2. When you write to us or call us
When you email us, call us or send us a message on WhatsApp (Meta) or Viber, we process the data you have given us yourself: name, phone number, email address and the content of the correspondence.
2.3. When you fill in an ad form on Facebook or Instagram
If you send an inquiry form from one of our ads on Facebook or Instagram, Meta passes us the data you filled in (usually name, phone number, email address and the answers to the form questions), together with the names of the ad and the form. We process it as an inquiry from the website.
2.4. When you write to the AI consultant on the website
The website has a chat, the "ProWebsite AI Consultant", which answers automatically with the help of a language model (Claude by Anthropic). We record the whole conversation: your messages and the replies, the page where you started it, the advertising identifiers (gclid, UTM), the IP address and the browser type, as well as your phone number or email address if you choose to leave them so we can contact you. Your messages are sent to Anthropic only so that a reply can be generated; Anthropic does not use them to train models. If you leave a phone number or email address, the conversation and your contact details are recorded as an inquiry in our CRM system. Do not write a personal identification number, card details or other sensitive data in the chat.
2.5. Automatically, when you visit the website
The web server records technical data in its logs (IP address, date and time, requested page, browser type) for security and diagnostics. Separately, Google Analytics 4, Matomo, Microsoft Clarity, Google Ads, Microsoft Advertising and the OpenAI ads pixel (ads in ChatGPT) collect data about your visit through cookies and similar technologies. Matomo runs on our own server (analytics.prowebsite.bg); if you turn off analytics cookies, it counts visits without cookies and without recognizing you on your next visit. See section 6.
3. Why we process it and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| To answer your inquiry and prepare a quote and a demo | Name, phone, service, message, page | Art. 6(1)(b) GDPR - steps taken at the request of the data subject prior to entering into a contract |
| Performance of a contract, if you become a client | Contact details and details of your company | Art. 6(1)(b) GDPR - performance of a contract |
| Protection against spam and abuse of the form | IP address, time of the request | Art. 6(1)(f) GDPR - legitimate interest in keeping the website working |
| Measuring which ad or page inquiries come from | gclid, UTM parameters, source page | Art. 6(1)(f) GDPR - legitimate interest in knowing which parts of our marketing work |
| Analysis of visits and advertising measurement | Data from Google Analytics, Matomo, Microsoft Clarity, Google Ads, Microsoft Advertising and OpenAI cookies | Art. 6(1)(a) GDPR - your consent, given through the cookie banner |
| Measuring whether a visit from an ad in ChatGPT led to an inquiry | When you send a form and consent to advertising cookies: email address and phone number in hashed (irreversibly encoded) form, the click identifier | Art. 6(1)(a) GDPR - your consent to advertising cookies |
| Card payment of a proforma invoice | Name, amount, proforma number, payment status (the card details are processed by Revolut and we do not see them) | Art. 6(1)(b) GDPR - performance of a contract |
| Accounting and tax obligations under a signed contract | Data in invoices and contracts | Art. 6(1)(c) GDPR - legal obligation |
We do not use your data for automated decision-making or profiling that has legal effects for you. We do not send you promotional newsletters unless you have explicitly signed up for them.
4. How long we keep the data
- Form inquiries and correspondence that did not lead to a contract: 24 months from the last contact. After that we delete them.
- Data of clients under a contract: for the term of the contract and 5 years after it ends, in line with the statutory limitation periods.
- Accounting documents: 10 years under the Bulgarian Accountancy Act (Закон за счетоводството) and tax legislation.
- Conversations with the AI consultant where no contact details were left: up to 12 months, then they are deleted. A conversation where a phone number or email address was left is an inquiry and is kept like the form inquiries.
- Server logs: up to 12 months.
- Cookies: according to the lifetime of each cookie, see the table in section 6.
5. Who we share the data with
We do not sell or rent out personal data. Only the following providers, which process it on our instructions, have access to it:
- Google Workspace (Google Ireland Limited) - the email hosting where inquiries from the form arrive and are stored.
- Coolify on our own server - the website hosting. The server is in the European Union, is administered by us and stores the web server logs.
- Our CRM system (EspoCRM) on our own server in the European Union - where inquiries from the form, the AI consultant and the ad forms are recorded, as well as correspondence with clients.
- Matomo on our own server in the European Union (analytics.prowebsite.bg) - visit statistics. The data is not passed to third parties.
- Google Analytics 4 and Google Ads (Google Ireland Limited) - analysis of visits and measurement of ads. They work only after you consent to the relevant category of cookies.
- Microsoft Clarity (Microsoft Corporation) - analysis of behavior on the website: where people click, how far they scroll, recordings of visits. Form fields are masked and what you type in them is not recorded. Clarity sets cookies only after consent to analytics cookies.
- Microsoft Advertising (Microsoft Corporation) - measuring our ads on Bing: whether a visit from an ad led to an inquiry.
- OpenAI (ads in ChatGPT) - measuring whether a visit from an ad in ChatGPT led to an inquiry, through a pixel on the website and a server-side event. It receives your email address and phone number only in hashed form, and only when you send a form and consent to advertising cookies.
- Meta Platforms Ireland Limited - the ad forms on Facebook and Instagram through which you send us an inquiry, and WhatsApp, if you message us there.
- Revolut Bank UAB - card payments through the link in the proforma invoice. You enter your card details at Revolut and we do not see them.
- Anthropic PBC (USA) - the language model behind the AI consultant on the website. It receives the chat messages to generate a reply, under a data processing agreement with the Standard Contractual Clauses of the European Commission; it does not use the data to train models.
- Accountant and public authorities - only when there is a signed contract and only to the extent required by law.
Google, Microsoft, Meta, OpenAI and Anthropic may transfer data outside the European Economic Area. Such transfers are made on the basis of the Standard Contractual Clauses of the European Commission and the EU-US Data Privacy Framework.
6. Cookies and similar technologies
A cookie is a small file that the website saves in your browser. We use three categories. Necessary cookies always work, because without them your choice cannot be remembered. Analytics and advertising cookies load according to what you have chosen in the cookie banner.
| Category | Name | Set by | Purpose | Lifetime |
|---|---|---|---|---|
| Necessary | pw_consent_v1 | prowebsite.bg | Remembers your cookie choice. Technically this is not a cookie but an entry in your browser's localStorage, and it is not sent to the server. | Until you delete it |
| Necessary | pw_chat_sid | prowebsite.bg | The number of your conversation with the AI consultant, so it continues on the next page. An entry in your browser's localStorage. | Until you delete it |
| Analytics | _pk_id | Matomo (our server) | Distinguishes individual visitors. Without consent to analytics cookies Matomo does not store it and counts visits without cookies. | 13 months |
| Analytics | _pk_ses | Matomo (our server) | Links the viewed pages into one visit. | 30 minutes |
| Analytics | _ga | Google Analytics 4 | Distinguishes individual visitors so we know how many people have visited the website. | 2 years |
| Analytics | _ga_ followed by the property code | Google Analytics 4 | Keeps the state of the visit (which pages were viewed within one session). | 2 years |
| Analytics | _clck | Microsoft Clarity | Distinguishes individual visitors and keeps the Clarity settings. | 1 year |
| Analytics | _clsk | Microsoft Clarity | Links the viewed pages into one recording of the visit. | 1 day |
| Advertising | _gcl_au | Google Ads | Measures whether a visit from an ad led to an inquiry. | 90 days |
| Advertising | IDE | Google (doubleclick.net) | Measurement and personalization of ads outside the website. | Up to 13 months |
| Advertising | _uetsid, _uetvid, MUID | Microsoft Advertising | Measures whether a visit from an ad on Bing led to an inquiry. | 1 day (_uetsid), up to 13 months (_uetvid, MUID) |
| Advertising | __oppref, __obref | OpenAI | Links the visit to the ad in ChatGPT it came from. | Under OpenAI's rules |
The website uses Google Consent Mode v2 and the Clarity Consent API, and your choice is also passed to Matomo and to the OpenAI pixel: if you refuse, the analytics and advertising cookies of these services are not stored.
How to change your choice
At any time, click the "Cookies" button at the very bottom of the footer on every page. A window opens where you can turn off analytics or advertising cookies. Your choice applies immediately and is saved in your browser. You can also delete cookies in your browser settings or block them completely, but then some features may not work as they should.
7. What rights you have
Under the GDPR and the Bulgarian Personal Data Protection Act (ЗЗЛД), you have the right to:
- Access - to find out what data about you we process and to receive a copy of it.
- Rectification - to have inaccurate or incomplete data corrected.
- Erasure ("the right to be forgotten") - to have your data deleted when we no longer need it or you have withdrawn your consent.
- Restriction of processing - to have us stop processing the data while a dispute about it is resolved.
- Data portability - to receive your data in a machine-readable format or to have us transfer it to another controller, where this is technically possible.
- Objection - to object to processing based on legitimate interest.
- Withdrawal of consent - at any time, without affecting the lawfulness of processing before the withdrawal.
You exercise these rights with a written request to [email protected]. We may ask you to confirm your identity so that we do not hand data to the wrong person. We reply within one month; in complex cases this period may be extended by a further two months, and we will let you know.
Complaint to the supervisory authority
If you believe that we process your data unlawfully, you have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (КЗЛД): 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, email [email protected], website www.cpdp.bg.
8. Security
The website runs over HTTPS with a valid certificate. Access to the mailbox with the inquiries is protected with two-factor authentication. The server and the application are updated regularly and backups are made. Only the owner of the company and people who need it for their work have access to the data.
9. External links
The website has links to external addresses, for example to Google Maps. We do not embed external maps, videos or social buttons in the pages, so that third-party cookies are not loaded without your consent. Once you open an external website, its privacy policy applies, not this one.
10. Changes to this policy
We may change this policy when our services or the law change. The current version is always at this address, and the date of the last update is at the top. If there are significant changes, we will notify our clients by email.