privacy policy

1. Who processes your data

The controller of your personal data is Green Heroes EOOD. We process data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and the Personal Data Protection Act (ЗЗЛД).

We are not required to appoint a data protection officer. For any questions about your personal data, write to us at info@greenheroes.bg.

2. What data we collect, why and how long we keep it

We process only the data needed for the purpose in question.

Enquiry and contact forms, e-mail and phone

Data	name and phone number, and optionally e-mail, town or village, the chosen service and a message; the consent tick box and the date of sending; for an on-site visit, the address of the site
Purpose	to reply to your enquiry, arrange an on-site visit and send you a quote
Legal basis	steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to enquiries (Art. 6(1)(f))
Timeframe	1 year from the last correspondence, unless the enquiry leads to a contract – in that case we keep them for as long as needed to perform it and as required by the Accountancy Act (ЗСч)

Site security

Data	IP address, date and time, page visited, browser data, login attempts to the admin area
Purpose	protecting the site against attacks, spam and abuse, fixing technical problems
Legal basis	legitimate interest in keeping the site secure and working (Art. 6(1)(f) GDPR)
Timeframe	server and security logs: usually up to 90 days, unless needed to investigate a specific incident

Social media profiles

If you write to us on our social media profiles (Facebook, Instagram и YouTube), we process the conversation data in order to reply to you. For the statistics of our Facebook and Instagram pages, Meta is a joint controller with us.

Instagram photos of the site

The strip of photos from our Instagram profile at the bottom of the pages is loaded from our own server (copies of the photos are stored there). So while you browse the website, your browser does not connect to Instagram or send it any data. If you click a photo or a link to our profiles, you go to the website of that network, and its own rules apply there.

We do not make decisions based solely on automated processing that have legal effects on you. We do not sell personal data.

3. Who we share data with

We share data only as far as necessary, with:

• the hosting provider of the site (Super5, on a Hetzner server in Germany, EU);
• the hosting provider’s e-mail server (Super5, Germany, EU) – this service is used to send and receive the e-mails of the site and of info@greenheroes.bg;
• the site protection provider (the server firewall and the website security plugins) – IP addresses during attempted attacks;
• public authorities (the National Revenue Agency, the Commission for Consumer Protection, courts, etc.) when we are required to by law.

The providers who process data on our behalf are bound by a contract and by our instructions.

4. Transfers outside the EU

Some providers (Meta (Facebook and Instagram) and Google (YouTube), whose platforms host our social media profiles) or their affiliates are based in the USA. Data is transferred on the basis of the European Commission’s adequacy decision under the EU-U.S. Data Privacy Framework, for companies certified under it, or on the basis of standard contractual clauses approved by the European Commission.

5. Your rights

To exercise your rights, write to us at info@greenheroes.bg or by letter to our address. We reply within 1 month; for complex requests this period may be extended by a further 2 months, in which case we will let you know. We may ask you to confirm your identity. Exercising your rights is free of charge.

6. Do you have to give us your data

You do not need to give us any personal data to browse the site.

The required fields in the contact form are needed so that we can reply to you.

Any consent we ask you for is voluntary, and refusing it does not restrict your use of the website.

7. Security

The Site runs entirely over a secure connection (HTTPS). Only authorised persons have access to personal data. We use a firewall, login attempt limiting and regular backups. Nevertheless, no method of transmission over the Internet is completely secure. In the event of a security breach that poses a high risk to you, we will notify you without undue delay.

8. Children

The Site is not intended for persons under 14 years of age, and we do not knowingly collect their data. If you believe a child has provided us with data, write to us and we will delete it.

9. Cookies

How we use cookies and how you can change your choice is described in the Cookie Policy.

10. Changes

We may change this policy when we change the way we process data or when the law changes. The current version is always on this page, with its effective date at the top.