Privacy policy

Who is responsible for your data

The data controller is Berill Group Ltd., Reg. No. (EIK) 205317985, VAT No. BG205317985, registered address: 1 27-mi Yuli Str., Varna, Bulgaria. Office: 14 Dragan Tsankov Str., Varna, Bulgaria.

For any question about personal data, write to berill@berill.group or call +359 89 989 6119.

What data we process and why

Requests and quotes. When you send a form (quick order, service order, calculator, custom order), we receive your name, email, phone, comment, the design file if you attach one, the quote lines and the page language. We need this data to answer your request, prepare an offer and fulfil the order. Legal basis: steps prior to entering into a contract and its performance (Art. 6(1)(b) GDPR). Email and phone are required: without them we cannot reply. Your name is optional, except for a custom order.

Spam protection. When you fill in a form, Cloudflare Turnstile checks that you are a person and processes your IP address and technical browser data for this. To limit repeated requests we keep a hash of the IP address made with a secret key (a pseudonym the address cannot be recovered from), not the address itself. Legal basis: our legitimate interest in protecting the site (Art. 6(1)(f) GDPR).

Running the site. Our host Cloudflare receives your IP address and technical request data to deliver the page and protect the site from attacks. Cloudflare derives your country and city from the IP address, and the Russian and Bulgarian versions of the site show the city in the delivery heading, and the phone field gets your country code. The data is not stored on the server; the browser keeps it until the tab is closed. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Analytics and advertising. Only with your consent (Art. 6(1)(a) GDPR) the site loads Google Analytics, and Google Tag Manager and Meta Pixel if they are in use. These services receive data about your visit and actions on the site (page views, form submissions, clicks on the phone number or messengers, calculator use), cookie identifiers, IP address, device and browser data. See the cookie policy for details.

Messengers. If you write to us on Telegram, Viber or WhatsApp, the messenger also processes the data under its own terms. We use the conversation only to reply and fulfil the order.

Order documents. When an order is placed, we process the invoice data to meet Bulgarian tax and accounting law (Art. 6(1)(c) GDPR).

Who receives the data

We do not sell personal data. Only those who need data for the work receive it, and only as much as they need:

• Cloudflare, Inc. (processor): site hosting, spam protection (Turnstile), storage of requests and files (R2), forwarding of request emails;
• VK LLC, Russia (processor): the VK WorkMail service that runs our mailbox berill@berill.group; request emails arrive there and our correspondence with clients takes place there;
• Google Ireland Limited: Google Analytics and Google Tag Manager, only with your consent;
• Meta Platforms Ireland Limited: Meta Pixel, only with your consent and if it is in use. For collecting and transmitting data via the Pixel, we and Meta are joint controllers (Art. 26 GDPR, Meta terms); afterwards Meta processes the data as an independent controller;
• our accountant and courier: when needed to fulfil the order;
• public authorities: when required by law.

Transfers outside the EU

Cloudflare, Google and Meta may process data in the USA and other countries outside the European Economic Area. Transfers rely on the European Commission adequacy decision for the EU-US Data Privacy Framework, in which these companies participate, or on standard contractual clauses approved by the European Commission.

Our email runs on VK WorkMail, which stores data in Russia. There is no European Commission adequacy decision for Russia. Request emails and correspondence go there only so that we can answer your request and fulfil the order at your request (Art. 49(1)(b) GDPR). If you do not want your data transferred to Russia, do not send the form; call us instead and we will find another way to communicate.

How long we keep data

• requests and attached files in the site storage: 180 days, then deleted automatically; the file link in the email works for 90 days;
• request emails and correspondence: while the order is discussed and fulfilled, then no longer than 3 years after the last contact;
• invoices and order documents: up to 10 years, as Bulgarian accounting and tax law requires;
• IP address hash used to limit repeated requests: 1 day;
• analytics and advertising data: see the periods in the cookie policy.

Your rights

Under the GDPR and the Bulgarian Personal Data Protection Act you have the right to:

• know what data about you we process and get a copy;
• correct inaccurate data;
• have data erased when we have no legal ground to keep it;
• restrict processing;
• receive your data in a machine-readable format and transfer it to another controller;
• object to processing based on legitimate interest;
• withdraw consent to analytics and advertising cookies at any time via the "Cookie settings" link at the bottom of the page; withdrawal does not affect processing carried out before it.

Write to berill@berill.group. We reply within one month; for complex requests this may be extended by two more months, and we will let you know. We may ask you to confirm your identity.

If you believe your rights have been infringed, you can lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP): 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg, or with the supervisory authority of the country where you live or work.

Automated decisions

We make no decisions based solely on automated processing that have legal effects for you. The calculator shows an estimate; the final price is stated in our offer.

Children

The site is intended for adults and businesses. We do not knowingly collect data from children under 14. For a child under 14, consent to analytics and advertising cookies can only be given by a parent or guardian.

Data security

The site works over HTTPS only. Requests and files are kept in private storage that the staff handling orders can access. The file is downloaded via the link in the request email: the link contains a random identifier and works for 90 days.

Changes to this policy

We may update this policy. The current version is always on this page, with its date at the top.