Privacy policy — ROCKLAST

01Who processes your data

ROCKLAST Ltd. is the data controller within the meaning of Regulation (EU) 2016/679 (GDPR).

Company: ROCKLAST Ltd. (РОКЛАСТ ООД)
Company ID: 208844117
Registered address: 198 Sveta Troitsa St., floor 4, apt. 4, 6000 Stara Zagora, Bulgaria
Data protection contact: office@rocklast.com · +359 89 4343990

The company does not fall within the cases listed in Art. 37 GDPR and is not required to appoint a Data Protection Officer. All enquiries under this policy are handled at the address above.

02What data we collect

This website is informational. It has no registration, no user accounts and no forms for submitting data. Personal data reaches us only when you contact us yourself.

A. When you write or call

First and last name
Business email and telephone
Company and job title
The content of the correspondence, including technical data about the project

B. Automatically, when you visit the site

The web server hosting the site keeps a standard request log: IP address, date and time, requested address, browser type and operating system. These records serve solely for server security and diagnostics.

C. Data of our partners' representatives

Within contractual relationships we process contact data of the persons nominated by the other party — managers, technical supervisors, delivery contacts. We receive this data from the company itself, not from the individual.

We do not process special categories of data under Art. 9 GDPR, we do not carry out profiling and we make no automated decisions producing legal effects.

03Legal grounds and retention

Every processing operation rests on a specific ground under Art. 6(1) GDPR:

Point (b) — pre-contractual and contractual relations. Answering a technical enquiry, preparing a quotation and specification, performing a delivery.
Point (c) — legal obligation. Issuing and retaining accounting and tax documents.
Point (f) — legitimate interest. Server security, defending our rights in a dispute, maintaining business contacts with partners.
Point (a) — consent. Only where you give it explicitly for a specific purpose, such as a technical newsletter. Consent may be withdrawn at any time, as easily as it was given.

Retention periods

Correspondence without a concluded contract: Up to 12 months from the last contact
Correspondence and documents under a contract: 5 years from termination — the general limitation period under Bulgarian law
Accounting and tax documents: As required by the Accountancy Act and the Tax and Social Insurance Procedure Code
Server logs: Up to 12 months

Once the relevant period expires, the data is deleted or irreversibly anonymised.

04Who we share it with

We do not sell or rent personal data. Access is granted only to:

The hosting provider of this website, acting as a processor under Art. 28 GDPR on the basis of a written agreement.
An accounting firm, for documents relating to contractual matters.
Legal counsel, only where a dispute arises and only to the extent necessary.
Public authorities, where the law obliges us to provide information.

Google Fonts — transfer outside the EU

The site loads the Montserrat and IBM Plex Mono typefaces from Google servers (fonts.googleapis.com and fonts.gstatic.com). During this request your browser's IP address becomes known to Google Ireland Limited and may be transferred to Google LLC in the United States. The transfer relies on the European Commission's adequacy decision on the EU—US Data Privacy Framework of 10 July 2023.

If you would rather this transfer did not take place, the fonts can be hosted locally on our own server. Write to us if you are a partner and your internal policy requires it.

05Cookies

This website sets no cookies. As at the date of this document it uses no web analytics, advertising pixels, embedded video, chat widgets or social plugins. No information is stored in your browser through cookies, localStorage or comparable technologies.

For that reason the site carries no consent banner — such a banner is required only where information is stored on, or accessed from, the user's terminal equipment.

Should we introduce analytics or marketing technologies in future, we will publish a separate cookie policy and implement prior-consent banner before activating them.

06Your rights

Under Chapter III GDPR you have the right to request:

Access — confirmation whether we process your data and a copy of it.
Rectification — correction of inaccurate or completion of incomplete data.
Erasure — the "right to be forgotten", where no ground remains for us to keep it.
Restriction of processing where accuracy or lawfulness is contested.
Portability — receiving the data in a structured, machine-readable format.
Objection to processing based on legitimate interest.
Withdrawal of consent, where processing rests on it.

Send your request to office@rocklast.com. We respond within one month. Where the request is complex, or where many requests are received, that period may be extended by a further two months, of which we will notify you with reasons. The service is free of charge; for manifestly unfounded or excessive requests we may charge a reasonable fee or refuse to act.

Complaint to a supervisory authority

If you believe your rights have been infringed, you may lodge a complaint with the Bulgarian Commission for Personal Data Protection — 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, tel. +359 2 915 3518, kzld@cpdp.bg, cpdp.bg. You also have the right to a judicial remedy.

07Security and changes

We apply technical and organisational measures appropriate to the risk: an encrypted connection to the site, access control over mailboxes and files, regular backups, and a confidentiality obligation on everyone who processes data on our behalf.

This policy may be amended where our activity or the applicable law changes. The current version is always available at this address and the effective date is stated at the top. Where changes are substantial, we will notify the individuals concerned.