Privacy Policy
For website visitors, client contacts and partners. How we process candidates’ data is set out in a separate Candidate Privacy Notice.
Last updated:
Who processes your data
The data controller is Smart Data Technologies EOOD, UIC (EIK) 204660397, registered office: bl. 39, entr. A, fl. 3, apt. 10, Samokovo estate, 2000 Samokov, Bulgaria (“HuntConsult”, “we”).
For any question about personal data: privacy@huntconsult.space. We have not appointed a data protection officer.
We comply with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and the Bulgarian Personal Data Protection Act (ZZLD).
Who this policy covers
- visitors to huntconsult.eu;
- people who write to us or send an enquiry on behalf of a company (current and prospective clients);
- partners’ representatives and people who propose a partnership.
What data we process, why and on what basis
| Situation | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Visiting the website | IP address, browser type, requested address, date and time (server logs) | Running the website securely, protecting it from attacks and abuse | Legitimate interest (Art. 6(1)(f) GDPR) | Up to 30 days |
| A client enquiry (contact form, call request or email to search@) | Name, company, position, email, phone, information about the role, preferred call times and format | Replying to the enquiry and preparing a proposal | Steps prior to entering into a contract at your request (Art. 6(1)(b)) and our legitimate interest in replying to business enquiries (Art. 6(1)(f)) | Up to 12 months if no contract is signed |
| A contract with a client | Representatives’ contact details, correspondence, invoicing data | Performing the contract, communication, invoicing | Contract (Art. 6(1)(b)), legitimate interest for contacts at legal entities (Art. 6(1)(f)), legal obligation for accounting records (Art. 6(1)(c)) | The term of the contract plus 5 years; accounting records up to 10 years |
| A partnership | Name, company, contact details, message | Discussing and managing the partnership | Pre-contractual steps (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)) | Up to 12 months without an agreement; with an agreement, as for a client contract |
| A GDPR request | The data in the request and the related correspondence | Handling the request and being able to show that we did | Legal obligation (Art. 6(1)(c)) | 3 years after it is closed |
We do not use your data for marketing messages without separate consent. We never sell personal data. We do not make decisions based solely on automated processing that have legal effects on you.
The forms on this website
Form messages are not stored in a database on the website. They are sent over an encrypted connection to the relevant mailbox (search@, talent@, partners@ or privacy@) and handled from there.
Before sending, you tick an explicit consent box. The consent texts and their version are published on the Consents page, and the version is recorded with each message.
To protect the forms from automated abuse, the website briefly counts how many forms are sent from one IP address. This count is kept only in the server’s memory and disappears within an hour.
Who receives the data
- processors that provide services to us under a contract under Art. 28 GDPR: hosting (Hetzner Online GmbH, Germany) and email (Google Workspace, Google Ireland Limited, Ireland);
- accountants, auditors and legal advisers bound by confidentiality;
- public authorities, when the law requires it.
As a rule, data is processed in the European Union and the European Economic Area. If a provider transfers data outside the EEA, it does so only with appropriate safeguards: a European Commission adequacy decision or standard contractual clauses (Arts. 45 and 46 GDPR).
Your rights
- Access (Art. 15 GDPR): to confirm whether we process data about you and to receive a copy.
- Rectification (Art. 16): to correct inaccurate or incomplete data.
- Erasure (Art. 17): to delete your data when we no longer have grounds to keep it.
- Restriction (Art. 18): to pause processing, for example while we check whether the data is accurate.
- Objection (Art. 21): to object to processing based on legitimate interest. If you object to being contacted, we stop at once.
- Portability (Art. 20): to receive the data you gave us in a structured, machine-readable format, where we process it on the basis of consent or a contract.
- Withdrawing consent (Art. 7(3)): at any time, without affecting the lawfulness of processing before the withdrawal.
You can exercise your rights through the request form or at privacy@huntconsult.space. We reply without undue delay and within one month at the latest. For complex or numerous requests, the period may be extended by two further months, and we will tell you if so. Exercising your rights is free of charge.
Right to complain
If you believe we process your data unlawfully, you have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP): 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, Bulgaria, www.cpdp.bg, kzld@cpdp.bg. We would appreciate the chance to resolve the matter first, so please feel free to contact us at privacy@huntconsult.space.
Security
The website works only over an encrypted connection (HTTPS). Only people who need the data for their work can access it. We collect only the data we need and delete it when the periods above expire.
Changes
When this policy changes, we update the date at the top of the page. For significant changes, we will let you know if we have your contact details.