Privacy Policy

This policy explains what personal data we collect through this website, why we collect it, who processes it on our behalf, and the rights you have over it under the General Data Protection Regulation (GDPR).

Who we are

The controller of your personal data is:

We are a small sourcing business and we have not appointed a Data Protection Officer, as we are not required to. Any question about this policy or about your data goes to the email address above and is answered by us directly.

What we collect

The only personal data this website collects is what you choose to type into the enquiry form on our contact section:

• Full name: required, so we know who we are replying to.
• Company: optional.
• Work email address: required, so we can reply.
• Telephone number: optional.
• Your message: the content of your requirement, including any technical or commercial detail you decide to include.

We ask for business contact details for a business purpose. Please do not send us special category data, and please do not include information about identifiable third parties in the message field unless it is necessary for the enquiry.

Cookies, analytics and tracking

This website sets no cookies. It does not use local storage or session storage, it carries no analytics, no advertising or tracking pixels, and no third-party scripts. The fonts used on these pages are served from our own domain rather than from a font provider, so no font provider learns that you visited.

Because nothing on this site requires consent, there is no cookie banner to dismiss.

Why we use your data, and on what legal basis

We use the data from the enquiry form to respond to your enquiry and, if the enquiry proceeds, to provide sourcing services to you: identifying and verifying manufacturers, managing quotations, and overseeing orders.

Article 6(1)(b) GDPR: steps prior to entering a contract

Where you contact us about a possible engagement, the processing is necessary in order to take steps at your request before entering into a contract, and to perform that contract if one follows.

Article 6(1)(f) GDPR: legitimate interests

Where your message is general business correspondence rather than a pre-contractual enquiry, we rely on our legitimate interest in receiving and answering correspondence addressed to us. We consider this proportionate: the data is business contact data you sent us on your own initiative, and we use it only to reply.

We do not rely on consent for the enquiry form, which is why the form has no consent checkbox. That also means there is no consent for you to withdraw, but you can object to the processing, or ask us to erase the correspondence, at any time. See Your rights below.

Who processes your data for us

We use the following service providers. Each acts as a processor on our instructions and none of them is permitted to use your data for their own purposes.

Web3Forms (Web3Creative)

Web3Forms receives the enquiry form submission and relays it to us by email. The form posts directly to their API, so the fields you complete pass through their systems. Web3Forms is operated from India and runs its infrastructure on Amazon Web Services. Web3Forms publishes a Data Processing Agreement which covers transfers of personal data outside the European Economic Area under the European Commission's Standard Contractual Clauses. Web3Forms retains submissions for up to three years by default.

Google Workspace

Google provides the email hosting for bdjonev@istrospartners.com, so your enquiry and any correspondence that follows are stored in that mailbox.

Cloudflare

Cloudflare hosts and delivers this website. In the course of serving pages it processes IP addresses transiently in its server logs, which is a normal and unavoidable part of how web hosting works. We do not use those logs to build any profile of visitors.

How long we keep it

We keep enquiry correspondence for as long as it remains relevant to a live or prospective business relationship: an open enquiry, an ongoing project, or a supplier relationship we may return to. Once it is no longer relevant, we delete it. We will also delete it sooner if you ask us to, subject only to any records we are required by Bulgarian law to retain, such as accounting records for orders actually placed.

Retention at Web3Forms is governed by their own default of up to three years, as described above.

What we do not do

• We do not sell your personal data, and we never will.
• We do not use it for marketing. We will not add you to a mailing list or send you unsolicited offers.
• We do not carry out automated decision-making or profiling, within the meaning of Article 22 GDPR or otherwise. Every enquiry is read and answered by a person.

Your rights

Under Articles 15 to 22 GDPR you have the right to:

• Access (Article 15): obtain confirmation of whether we hold data about you, and a copy of it.
• Rectification (Article 16): have inaccurate data corrected and incomplete data completed.
• Erasure (Article 17): have your data deleted, where one of the grounds in that Article applies.
• Restriction (Article 18): have us limit our use of your data while a dispute about it is resolved.
• Portability (Article 20): receive the data you gave us in a structured, commonly used, machine-readable format.
• Objection (Article 21): object to processing we carry out on the basis of our legitimate interests.
• Not to be subject to automated decision-making (Article 22): which does not arise here, as we carry out none.

To exercise any of these rights, email bdjonev@istrospartners.com. No particular form of words is needed. We will respond within one month of receiving your request, as Article 12(3) requires, and we will tell you if we need longer because the request is complex. Exercising these rights is free of charge.

Complaints

If you believe we have handled your personal data unlawfully, we would like the chance to put it right, so please contact us first. You also have the right under Article 77 GDPR to lodge a complaint with a supervisory authority at any time, without contacting us first.

Our supervisory authority is the Bulgarian data protection regulator:

If you are in another EEA country, you may instead complain to the supervisory authority where you live or work.

Changes to this policy

If we change how we handle personal data, for example if we change form provider or email host, we will update this page and change the date at the top. This policy was last updated on 15 October 2026.