Privacy Policy

Last updated: 14 October 2026

This policy explains what data we collect when you use outoftheboxbg.com or contact us, why we do it and what rights you have.

1. Who we are

The data controller is Out Of The Box Agency Ltd („Агенция Аут оф да бокс“ ЕООД), UIC 206729645, VAT No. BG206729645, registered address: 12 Dobri Nemirov St., entr. 1, fl. 3, apt. 31, 7000 Ruse, Bulgaria (Out Of The Box Agency, “OBA”, “we”).

Privacy contact: Marketing@outoftheboxbg.com, +359 897 20 36 20.

2. What data we collect

• When you contact us via the form, email or phone: name, email, phone, the topics you are interested in and the content of your message.
• Visit statistics via Plausible Analytics: no cookies and no personal data. We only see aggregated data — which pages are viewed, referring websites, country, device type and browser. IP addresses are not stored; they are only used to create an anonymous daily identifier that changes every day.
• Technical data: on every visit, the server hosting the website processes your IP address and browser data to deliver the page and protect it from abuse (server logs).

We do not collect special categories of data and do not use your data for automated decision-making or profiling.

3. Why we use the data and on what legal basis

• Replying to enquiries and preparing a free quote — pre-contractual steps and our legitimate interest in replying (Art. 6(1)(b) and (f) GDPR).
• Performing contracts with clients — Art. 6(1)(b) GDPR.
• Accounting and tax obligations — Art. 6(1)(c) GDPR.
• Anonymous statistics, security and operation of the website — legitimate interest (Art. 6(1)(f) GDPR).

4. How long we keep data

• Enquiries that do not lead to a contract — up to 12 months after the last communication.
• Contract and invoice data — for the periods required by Bulgarian accounting and tax law.
• Statistics are aggregated and contain no personal data.

5. Who we share data with

We do not sell data or share it for advertising. Data may be processed by providers who help us operate, only as far as necessary:

• our website hosting provider and email service provider;
• Plausible Insights OÜ (Estonia) — anonymous statistics, servers in Germany;
• public authorities, where required by law.

6. Transfers outside the EU

We process data within the European Union and do not transfer it outside the EU. Fonts and all website files are served from our own server, not from third-party services.

7. Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time.

To exercise your rights, email Marketing@outoftheboxbg.com. We reply within one month.

You can lodge a complaint with the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg.

8. Security

The website runs entirely over HTTPS. Only staff who handle enquiries have access to them.

9. Changes

We may update this policy. The current version is always on this page, with the date of the last change.