Privacy Policy

This website is operated by Diadraw Ltd., a software development company registered in Bulgaria. We provide custom software development, AI integration, mobile app development, and related technology services to businesses across Europe and beyond.

For the purposes of GDPR and EU data protection law, Diadraw Ltd. is the data controller of the personal information collected through this website.

Registered address: 16 ulitsa "Ekzarh Yosif", Plovdiv, Bulgaria
Email: office@diadraw.com
Phone: +359 887 194 636

We only collect personal data that you voluntarily provide to us, or that is generated automatically by your visit to this website. We do not collect sensitive personal data (such as health, financial, or identity information) through this site.

Information you give us directly:

• Your name and email address when you complete a contact or project brief form
• Your company name, phone number, and project details if you choose to provide them
• Your name and email when you book a discovery call
• Any information you voluntarily include in the message field of a contact form

Information collected automatically:

• Your IP address and general geographic location (country/city level)
• Browser type, device type, and operating system
• Pages visited, time spent on pages, and referring URL
• Date and time of your visit

Under GDPR, we must have a lawful basis for processing your personal data. Here is what we collect, why, and which legal basis applies:

Contact and project brief submissions
Purpose: To respond to your enquiry and, if relevant, provide you with a project proposal.
Legal basis: Legitimate interests (Article 6(1)(f) GDPR) — specifically our interest in responding to business enquiries, and your interest in receiving a response. In some cases, where we enter a pre-contractual discussion, processing is necessary for the performance of a potential contract (Article 6(1)(b)).

Discovery call bookings
Purpose: To schedule and confirm a call, and to prepare for it.
Legal basis: Legitimate interests (Article 6(1)(f)) and pre-contractual steps (Article 6(1)(b)).

Website analytics (anonymised)
Purpose: To understand how visitors use the site so we can improve it.
Legal basis: Legitimate interests (Article 6(1)(f)). We use privacy-respecting analytics and do not track individual users across the web.

We keep personal data only for as long as necessary for the purpose it was collected.

• Contact form and brief submissions: Retained for up to 2 years from the date of the last communication, in case you follow up or the enquiry leads to an engagement. After that, it is deleted.
• Active client project data: Retained for the duration of the engagement plus up to 5 years for legal and accounting obligations, in line with Bulgarian and EU law.
• Website analytics: Aggregated and anonymised data may be retained indefinitely; individual session data is not stored beyond 90 days.
• Job applications: Retained for up to 6 months after the position is filled, then deleted unless you have given consent to retain your details for future openings.

If you ask us to delete your data at any time, we will do so promptly — see Section 7 for your rights.

We do not sell your personal data. Ever.

We may share data with a small number of trusted third-party service providers who help us operate our website and business. These providers act as data processors on our behalf and are contractually bound to process your data only for the purposes we specify.

Categories of third parties we may use:

• Hosting and infrastructure: Cloud hosting providers for our website and internal systems (e.g. Google Cloud, AWS)
• Calendar and scheduling tools: To manage discovery call bookings
• Email service providers: For sending and receiving enquiry responses
• Analytics: Privacy-respecting analytics tools to understand website usage in aggregate

All third-party providers we use are required to handle your data in compliance with GDPR. Where providers are located outside the European Economic Area (EEA), we ensure appropriate safeguards are in place (such as Standard Contractual Clauses).

We may also disclose your data if required by law, court order, or regulatory authority — but we will notify you where legally permitted to do so.

This website uses a minimal number of cookies — small text files stored on your browser that help the site function.

Essential cookies are strictly necessary for the website to work. They cannot be disabled. These include session management and security cookies.

Analytics cookies help us understand how visitors use the site — which pages are visited, how long people spend on them, and where they come from. We use privacy-respecting analytics that do not track you across other websites and do not fingerprint individual users. These are non-essential and you can opt out.

We do not use advertising cookies, social media tracking pixels, or any cookies that track your behaviour outside of this website.

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies. Note that blocking essential cookies may affect how the site functions.

If you are in the European Economic Area (EEA) or UK, you have the following rights in relation to your personal data. We take these seriously and will respond to any request within 30 days.

To exercise any of these rights, email us at office@diadraw.com with the subject line "Data Request". We will respond within 30 days and at no charge.

You also have the right to lodge a complaint with the supervisory authority in your country. In Bulgaria, this is the Commission for Personal Data Protection (CPDP) — www.cpdp.bg. In the UK, it is the ICO — ico.org.uk.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encrypted data transmission (HTTPS/TLS) across this website
• Access controls limiting who within Diadraw can access personal data
• Regular review of our security practices
• Data minimisation — we only collect what we genuinely need

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and will inform affected individuals where required by law.

No method of transmission over the internet is 100% secure. While we take all reasonable precautions, we cannot guarantee absolute security.

This website is directed at business professionals and is not intended for use by children under the age of 16. We do not knowingly collect personal data from anyone under 16.

If you believe we have inadvertently collected data from a child, please contact us at office@diadraw.com and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

When we make material changes, we will update the "Last updated" date at the top of this page. For significant changes, we may also notify clients we have an active relationship with by email.

We encourage you to review this policy periodically. Continued use of the website after changes are posted constitutes your acknowledgement of the updated policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the personal data we hold about you, please contact us:

Diadraw Ltd.
16 ulitsa "Ekzarh Yosif", Plovdiv, Bulgaria
Email: office@diadraw.com
Phone: +359 887 194 636

We aim to respond to all privacy-related enquiries within 5 business days, and to all formal data subject rights requests within 30 days as required by GDPR.