This Privacy Policy explains how xciterr Ltd(“xciterr”, “we”, “us”, or “our”) collects, uses, and protects personal data when you visit https://xciterr.com or get in touch with us. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Bulgarian Personal Data Protection Act.
Who we are (data controller)
The data controller is xciterr Ltd (EOOD), a company registered in Bulgaria under UIC 206478710, VAT BG206478710, with its address at 9 Bulair St., 1612 Sofia, Bulgaria. You can reach us at info@xciterr.com or +359 89 359 88 94.
What data we collect
- Information you give us: when you use our contact form or email us, we collect your name, email address, the topic you select (organization or business enquiry, individual career coaching, student or education partnership, or other), and the contents of your message.
- Technical data: when you visit the site, our hosting provider automatically processes limited technical data such as your IP address, browser type, and the pages you request, in server logs used for security and reliability.
- Anti-abuse data: when you submit our contact form, we briefly process the IP address the submission comes from in order to detect and limit automated or excessive submissions (rate limiting), and we use standard anti-spam techniques to detect automated bot submissions. This information is held only in temporary server memory for the lifetime of the server process handling your request, and is never written by us to a database or log file.
We do not use advertising or analytics tracking, and we do not knowingly collect any special categories of personal data.
How we use your data and our legal bases
- To respond to your enquiries and, where relevant, take the steps you request towards entering into a contract with us. Legal basis: performance of pre-contractual steps taken at your request (Art. 6(1)(b) GDPR) where you are enquiring on your own behalf, or our legitimate interest in responding to business enquiries (Art. 6(1)(f) GDPR) where you contact us on behalf of an organization.
- To prevent abuse of our contact form, such as spam or automated flooding. Legal basis: our legitimate interest in protecting the service from abuse (Art. 6(1)(f) GDPR).
- To operate, secure, and improve the website. Legal basis: our legitimate interest in running a safe, functional site (Art. 6(1)(f) GDPR).
- To comply with legal obligations where applicable (Art. 6(1)(c) GDPR).
We do not sell your personal data, and we do not use it for automated decision-making or profiling.
Who we share it with
We share personal data only with service providers who process it on our behalf under appropriate agreements:
- Vercel Inc., which provides website hosting and content delivery.
- Resend (Plus Five Five, Inc.), which delivers contact-form messages by email.
- Microsoft Corporation, whose Microsoft 365 service we use to receive and store your message.
We may also disclose data where required by law or to protect our legal rights.
International transfers
Some of our providers are headquartered outside the European Economic Area. Where personal data is transferred internationally, it is protected by the following safeguards:
- Vercel Inc.(USA): Vercel is certified under the EU-U.S. Data Privacy Framework, so transfers to Vercel are covered by the European Commission’s adequacy decision for that framework.
- Resend (Plus Five Five, Inc.)(USA): the European Commission’s Standard Contractual Clauses, incorporated into our data processing agreement with Resend. Contact-form emails are sent from Resend’s EU (Ireland) infrastructure.
- Microsoft Corporation(USA): Microsoft’s Data Protection Addendum, incorporating the Standard Contractual Clauses.
Further details of the safeguards applied to a specific transfer are available on request.
How long we keep it
- Contact enquiries: retained for up to 24 months from our last exchange with you, so we can handle follow-up questions, then deleted, unless a longer period is needed to establish, exercise, or defend legal claims, or an ongoing engagement requires it.
- Anti-abuse (rate-limiting) data: held only in temporary server memory for the lifetime of the server process handling your request (typically well under an hour) and never written by us to a database or log file.
- Server and delivery logs: kept by our hosting and email providers for short periods in accordance with their own retention policies, for security and reliability purposes.
Your rights
Under the GDPR, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to our processing;
- data portability;
- where any processing is based on consent, withdraw that consent at any time, without affecting prior processing.
To exercise any of these rights, contact us at info@xciterr.com. We will respond within one month of receiving your request; for complex or numerous requests this may be extended by up to two further months, in which case we will tell you why. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive. To protect your data, we may ask you to verify your identity before acting on a request.
Children
Our services are intended for adults and are not directed at children. If you are under 16, please ask a parent or guardian to contact us on your behalf.
Complaints
If you believe we have not handled your data properly, you have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP), Bulgaria, the supervisory authority for data protection in Bulgaria (cpdp.bg).
Security
We use appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or misuse. No method of transmission over the internet is completely secure, but we work to keep your data safe.
Changes to this policy
We may update this Privacy Policy from time to time. The date at the top of this page shows when it was last revised.
Contact
For any privacy question or request, contact us at info@xciterr.com or by post at 9 Bulair St., 1612 Sofia, Bulgaria.