1. Who is responsible?
1.1 PASO CLEANING EOOD, trading as IT bugsolutions, ul. Musala 8, 5138 Polikraishte, Bulgaria, registration and VAT number BG202091716, is the controller of the personal data we process through this website and in our own administration (clauses 2 to 9).
1.2 For personal data in our customers' websites and systems, which we work on under instruction, we are the processor and the customer is responsible (clause 10).
1.3 Contact for privacy questions: contact@itbugsolutions.com. We have not appointed a data protection officer; we assess that this is not mandatory. We work by e-mail, the forms and chat; telephone contact is not always possible.
2. Which data, why and on which legal basis
Per purpose: the data, the legal basis (GDPR Art. 6) and the retention period (clause 8).
| Purpose | Data | Legal basis | Required? |
|---|---|---|---|
| A. Answer your request via the problem form and prepare a diagnosis/quote | platform, problem description, website URL or company name, e-mail address, optional telephone/WhatsApp number, language, date/time; confirmation that you act in a business capacity, are authorised and agree to the terms (version, time, hashed IP value) | Steps at your request before a contract (Art. 6(1)(b)); recording your agreement: legitimate interest in having evidence (6(1)(f)) | Yes for this request. Without an e-mail address we cannot reply. The telephone number is optional and may be left empty. |
| B. Answer your message via the contact form or chat | name, e-mail address, optional telephone/WhatsApp number, message; in chat: message content, time, IP address and device data (by the chat provider) | Legitimate interest in answering questions (6(1)(f)); for a concrete request: 6(1)(b). The chat service is loaded only with your consent or on your click (see cookie policy). | Yes |
| C. Perform Assignments and Care Plans | business and contact details, VAT number, quote/acceptance, communication, work reports, verification evidence; access credentials to your systems (see 10) | Performance of the contract (6(1)(b)) | Yes, to deliver the service |
| D. Payments and administration | invoice data, payment status, payment-provider references (we do not see full card numbers) | Contract (6(1)(b)) and legal accounting/tax obligations (6(1)(c)) | Yes |
| E. Prevent fraud, abuse and for security (authority verification, honeypot/timing on forms, spam filter, logs, rate limiting) | IP address, time, form behaviour (fill time), server logs, refusal log | Legitimate interest (6(1)(f)): protecting our systems and customers | No, but needed for safe use |
| F. Visitor origin (attribution): where a request came from | channel (e.g. search engine, social, AI assistant), source, campaign, click ID (such as gclid/fbclid), referring site, landing page, time; linked to your request | Consent (6(1)(a)) via the cookie banner (statistics category). | No. If you decline, we do not store origin with your request. |
| G. Website statistics (Google Tag Manager, Google Analytics and Microsoft Clarity) | pseudonymous ID, pages visited, device/browser, approximate location, IP (processed by Google according to its settings), events such as "form sent" | Consent (6(1)(a)); not loaded without consent | No |
| H. Chat service Tawk.to (live chat) | chat content, name/e-mail if you enter them, IP, device, Tawk.to cookies/local storage | Consent (6(1)(a)) or your own click to chat (see cookie policy); afterwards 6(1)(b)/(f) for replying | No |
| I. Improve our policy and offer, quality (e.g. reviewing chats, analysing common problems) | aggregated or limited personal data | Legitimate interest (6(1)(f)) | No |
| J. Legal obligations and disputes | relevant file data | Legal obligation (6(1)(c)); legitimate interest in establishing/defending rights (6(1)(f)) | n/a |
2.2 We send no unsolicited marketing e-mail and build no newsletter without your consent. If that changes, we first ask consent or update this policy.
2.3 In the request form and the contact form you can give an optional telephone or WhatsApp number. It is optional and may be left empty; we use it only to contact you about your request and keep it as long as the other data of that request (clause 8). We otherwise communicate by e-mail, the forms and chat.
3. Sources of data
Mostly you provide the data. Technical data (IP, device, origin) come from your visit. When we access your systems, data come from your own environment (clause 10). When verifying authority we may use public data (such as domain data, the company register, VIES).
4. Who receives your data?
We do not sell your data. We share it with processors and recipients we need:
| Recipient | Purpose | Location / transfer |
|---|---|---|
| Hosting and e-mail provider of IT bugsolutions (the website is hosted with Namecheap, web-hosting.com) | website, database, e-mail | Locations depend on the provider; where data leaves the EEA we rely on an adequacy decision or standard contractual clauses |
| Tawk.to | live chat | The provider may process data outside the EEA. Only after consent or your own click on the chat |
| Google (Tag Manager, Analytics) | statistics | US and elsewhere; transfer based on an adequacy decision (such as the EU-US Data Privacy Framework) or standard contractual clauses, as applicable. Only after consent |
| Microsoft (Clarity) | website statistics with session recordings; only after consent | US and elsewhere; transfer based on an adequacy decision or standard contractual clauses, as applicable |
| Stripe and/or PayPal | payments | Payment providers often act as independent controllers for their own legal obligations |
| Anthropic (Claude) | AI assistance for customer communication and first analysis, and drafting | May be processed outside the EEA (US). We do not send passwords, personal data of end users or unnecessary data (clause 6) |
| Backup storage provider in the EEA | backups for care plans | Within the EEA (our commitment) |
| Accountant | administration | Depends on the accountant; bound by confidentiality |
| Supervisors, authorities, courts, payment provider in case of dispute or fraud | legal obligation / rights | depending on case |
5. Transfers outside the European Economic Area
Some suppliers (such as Google, Tawk.to and Anthropic) may process data outside the EEA. We then rely on an adequacy decision (for example the EU-US Data Privacy Framework, where the supplier is certified) or on standard contractual clauses (SCCs) with supplementary measures. You can request a copy of the safeguards at contact@itbugsolutions.com. We self-host the fonts used on this website, so no font requests go to Google.
6. Automated processing and AI
6.1 We use no automated decision-making with legal effect or similarly significant effect (GDPR Art. 22). Prices follow pricing rules set by people, and a person can step in at any time and reviews exceptions.
6.2 Customer communication and our first analysis of a problem may be assisted by AI tools (Anthropic Claude), including for drafting replies and reading logs. We work as automatically as possible, within fixed rules set by people (pricing agreements, working method and security requirements). A person can step in at any time, reviews exceptions and anything outside those rules, and can overrule a result. We send no passwords or access keys and as little personal data as possible; we remove or mask it where possible. If a chatbot/AI assistant for visitors is deployed, we say so in the chat.
6.3 Spam and bot detection (honeypot, fill time) works automatically and may block a request. If you think your message was wrongly blocked, e-mail us.
7. Cookies and similar technologies
See our cookie policy for an overview and your choices. Strictly necessary storage (session, security token, your cookie choice) we use without consent; statistics and chat only with consent. The banner offers Accept all, Reject all and Preferences, and you can reopen "Cookie settings" in the footer at any time.
8. Retention periods
| Data | Period |
|---|---|
| Requests that do not lead to an Assignment (form, e-mail, including an optional telephone number) | 12 months after last contact, then deleted |
| Spam/blocked requests and form logs | 30 days |
| Chat conversations (Tawk.to) | Retention at Tawk.to follows the provider's settings. Where we control it, 12 months; we delete chat logs on request |
| Origin data attached to a request | as long as the request is kept, at most 12 months for non-customers |
| Customer data (quote, acceptance, communication, work report, verification evidence) | 5 years after the end of the last Assignment |
| Accounting and tax data (invoices) | per the statutory retention period in Bulgaria |
| Record of your agreement to the terms (version, time, hashed IP) | duration of the related contract plus 5 years |
| Access credentials to customer systems | no later than 7 days after completion or end of plan |
| Backups of customer systems (processor role) | 14, 30 or 90 days per plan; deleted within 30 days after the plan ends |
| Website statistics (Google Analytics, Microsoft Clarity) | according to the retention setting in Google Analytics, which we keep as short as practical (at most 14 months) |
| Cookie choice | 6 months (then we ask again) |
| Session data on the server | duration of the session, or up to 2 hours of inactivity |
9. Security
We limit access, use an encrypted password manager, two-factor authentication where possible, encrypted connections (HTTPS), separate access keys per customer and logs. We store customer backups encrypted with a provider in the EEA. No system is completely secure. In case of a data breach that poses a risk we notify the supervisory authority within 72 hours where required and inform data subjects where needed.
10. Customer data we work on (our role as processor)
10.1 If you are a customer and give us access to your website, database or backups, we may see personal data of your users, orders or e-mail addresses. We process it only on your instructions, for the Assignment, under the data processing agreement (see "Data Processing Agreement" page). You are the controller for it and must align your own privacy policy.
10.2 Backups may contain personal data. They are used only for restoration, stored encrypted with a provider in the EEA, for the duration of the plan, and then deleted.
10.3 We receive credentials through a secure channel, store them encrypted and delete them within 7 days after completion. We never ask for passwords in chat or plain e-mail.
10.4 Your end users can exercise their rights with you. If we receive a request from them, we forward it to you.
11. Your rights
You have the right to: access; rectification; erasure; restriction; portability; object to processing based on legitimate interest; and withdraw consent (without affecting earlier processing). E-mail contact@itbugsolutions.com with your request and enough information to identify you. We respond within one month (extendable by two months for complex requests). We may ask for identification. Exercising your rights is free, unless the request is manifestly unfounded or excessive.
12. Complaints
You can always complain to us (contact@itbugsolutions.com). You also have the right to lodge a complaint with the supervisory authority: in Bulgaria the Commission for Personal Data Protection (CPDP, Комисия за защита на личните данни, www.cpdp.bg), or the authority in your own country or place of work or residence (e.g. the Autoriteit Persoonsgegevens in the Netherlands, the Data Protection Authority in Belgium; elsewhere your national authority).
13. Children
Our services are aimed at businesses and professionals and not at persons under 16. We do not knowingly collect data from children. If you think this happened, e-mail us.
14. Changes
We may update this policy. The version and date are at the top. For important changes we say so on the website.