Who controls the data
Data controller: DEAFOR EOOD (ДЕАФОР ЕООД), UIC 205403854, VAT number BG205403854. Registered address: 2 Dobar Yunak Street, apartment/office 1, 1421 Sofia, Bulgaria. Contact for privacy enquiries: office@deafor.com.
Data we process
For project enquiries, we process the name, business email, optional company name and message supplied by the visitor, together with subsequent business correspondence. Please do not submit passwords, special-category data or information that is not needed for the enquiry.
- Identity and business contact information
- Enquiry content and correspondence
- IP address and limited technical security information
Purposes and legal bases
We process enquiry information to answer requests, assess possible cooperation and take steps requested before entering a contract. The applicable bases are Article 6(1)(b) GDPR where the visitor requests pre-contractual steps and Article 6(1)(f) GDPR for our legitimate interests in managing B2B enquiries, protecting the website and maintaining reliable business communications. The form acknowledgement confirms that this notice has been read; it is not consent to marketing.
Service providers and transfers
The website is hosted by Vercel. Enquiry emails are delivered using Resend (Plus Five Five, Inc.). Deafor has entered into Resend’s Data Processing Addendum. Resend processes email addresses, message content and delivery metadata in the United States under safeguards that include the EU Standard Contractual Clauses and reference the EU–U.S. Data Privacy Framework. Cloudflare Turnstile protects the form against automated abuse and may process security signals including IP address, user-agent, TLS fingerprint, site key and origin. Turnstile does not receive the visitor’s form entries from Deafor.
- Vercel — website hosting and runtime infrastructure
- Resend — transactional email delivery
- Cloudflare Turnstile — bot detection and form security
Retention
Enquiry information and related correspondence are normally retained for up to 24 months after the last meaningful contact, unless a shorter period is appropriate or longer retention is required for a contract, legal obligation or the establishment, exercise or defence of legal claims. Essential security logs are retained only for the period reasonably required to detect and investigate abuse, subject to the hosting and security providers’ configured retention periods. Personal data is not sold.
Your rights and complaints
Subject to the GDPR and applicable law, individuals may request access, rectification, erasure, restriction or portability of their data and may object to processing based on legitimate interests. Requests can be sent to office@deafor.com. Individuals may also lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, or use the complaint channels published at cpdp.bg.
Last updated: 21 August 2026