Privacy Policy

Last updated: September 2026

ECOMM LTD ("we", "us", "our") respects your privacy. This policy explains what personal data we collect, why we collect it, how we use it, and what rights you have.

1. Data Controller

The data controller is:

ECOMM LTD
EIK: 201938158 · VAT: BG201938158
Ruse, Bulgaria · EU
Email: office@ecomm.bg

2. What Data We Collect

2.1 Contact form submissions

When you submit our contact form, we collect:

• Your name
• Your email address
• Your website URL (if provided)
• Your message
• Your IP address and submission timestamp (for security and spam prevention)

2.2 AI assistant (chat)

The website has an AI assistant. When you use it:

• Your messages and the recent conversation are sent through our server to OpenAI, which generates the reply. We do not store the conversation on our server.
• The conversation is kept in your own browser (sessionStorage) so it survives a page refresh. It is deleted when you close the tab or press "New chat".
• If you choose to send a request from the chat, the summary (name, email, goal, industry, budget range, timeline, website) is emailed to us and a copy to you.
• Your IP address is used briefly to limit abuse (a counter kept for one hour).

Please do not share sensitive personal information in the chat.

2.3 Analytics

This website currently runs no analytics and no tracking. If we add analytics in the future, it will load only after your explicit consent, and this policy will be updated first.

2.4 Cookie data

See our Cookie Policy for full details on cookies used.

3. Why We Collect Your Data

• Contact form: To respond to your inquiry, provide a quote, or discuss a potential project. Legal basis: legitimate interest (responding to your request).
• AI assistant: To answer your questions during your visit and, if you send a request, to reply to it. Legal basis: legitimate interest, and steps taken at your request before entering into a contract.
• Analytics (not active): Would only run with your consent.
• Cookies: Essential cookies operate on legitimate interest; non-essential cookies require your consent.

4. How We Use Your Data

We use your data only to:

• Respond to your inquiries and provide services
• Send project-related communications (quotes, invoices, updates)
• Protect the website against abuse and spam

We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not send newsletters or promotional emails unless you explicitly request them.

5. Data Processors & Third Parties

Your data may be processed by the following service providers, acting as data processors on our behalf:

Transfers outside the EU (Cloudflare, OpenAI) rely on the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses included in these providers' data processing terms.

Fonts and icons on this website are hosted on our own server. Your browser does not contact Google Fonts or any other third-party font or script service.

If we add another processor, this table will be updated first.

6. Data Retention

• Contact form data: Retained for up to 2 years after the last communication, or as required for ongoing business relationships.
• Chat conversations: Not stored on our server. Kept in your browser until you close the tab. OpenAI may keep API data for up to 30 days for abuse monitoring.
• Requests sent from the chat: Treated like contact form data.
• Theme preference (light/dark): Stored locally on your device until you clear it.

7. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access: request a copy of the data we hold about you
• Rectification: request correction of inaccurate data
• Erasure: request deletion of your data ("right to be forgotten")
• Restriction: request that we limit processing of your data
• Portability: receive your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interest
• Withdraw consent: for any processing based on consent, at any time

To exercise any of these rights, contact us at office@ecomm.bg. We will respond within 30 days.

8. Security

We take reasonable technical and organizational measures to protect your data, including:

• SSL/TLS encryption on all pages
• Secure email hosting
• Access limited to authorized personnel only
• Regular software and security updates

No system is 100% secure. If we become aware of a data breach that affects your rights, we will notify you and the relevant supervisory authority as required by law.

9. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP) of Bulgaria:

Website: www.cpdp.bg
Address: 2, Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria

10. Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top reflects the most recent revision. Significant changes will be noted on our website.