DRAFT — the technical fields must be completed before publication.
1. Data Controller
1.1. The controller of the personal data processed in connection with the website https://smartmetalsystems.com/ and the enquiries we receive is Smart Metal System EOOD, UIC 207790175, VAT No. BG207790175, with its registered office and management address at 18 Todor Chengeliev St., Shumen, Bulgaria, represented by Emil Marinov Kutsarov. For questions and to exercise your rights regarding personal data: info@smsevo.com. Contact telephone: +359 88 9220309.
1.2. This policy covers visitors to the Site, people making enquiries, applicants for business partnerships, clients and representatives of organisations. It also applies to messages we receive by email, telephone or through our company social media profiles, insofar as we process the data for the purposes described. No claim is made that telephone calls are recorded.
2. What Data We Process
2.1. When you make an enquiry, we process the data you provide: name, email, telephone, company and job title where relevant, the content of the message and any attached files. When discussing a project, this may include the address or location of the site, drawings and other necessary information. When concluding and performing a contract, we also process the necessary contractual, invoicing and payment data. You do not need to send us your personal identification number, copies of personal documents or sensitive data through the general enquiry form. If a specific procedure requires additional data, we will clarify why it is needed and the appropriate way to provide it.
2.2. When you apply for a partnership, we may process the company or team you specify, your professional role, the town and area you work in, your field of activity, the type of cooperation you are seeking, a description of your experience and links to a portfolio or professional profile. We use this to assess the proposal and for subsequent business communication. Do not provide unnecessary data about third parties in your portfolio or attachments.
3. Technical Data
3.1. When you access the Site, the server and the technical services used may process your IP address, the date and time of the request, the page visited, browser and device information and technical events. These are used to the extent necessary to deliver the pages, for diagnostics and to protect against abuse. Additional analytics and advertising technologies are described separately below and are used only where an applicable legal basis exists.
4. Purposes and Legal Bases
4.1. To respond to an enquiry and prepare a quotation at your request, as well as to conclude and perform a contract with an individual, the legal basis is Article 6(1)(b) of Regulation (EU) 2016/679 (GDPR). When we communicate with a company representative, the basis is our legitimate interest in conducting business communication and organising contractual relationships — Article 6(1)(f).
4.2. For accounting, tax and other legal obligations, we process data on the basis of Article 6(1)(c). For the necessary protection of the Site and the establishment, exercise or defence of legal claims, the basis is our legitimate interest under Article 6(1)(f), taking into account your rights and interests.
4.3. Where consent is required for a particular technology or for marketing communication, the basis is Article 6(1)(a). Such consent is separate, voluntary and can be withdrawn. Responding to an enquiry is not conditional on consent to advertising.
4.4. The consideration of a partnership proposal from an individual who wishes to enter into a contract in their own name is based on taking steps at their request prior to entering into a contract — Article 6(1)(b). For company representatives and other professional contacts, the basis is our legitimate interest in assessing the possibility of business cooperation — Article 6(1)(f). The application does not constitute consent to unlimited future advertising.
5. Sources of Data
5.1. We usually receive data directly from you. When working with organisations, we may receive business contact details from your colleague or employer, from project correspondence or from a public professional source. Where required, we provide information about the specific source and the processing in accordance with Article 14 GDPR.
6. Who May Receive the Data
6.1. Access is given to authorised persons according to their job duties. Where necessary, data may be provided to providers of hosting, email and technical support, accounting and legal services, as well as to designers and other contractors when this is necessary for the specific enquiry or contract. Processors are engaged under the necessary contractual and safeguarding conditions. Data may also be provided to competent authorities where required by law. We limit disclosure to what is necessary for the relevant purpose.
7. Retention Periods
7.1. Enquiry data is kept for the time needed to review it, correspond and follow up on the relevant project. Once the purpose no longer applies, the data is deleted or anonymised, unless retention is necessary for a legal obligation or the justified defence of claims. Contractual and accounting documents are kept in accordance with the applicable statutory periods. In the event of a dispute, the relevant data may be kept until it is finally resolved and the applicable limitation periods have expired. The specific periods stated in section 8 apply to technical records and cookies. Retention periods are assessed according to the purpose, the development of the relationship and the applicable legal requirements.
7.2. The same principle applies to unsuccessful or withdrawn partnership applications: data is not kept indefinitely simply because it might be useful in the future. Longer retention for future opportunities requires a separately defined purpose, an appropriate legal basis and a retention period, about which the person must be informed.
8. Cookies and External Technologies
8.1. Strictly necessary technologies may be used to provide a service you have explicitly requested or for the technical transmission of a message. Where optional analytics or advertising technologies that require consent are used, they should be activated only after you make your choice. Refusing or withdrawing consent should not prevent basic use of the Site. Browser settings also let you manage stored cookies, but blocking necessary ones may affect certain features.
9. Social Networks and External Pages
9.1. When you write to us via Facebook, Instagram or another of our company pages, we process the content of the message, the visible profile name or identifier and the data you provide, in order to review the enquiry and respond. The relevant legal bases described above apply to business communication and any contract negotiations.
9.2. The operator of the social network also carries out its own processing in accordance with its policy. This document does not replace that policy. Sending us a message does not mean that we have gained access to your entire profile.
11. Your Rights
11.1. Subject to the conditions of applicable law, you have the right to access your data, to have inaccurate data rectified, and to erasure and restriction of processing. You have the right to data portability where the processing is automated and based on consent or a contract. Where the legal basis is legitimate interest, you may object on grounds relating to your particular situation. Where data is processed for direct marketing, you may object at any time and processing for that purpose will stop. Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal. Some rights are subject to legal conditions and limitations, for example where a document must be kept by law.
12. How to Exercise Your Rights
12.1. Send a request to info@smsevo.com or to our registered office address, describing your request and a suitable way to contact you. If there is reasonable doubt about your identity, we may ask for additional information, but only to the extent necessary. As a rule, we respond within one month of receiving the request. Where necessary, this period may be extended by up to two further months depending on the complexity and number of requests, in which case we will inform you within the first month and give the reasons. Exercising your rights is generally free of charge; statutory exceptions apply only where the relevant conditions are met.
13. Right to Lodge a Complaint
13.1. If you believe that the processing breaches data protection rules, you may lodge a complaint with the Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, https://cpdp.bg/, contact email: kzld@cpdp.bg. The requirements and methods for validly submitting a complaint are published on the Commission’s website. You may also contact another competent supervisory authority in accordance with the GDPR. You do not need to contact us first in order to exercise this right.
14. Provision of Data and Security
14.1. Providing data for a general enquiry is voluntary. If there is no suitable way to contact you or no information about the project, we may not be able to respond or prepare a quotation. Additional data may be required for a contract or a legal obligation, and we will inform you of this. We apply technical and organisational measures appropriate to the risk to protect the data.
15. Updates
15.1. If the processing changes, we will update this policy and state the new date. Where necessary, we will provide additional information or ask for new consent before the relevant processing.
16. Children’s Data
16.1. The Site presents services for construction projects and professional cooperation and is not aimed at children. We do not ask children to send personal data through the forms. If you believe that such data has been provided without an appropriate basis, please let us know at info@smsevo.com so that we can look into the matter and take the necessary action. This does not introduce a general ban on minors viewing the public pages.
17. Version
17.1. Draft prepared on 11.11.2026. Effective from the date of publication. All fields marked “TO BE COMPLETED”, “TO BE CONFIRMED” and “TO BE CLARIFIED” must be finalised before publication.
