Privacy Policy
Last updated: 28 October 2026
This Privacy Policy explains how EVLabs processes personal data when you visit evlabsdigital.com or contact us about our business services. It applies to website visitors, prospective clients and business contacts. Processing carried out for a client as its service provider is governed by the relevant client agreement and data processing terms.
1. Who is responsible for your data
EV LABS LTD. (ИВИ ЛАБС ООД), trading as EVLabs
Bulgarian limited liability company, registered in the Commercial Register and Register of Non-Profit Legal Entities maintained by the Bulgarian Registry Agency.
EIK/UIC: 206802849
VAT number: BG206802849
Registered office: 71 Stoycho Moshanov Street, floor 4, apartment 3, Central District, Plovdiv 4000, Bulgaria.
Business office: Asenovgradsko Shose 4B, floor 7, Plovdiv, Bulgaria.
Email: info@evlabsdigital.com
Telephone: +359 88 799 1230
EV LABS LTD. is the controller for the website processing described here. For privacy questions or to exercise your rights, email info@evlabsdigital.com with the subject “Privacy request”, or write to our registered office.
2. Data we collect
When you contact us, we receive the name, email address, company name and project information you provide, together with subsequent correspondence. Our Elementor contact form stores submissions in WordPress and sends them to info@evlabsdigital.com. Submission records can include the date and time, page URL, IP address and browser user-agent information.
Website operation may also involve technical logs containing IP addresses, requested pages, timestamps, browser and device information and security events. Google Analytics is integrated into this website and can process online identifiers, device and browser information, page views, interactions and approximate location. See the Cookie Policy for more detail.
Please provide only information needed for your enquiry. Do not submit passwords, financial credentials, special-category personal data or confidential client datasets through the public form. If you share another person’s data, you must be entitled to do so.
3. Purposes and legal bases
Answering enquiries and discussing projects: we process contact details, enquiry content and correspondence to respond, understand your requirements and prepare proposals. Where you personally request steps towards a contract, the basis is Article 6(1)(b) GDPR. For contacts acting for a company, the basis is our legitimate interest under Article 6(1)(f) in communicating with prospective clients and managing business relationships.
Operating and protecting the website: technical and form metadata are used for delivery, troubleshooting, abuse prevention and information security, based on our legitimate interests under Article 6(1)(f). We assess these interests against your rights and use only data appropriate to the purpose.
Legal obligations and claims: where applicable, we retain or disclose records to comply with binding legal duties under Article 6(1)(c), or establish, exercise or defend legal claims based on Article 6(1)(f).
Optional analytics: the legal basis for optional analytics involving personal data is consent under Article 6(1)(a), together with the applicable rules on accessing or storing information on your device. Optional tracking requires prior consent. Simply visiting the website or submitting an enquiry does not provide that consent.
An enquiry is not a subscription to marketing. Any optional marketing consent must be requested separately and can be withdrawn.
4. Whether you must provide information
You are not legally required to submit an enquiry. We need sufficient contact information and project context to reply. If you do not provide them, we may be unable to respond or assess your request. Optional analytics are not necessary to send us an enquiry.
5. Who can receive your data
Data may be accessed by authorised EVLabs staff and by providers supporting website hosting, maintenance, backups, security and email delivery, to the extent needed for their functions. Elementor form submissions are stored in our website database; use of the Elementor software does not by itself mean every submission is sent to Elementor’s own servers.
Google receives data through the Google Analytics integration. For users in the European Economic Area, the service is generally provided by Google Ireland Limited, with processing involving Google group companies where applicable. See Google’s Privacy Policy. Professional advisers and competent authorities may receive information where necessary for legal advice, a legal obligation or a claim.
6. International processing
Some service providers, including Google, operate internationally and processing can involve countries outside the European Economic Area. Transfers must meet Chapter V GDPR, for example through an applicable European Commission adequacy decision or approved Standard Contractual Clauses with any necessary supplementary measures. You can contact us for information about the safeguards applicable to your data and how to obtain a copy. This notice does not itself authorise a transfer or replace the required safeguards.
7. How long data are kept
Retention depends on the purpose and type of record. Enquiry correspondence and website submission records are needed while we assess and respond to a request and conduct any related business discussions. If a project proceeds, relevant records form part of the client relationship and are kept for the applicable contractual, accounting and legal periods.
Where no project proceeds, the relevant criteria are whether the discussion is still active, whether further contact is reasonably expected, and whether retaining particular records is necessary for a legal obligation or a claim within the applicable limitation period. Technical logs are kept according to operational and security needs; incident records may need longer retention while an incident or claim is resolved. Backups follow their normal replacement cycle and should not be used to restart processing of deleted data.
Cookie lifetimes are explained separately in the Cookie Policy. Cookie expiry is different from retention of data already received by an analytics provider. Contact us for information about the retention applicable to a particular record.
8. Your rights
Subject to the GDPR’s conditions, you may request access, correction, erasure, restriction of processing and portability of data processed automatically on consent or contract grounds. You may object to processing based on legitimate interests on grounds relating to your situation. You have an unconditional right to object to direct marketing.
If processing relies on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing. We may need proportionate information to verify your identity. We normally respond within one month; where the GDPR allows an extension, we will explain it within that first month. Requests are normally free of charge, subject to the GDPR’s limited exceptions.
9. Complaints
You may complain to the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592, Bulgaria, or to another competent supervisory authority. Website: cpdp.bg. Email: kzld@cpdp.bg. See the Commission’s complaint submission instructions, including signature requirements. You do not need to contact us first to exercise this right.
10. Security, external links and changes
Personal data must be protected using technical and organisational measures appropriate to the risk. No online transmission or storage system can be guaranteed completely secure. Contact us if you believe information sent through this website has been compromised.
External websites linked here, including social networks, apply their own privacy notices when you visit them. The enquiry form is not used to make solely automated decisions producing legal or similarly significant effects. This policy may be updated when processing or legal requirements change; the date above identifies the current version.