Privacy Policy

1. Data controller

The controller of personal data is AeroMetrix LTD. Identity and contact details are shown below.

2. Who and what this policy covers

This policy explains how we process personal data concerning website visitors, people who submit an enquiry, representatives of clients and partners, and individuals whose data appears in project correspondence or supplied files.

3. Data we process

• name, role, organisation, email address and telephone number;
• enquiry content, site location and information, programme and required deliverables;
• files, photographs, coordinates, KML/DXF/CAD data and other information you send to us;
• contract, invoicing and payment information;
• technical security and usage data, such as IP address, date, time, requested resource and user agent, where recorded by the hosting infrastructure.

Where data is not obtained directly from the individual concerned, its source may be a commissioning party, client, partner, public register or supplied project file.

Information identified as required in a quotation, contract or project communication is necessary to prepare or perform the service. Without it, we may be unable to quote, perform safely or issue a compliant accounting document. Do not send special-category data, identity documents or children's data unless necessary, agreed in advance and supported by a lawful basis.

4. Why we process personal data and on what legal basis

• Responding to enquiries and preparing quotations. The purpose is to understand the assignment, assess whether we can perform it and propose a scope, timeframe and price. The legal basis is Article 6(1)(b) GDPR where an individual requests steps with a view to entering into a contract in their own name, or Article 6(1)(f) GDPR where we communicate with a representative of an organisation — our legitimate interest in establishing and developing business relationships.
• Performing and managing a commissioned service. The purpose is planning, communication, safe performance, delivery, payment and maintenance of the project record. The legal basis is Article 6(1)(b) GDPR for a contract with an individual or Article 6(1)(f) GDPR for communication with representatives and contact persons of legal entities.
• Accounting and other legal obligations. The purpose is to issue and retain required records and cooperate with competent authorities. The legal basis is Article 6(1)(c) GDPR — compliance with a legal obligation.
• Security and protection of legal rights. The purpose is to protect the website, systems and data, prevent misuse, and establish, exercise or defend legal claims. The legal basis is Article 6(1)(f) GDPR — our legitimate interest in protecting our operations and rights.

Where we rely on legitimate interests, we assess whether the processing is necessary and balance our interest against the rights of the person concerned. You may object to such processing as described in section 10.

5. Cost estimator and automated decisions

The displayed estimator calculation takes place in your browser. Selected values are not sent to AeroMetrix until you submit the enquiry form. On submission, the configuration parameters are validated and recalculated on the server before they are added to the enquiry and automatic confirmation. This protects against altered or invalid values and helps us prepare a response. We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

6. Recipients and processors

Where necessary, data may be shared with providers of email, hosting, cloud storage, accounting, legal and IT services; project-specific subcontractors; and public authorities where there is a legal basis. We use Cloudflare infrastructure to operate and protect the website, including the form security check and backup registration of enquiries submitted through the form. We use Brevo (Sendinblue SAS) to deliver enquiries to our business mailbox and, where an email address is provided, to send an automatic confirmation and summary to the sender. These providers process only the data required for the relevant technical service. We require appropriate confidentiality and data protection.

Where we receive from a client personal data concerning owners, staff, subcontractors or other individuals, the source of the data and each participating organisation's role are determined by the specific assignment. AeroMetrix and the client may be independent controllers, or AeroMetrix may act as a processor; in the latter case, the required agreement under Article 28 GDPR is concluded before processing. Responsibilities follow each organisation's actual role, applicable law and the specific written agreement, rather than this policy alone.

7. Transfers outside the European Economic Area

Where a provider or project requires a transfer outside the EEA, we use an applicable mechanism under Chapter V GDPR, such as an adequacy decision or standard contractual clauses, unless another lawful basis applies. Information about the applicable mechanism and how to obtain a copy or description of the safeguards may be requested using the privacy contact email.

8. Retention periods

• an enquiry that does not lead to a contract: up to 12 months after the last communication;
• project and contract correspondence: for the contract term and up to 5 years after completion, unless a longer period is required;
• accounting documents: for the applicable statutory period;
• technical logs: for as long as required for security, abuse prevention and diagnostics, in accordance with the retention periods of the hosting and security infrastructure provider;
• data connected with a dispute: until final resolution and expiry of the applicable limitation periods.

9. Cookies and similar technologies

As of the date of this policy, the website does not use first-party analytics or advertising cookies. Hosting and the form security check may use strictly necessary technologies and technical data for security, automated-spam prevention and site delivery. If we introduce analytics, advertising or optional cookies, we will update this policy and request consent where required.

If you contact us through Viber or WhatsApp, the selected service processes the communication under its own privacy policy. AeroMetrix LTD receives the information you voluntarily send in the conversation. For coordinates, project files or other sensitive information, we recommend agreeing an appropriate transfer channel in advance.

10. Your rights

Subject to the applicable conditions, you may request information, access, rectification, erasure, restriction and portability, and may object to processing. Where processing is based on consent, you may withdraw it for the future. To exercise a right, email office@aerometrix.bg. We may request reasonable information to verify your identity.

We respond without undue delay and normally within one month. The period may be extended for complexity or multiple requests as permitted by the GDPR. Rights are not absolute; where the law permits a refusal or restriction, we will explain the reason.

You may lodge a complaint with the Bulgarian Commission for Personal Data Protection or another competent supervisory authority.

11. Security, changes and contact

We apply reasonable technical and organisational measures appropriate to the nature of the data and risk. No system can guarantee absolute security. This policy may be updated when our services or the law change; the revised date will appear at the top. Privacy questions may be sent to office@aerometrix.bg.