Privacy Policy

The data controller is Ес Капитал Груп ООД (SCapital Group Ltd.), a limited liability company registered in Bulgaria.

Company number (ЕИК): 208249308

VAT number: BG208249308

Registered office (as registered, in Bulgarian): гр. София 1408, район Триадица, България 13, ет. 8, ап. 15

Managers: Svetlana Taneva Staneva and Simeon Lyubomirov Stanev

Email: scapitalgroup@yahoo.com · Phone: +359 885 919911 · Website: scapitalgroup.ltd

The company has not appointed a data protection officer. For any question or request about your personal data, please contact us at scapitalgroup@yahoo.com.

This policy covers the website scapitalgroup.ltd and the personal data we process when you contact us through the contact form, by email or by phone, when you ask to subscribe to marketing communications, and when we use cookies and similar technologies.

We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”), the Bulgarian Personal Data Protection Act and the Bulgarian legislation on electronic communications and electronic commerce.

• Data you give us with an inquiry: your name, email, phone, company, the service you are interested in, and the content of your inquiry.
• Data we record with the inquiry: the language of the form, the date and time it was sent, and the version of this policy at that time.
• Data about the marketing subscription, if you ask for it: whether you requested, confirmed or withdrew it, with the date and time of each; the exact wording you were shown and its version; the language of the form and the version of this policy; a cryptographic fingerprint (hash) of the confirmation and unsubscribe links — never the links themselves.
• Technical data when you visit the site: when you load the site, our hosting provider processes technical data (such as your IP address, browser and device type) to make the site available and secure. To protect the contact form from abuse, the number of submissions from one IP address is briefly limited. We do not store your IP address in the inquiry database.
• Data from cookies and similar technologies — only if such technologies are introduced, and only with your consent (see section 6 and the Cookie Policy).

We do not collect special categories of personal data. Please do not include them in your messages.

An inquiry is a request for a consultation or an audit. We use your data to reply, to discuss your organisation's needs and, if you wish, to agree the scope of the work. Sending an inquiry does not create a contract.

Legal basis: taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in answering business correspondence (Article 6(1)(f) GDPR).

Inquiries are stored in a database located in the European Union, with our provider Supabase (sections 9 and 10). Your contact details (name, email, phone, company) are kept separately from the content of your inquiries; if you write to us more than once from the same email address, your inquiries are linked to the same record. Each new inquiry also sends us an internal notification by email.

Providing your data is voluntary, but without it we cannot reply. Sending an inquiry is not consent to marketing: we will not add you to any marketing list just because you contacted us.

With your consent, we may send you by email:

• information about SCapital Group's services;
• information about new services;
• information about subscription services;
• company updates;
• promotional communications.

Legal basis: your consent (Article 6(1)(a) GDPR), which Bulgarian law also requires for sending commercial communications by electronic means.

The subscription is entirely optional. You ask for it with a box in the contact form that is not ticked in advance; it is not a condition for sending an inquiry, and it is separate from reading this policy and from your consent to analytics cookies. Sending an inquiry is not, in itself, consent to marketing.

The subscription is activated by double opt-in. When you tick the box, we record your request separately from your inquiry — the exact time, the exact wording you were shown and its version, the language of the form and the version of this policy — and email you a confirmation link. Until you confirm, we send you no marketing and you are not on the marketing list.

The confirmation link can be used once and is valid for 7 days. It contains no personal data; we store only a cryptographic fingerprint (hash) of it, never the link itself. If you do not confirm, the subscription is not activated.

When you confirm, we record the time of the confirmation. The request, the confirmation and any withdrawal are kept as separate records; earlier records are never changed, so that we can show when consent was given and when it was withdrawn.

Only people who have confirmed their subscription and not withdrawn it can receive marketing communications.

We do not currently use an email marketing platform. If we start using one, we will name it in this policy before the first mailing.

We plan to use Google Analytics to understand how the site is used — for example, which pages are visited. Google Analytics is not active at present, and the site loads no analytics, advertising or other tracking technology.

Once activated, Google Analytics will load only after you consent to analytics cookies in the cookie settings. Without that consent it does not load and sets no cookies. Consent to analytics is separate from the marketing subscription: one does not include the other.

Legal basis: your consent (Article 6(1)(a) GDPR), given through the cookie settings, in line with the requirement for consent before information is stored on, or accessed from, your device.

Before activating it, we will add the provider, its cookies and their durations to this policy and the Cookie Policy.

You can withdraw any consent at any time, free of charge and as easily as you gave it:

• for marketing communications — with the unsubscribe link every marketing email will contain, or by emailing scapitalgroup@yahoo.com;
• for analytics cookies — in “Cookie settings” at the bottom of the site, which appear once a technology that needs consent is activated.

Withdrawing consent does not affect the lawfulness of processing based on that consent before its withdrawal (Article 7(3) GDPR).

When you withdraw your marketing consent, we record the withdrawal, stop marketing communications and remove you from the marketing list; unused confirmation links stop working. Your contact details and inquiries are not deleted merely because of the withdrawal — sections 4 and 11 apply to them.

Withdrawing marketing consent does not affect our reply to your inquiry or any work already under way.

You have the right to object at any time to the processing of your personal data for direct marketing. Once you object, we stop that processing (Article 21(2) and (3) GDPR).

We do not sell personal data. Data is processed by providers that supply technical services to us, and only as far as those services require:

• Cloudflare — hosting and delivery of the site and the server-side handling of the contact form; processes technical data when you visit, to keep the site available and secure;
• Supabase — a database in the European Union that stores inquiries, contact details and marketing-subscription records;
• Resend — sending emails: our internal notifications of new inquiries and the subscription confirmation emails;
• Yahoo — the provider of our email address scapitalgroup@yahoo.com, which receives inquiry notifications and your correspondence;
• Google — only if Google Analytics is activated, and only with your consent (section 6).

Data may also be disclosed to public authorities where the law requires it.

The database that stores inquiries, contact details and marketing-subscription records is located in the European Union — Supabase's Central Europe (Frankfurt) region.

Certain service providers may process personal data in jurisdictions outside the European Economic Area (EEA) where applicable, subject to the safeguards required by applicable data protection law.

For more information, please contact us at scapitalgroup@yahoo.com.

We keep personal data for as long as is necessary for the purpose for which it was collected and to meet applicable legal obligations:

• Inquiries and contact details: for as long as necessary to handle and answer them. If an inquiry leads to working together, the data is kept in line with our contractual and legal obligations.
• Marketing communications: until you withdraw your consent or object.
• Marketing-subscription records (request, confirmation, withdrawal — date, time, wording and versions): for as long as necessary to demonstrate the consent given and withdrawn.
• Cookies and similar technologies: for the durations set out in the Cookie Policy.

When the data is no longer needed, we delete or anonymise it.

Under the GDPR you have the right to:

• access your personal data (Article 15);
• rectification (Article 16);
• erasure (Article 17);
• restriction of processing (Article 18);
• data portability (Article 20);
• object (Article 21), including to direct marketing at any time;
• withdraw consent at any time (Article 7(3));
• lodge a complaint with a data protection supervisory authority (Article 77).

The data protection supervisory authority in Bulgaria is the Commission for Personal Data Protection (КЗЛД / CPDP). You may also lodge a complaint with the supervisory authority in the EU Member State where you habitually reside or work, or where the alleged infringement took place.

To exercise your rights, write to us at scapitalgroup@yahoo.com. We reply without undue delay and within one month at the latest.

We do not use automated decision-making or profiling. Inquiries are never accepted or rejected automatically.

How the site uses cookies and similar technologies is set out in the Cookie Policy, linked at the bottom of every page.

Your cookie choices and your marketing email subscription are separate: consent to one is not consent to the other.

We may update this policy, for example when we introduce new services or technologies. The current version is always on this page, with the date of the last change at the top.