Privacy policy
Last updated: 12 October 2026.
This policy explains how EMERANT LTD. ("Emerant", "we", "us") handles personal data when you visit this website or get in touch with us. We collect little, and we keep this policy short for that reason.
Who is responsible
For the data described below, the controller is:
- EMERANT LTD. (ЕМЕРАНТ ЕООД), a company registered in Bulgaria
- Company ID (EIK): [EIK]
- VAT number: BG205933895
- Registered office: blvd. Okolovrasten pat 487, fl. 3, 1853 Sofia, Bulgaria
- Email: •••••@•••••••.•••
We act under Regulation (EU) 2016/679 (the GDPR) and the Bulgarian Personal Data Protection Act. When we process personal data on behalf of a client during an engagement, the client is the controller and we act as processor under a data processing agreement. That work is not covered by this policy.
What we collect, why, and on what legal basis
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| You write or call us (email, phone, WhatsApp, Viber, iMessage) | Name, contact details, employer and role, your message and any attachments | Answering your enquiry, discussing and scoping possible work, following up | Steps at your request before a contract (Art. 6(1)(b) GDPR); our legitimate interest in answering business enquiries (Art. 6(1)(f)) |
| You apply for an Academy seat or a job | CV, application, links to your work, correspondence | Assessing your application and replying | Steps at your request before a contract (Art. 6(1)(b)); your consent for any longer retention (Art. 6(1)(a)) |
| You visit the website | IP address, browser and device type, pages requested, date and time, held in server logs | Keeping the site secure, reliable and free of abuse | Legitimate interest (Art. 6(1)(f)) |
| You choose a language or a region | The choice itself, stored on your device; an analytics event with the language you switched to, which on its own carries no IP address or identifier (the returning-visitor ID below applies if it is on) | Remembering your choice; understanding which languages visitors use | Your request; legitimate interest (Art. 6(1)(f)) |
| You browse the website | Pages viewed, referrer, browser, operating system, device and screen size, language, country, which links and buttons you use (including whether you reach out by email, phone or message, never the address or number itself), how far you scroll an article, how quickly pages load and respond on your device. For a sample of visits, a replay of what the page showed and how you moved through it (mouse movement, clicks, scrolling). On its own this measurement sets no cookie and stores no IP address, name, email address, phone number or typed text (the returning-visitor ID in the next row adds to it unless you switch it off) | Understanding which content helps visitors, finding what is confusing or broken, and improving the site | Legitimate interest (Art. 6(1)(f)) |
| You visit the website again, with the returning-visitor ID on (the default) | A random ID in a first-party cookie (emerant-vid) and, once per visit, a visitor profile linked to that ID and stored in our analytics: your IP address (added by our server), the date, first page, referring website and campaign tags of your first visit, the number of visits so far, your time zone, browser window size, light or dark colour scheme, reduced-motion setting, connection type (where your browser reports it) and the site language | Understanding how visitors find and return to the site, recognising returning visitors, improving the site and our marketing, and seeing which organisation's network a visit came from | Legitimate interest (Art. 6(1)(f)); you can object at any time by switching the ID off |
| You unlock the delivery bench page | The access password, kept in your browser's local storage so the page stays unlocked on your device | Limiting access to people we have invited | Legitimate interest (Art. 6(1)(f)) |
| You are a client, supplier or partner | Contact details of the people we deal with, contracts, invoices | Performing and administering our agreements | Contract (Art. 6(1)(b)); legal obligations such as accounting and tax (Art. 6(1)(c)) |
We do not run advertising, we do not sell personal data, we do not make decisions about you by automated means, and we do not use advertising cookies or third-party tracking cookies on this website. We do measure how the website is used, with the self-hosted tool described next. If our practices change, we will update this policy and the cookie policy first and, where the law requires it, ask for your consent.
Analytics and session replay
We use Umami, open-source analytics software that we run ourselves on servers we control (analytics.ktsparks.net). Your browser sends analytics requests to this website's own address, and our server forwards them to Umami. Nothing goes to an advertising network or to a third-party analytics provider. On its own, Umami sets no cookie and does not store IP addresses. We rely on our legitimate interest in understanding and improving our website.
The returning-visitor ID adds to this. It is optional and on by default. While it is on, we store a random ID on your device (the emerant-vid cookie) and, once per visit, send a visitor profile linked to that ID, which Umami stores as properties of the visit. The profile contains:
- your IP address, which our server adds when it forwards the request;
- your approximate location as determined by our network provider, Cloudflare, from your IP address: country, region, city, postcode, approximate coordinates and time zone;
- details of your first visit: its date, the first page you landed on, the website that referred you (its address without the query string) and the campaign tags (utm source, medium and campaign);
- the number of visits so far;
- your time zone, browser window size, light or dark colour scheme, reduced-motion setting, connection type (such as 4g, where your browser reports it) and the site language.
The first-visit details and the visit count are kept on your device in local storage (emerant.visitor) until you switch the ID off, which deletes them, or clear your browser data.
We use the profile to understand how visitors find and return to the site, to improve it and our marketing, and to recognise returning visitors. We may use the IP address to see which organisation's network a visit came from. We do not sell this data, do not use it for advertising and do not follow visitors across other websites. The ID lasts 13 months from the day it is created, and later visits do not extend it. A short notice on your first visit tells you about it. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). You have the right to object: switching the ID off with the settings at the top of the cookie policy page stops the profile and your IP address from being sent from then on and deletes the ID and the local record from your device at once. To have data already recorded deleted, write to •••••@•••••••.••• and quote the ID shown in the settings. Analytics data, including IP addresses, is kept for up to 13 months and then deleted.
For a sample of visits, Umami's session recorder also captures a replay of the page as you see it and how you move through it. Recordings are masked: what you type into a form field is not captured, and the email addresses and phone numbers shown on the page are blocked from them. Replays are not linked to the random ID above. We use recordings only to find parts of the site that confuse visitors or do not work, never to identify anyone.
You can object at any time by switching the ID off in the settings on the cookie policy page, or by writing to •••••@•••••••.•••, which also covers the rest of the analytics. The website works the same without it.
Who receives your data
- Hosting and infrastructure providers that run this website and our systems.
- Our email provider, and the messaging service you choose when you contact us through it.
- Professional advisers such as accountants, lawyers and auditors, under a duty of confidentiality.
- Public authorities, where the law requires it.
Providers that handle personal data for us act as processors under a data processing agreement. We prefer providers that store data in the European Union or the European Economic Area. Where a provider transfers data outside the EEA, the transfer relies on an adequacy decision (including the EU-US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses.
How long we keep it
- Enquiries that do not lead to work: up to 24 months after the last contact, then deleted.
- Client, supplier and partner records, contracts and invoices: for the length of the relationship and for the periods that Bulgarian accounting and tax law require, generally up to 10 years.
- Applications: up to 12 months after the process ends, unless you agree to a longer period.
- Server logs: up to 90 days.
- Analytics data (including IP addresses) and session replays: up to 13 months, then deleted.
- Cookies and local storage: see the cookie policy.
Your rights
You can ask us for access to your personal data, correction, erasure, restriction of processing and a portable copy. You can object to processing that rests on our legitimate interest, and you can withdraw consent at any time without affecting what happened before. To use any of these rights, write to •••••@•••••••.•••. We reply within one month, and we may ask you to confirm your identity first. We do not charge for this unless a request is clearly unfounded or excessive.
Complaints
You have the right to lodge a complaint with a supervisory authority. In Bulgaria that is the Commission for Personal Data Protection (Комисия за защита на личните данни, КЗЛД), Sofia, www.cpdp.bg. You can also complain to the authority in the EU member state where you live or work. We would like the chance to put things right first, but you do not have to come to us before you go to the authority.
Security
We protect personal data with technical and organisational measures that fit the risk: encrypted connections, access limited to the people who need it, and regular updates of the systems we run. We use Cloudflare Turnstile on protected forms, such as the password page for our delivery bench, to block automated bots; it checks your browser and passes the result and your IP address to Cloudflare. No system is perfectly secure, and if a breach affects you we will tell you and the authority as the law requires.
Children
This website is written for business visitors. It is not directed at children, and we do not knowingly collect their data.
Changes to this policy
We update this policy when our practices change. The date at the top shows the latest version.
Contact
Questions about your data go to •••••@•••••••.•••, or by post to EMERANT LTD., blvd. Okolovrasten pat 487, fl. 3, 1853 Sofia, Bulgaria.