Privacy Policy
Effective date: 24 August 2026
1. Who we are
Evalda is operated by ITNas Ltd., a company registered in Bulgaria (EIK 208793733), with registered address at 6 Mihail Sarafov Street, Sukhata Reka, Poduyane District, 1505 Sofia, Bulgaria. We act as the data controller for personal data collected through this website. You can contact us at atanas@evalda.io.
2. What this policy covers
This policy explains what personal data we collect through evalda.io, why we collect it, how we use it, and what rights you have under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Bulgarian data protection law.
This policy applies to the marketing website at evalda.io. When we make the Evalda product (the regulatory intelligence platform) generally available, a separate product privacy notice will cover account data, classification reports, and other product-specific data flows.
3. What data we collect
We collect personal data in three ways:
3.1 Information you provide to us. When you submit the demo booking form on this site, we collect your name, work email address, the name of your firm or company, and any free-text content you choose to add about the devices you work on or what you would like to see in a demo.
3.2 Information we receive when you contact us. When you email us at atanas@evalda.io or a related address, we receive the content of your message, your email address, and any attachments you send.
3.3 Information collected automatically. When you visit the site, our hosting provider collects basic technical information such as your IP address, browser type, operating system, the pages you visit, and the date and time of your visit. We use Vercel Analytics for this, which does not use cookies and does not track individuals across sites.
3.4 Analytics cookies, only with your consent. If you accept analytics cookies in the banner shown on your first visit, we also use Google Analytics to understand how visitors use the site – which pages are viewed, how long for, and what device and general location (derived from IP address) they come from. Google Analytics sets cookies in your browser to do this; details are in the table below. We have disabled Google Signals and ad personalization, so this data is not linked to a Google account or used to serve you ads. Google Analytics does not run, and no analytics cookies are set, until you accept.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
_ga | Google Analytics | Distinguishes visitors | Up to 2 years |
_ga_<container-id> | Google Analytics | Persists session state | Up to 2 years |
You can withdraw consent at any time from the "Cookie preferences" link in the footer, which clears these cookies and stops future collection. We do not use advertising cookies, social media tracking pixels, or third-party analytics that build cross-site behavioral profiles. We do not buy or rent personal data from third parties.
4. Why we collect it and our legal basis
| Purpose | Legal basis under GDPR |
|---|---|
| Responding to demo requests and inquiries | Performance of pre-contractual measures at your request – Article 6(1)(b) |
| Sending you updates about Evalda if you have explicitly opted in | Consent – Article 6(1)(a) |
| Measuring site usage with Google Analytics, if you accept analytics cookies | Consent – Article 6(1)(a) |
| Operating, maintaining, and improving the website | Legitimate interest – Article 6(1)(f) |
| Complying with legal obligations | Legal obligation – Article 6(1)(c) |
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
5. Who has access to your data
Your personal data is accessible to:
- The Evalda team. As of the effective date above, this is Atanas Ivanov, the founder.
-
Service providers we use to operate the site, acting as data processors
under written agreements that meet the requirements of GDPR Article 28:
- Vercel Inc. – website hosting and analytics (United States; transfers protected by Standard Contractual Clauses and the EU-US Data Privacy Framework)
- Google Ireland Limited – Google Analytics, only if you accept analytics cookies (transfers, where applicable, protected by Standard Contractual Clauses and the EU-US Data Privacy Framework)
- Google LLC – Google Workspace for email and calendar (United States; transfers protected by Standard Contractual Clauses and the EU-US Data Privacy Framework)
- Form-handling and calendar scheduling providers as we add them, listed here once integrated
We do not sell or rent your personal data to anyone. We do not share it with third parties for their independent marketing purposes.
6. International transfers
Some of our processors are based outside the European Economic Area (primarily in the United States). Where this applies, transfers are protected by appropriate safeguards under GDPR Chapter V, including Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
7. How long we keep your data
| Data type | Retention period |
|---|---|
| Demo form submissions and related correspondence | Until our commercial discussions end, plus a further 24 months |
| Email correspondence outside of a commercial conversation | 24 months from the last interaction |
| Server logs | Up to 30 days |
| Data we are required to retain by law | For the period required by the relevant law |
After the retention period, your data is deleted or irreversibly anonymized.
8. Your rights
Under GDPR, you have the following rights regarding your personal data:
- Right of access – to obtain a copy of the personal data we hold about you (Article 15)
- Right to rectification – to correct inaccurate or incomplete data (Article 16)
- Right to erasure – to ask us to delete your data (Article 17)
- Right to restriction of processing – to limit how we use your data (Article 18)
- Right to data portability – to receive your data in a structured, machine-readable format (Article 20)
- Right to object – to processing based on legitimate interests (Article 21)
- Right to withdraw consent – at any time, for processing based on consent (Article 7)
- Right to lodge a complaint with a supervisory authority (Article 77)
To exercise any of these rights, contact us at atanas@evalda.io. We will respond within one month, as required by GDPR Article 12(3).
If you are not satisfied with our response, you can lodge a complaint with the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), at cpdp.bg, or with the supervisory authority in your country of residence.
9. Data security
We use reasonable technical and organizational measures to protect your personal data, including encrypted connections (HTTPS), encrypted storage with our processors, access controls, and regular review of our processors' security postures. No system is completely secure, and we will notify you of any data breach affecting your personal data within 72 hours of becoming aware of it, as required by GDPR Article 33.
10. Children's data
Evalda is a B2B service intended for professional use in regulatory affairs work. It is not directed at, and we do not knowingly collect personal data from, individuals under the age of 16. If you believe we have collected data from a child, contact us immediately.
11. Changes to this policy
We may update this policy from time to time as our services and applicable law evolve. The effective date at the top reflects the most recent revision. Material changes will be highlighted on this page; for substantive changes affecting active commercial discussions, we will also notify you by email.
12. Contact
For questions about this policy or to exercise any of your rights:
- Email: atanas@evalda.io
- Company: ITNas Ltd.
- EIK: 208793733
- Registered address: 6 Mihail Sarafov Street, Sukhata Reka, Poduyane District, 1505 Sofia, Bulgaria