Privacy Policy

1. Who we are

Evalda is operated by ITNas Ltd., a company registered in Bulgaria (EIK 208793733), with registered address at 6 Mihail Sarafov Street, Sukhata Reka, Poduyane District, 1505 Sofia, Bulgaria. We act as the data controller for personal data collected through this website. You can contact us at atanas@evalda.io.

2. What this policy covers

This policy explains what personal data we collect through evalda.io, why we collect it, how we use it, and what rights you have under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Bulgarian data protection law.

This policy applies to the marketing website at evalda.io. When we make the Evalda product (the regulatory intelligence platform) generally available, a separate product privacy notice will cover account data, classification reports, and other product-specific data flows.

3. What data we collect

We collect personal data in three ways:

3.1 Information you provide to us. When you submit the demo booking form on this site, we collect your name, work email address, the name of your firm or company, and any free-text content you choose to add about the devices you work on or what you would like to see in a demo.

3.2 Information we receive when you contact us. When you email us at atanas@evalda.io or a related address, we receive the content of your message, your email address, and any attachments you send.

3.3 Information collected automatically. When you visit the site, our hosting and analytics provider collect basic technical information such as your IP address, browser type, operating system, the pages you visit, and the date and time of your visit. We use Vercel Analytics, which does not use cookies and does not track individuals across sites.

We do not use tracking cookies, advertising cookies, social media tracking pixels, or third-party analytics that build behavioral profiles. We do not buy or rent personal data from third parties.

4. Why we collect it and our legal basis

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

5. Who has access to your data

Your personal data is accessible to:

• The Evalda team. As of the effective date above, this is Atanas Ivanov, the founder.
• Service providers we use to operate the site, acting as data processors under written agreements that meet the requirements of GDPR Article 28:
  • Vercel Inc. – website hosting and analytics (United States; transfers protected by Standard Contractual Clauses and the EU-US Data Privacy Framework)
  • Google LLC – Google Workspace for email and calendar (United States; transfers protected by Standard Contractual Clauses and the EU-US Data Privacy Framework)
  • Form-handling and calendar scheduling providers as we add them, listed here once integrated

We do not sell or rent your personal data to anyone. We do not share it with third parties for their independent marketing purposes.

6. International transfers

Some of our processors are based outside the European Economic Area (primarily in the United States). Where this applies, transfers are protected by appropriate safeguards under GDPR Chapter V, including Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

7. How long we keep your data

After the retention period, your data is deleted or irreversibly anonymized.

8. Your rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access – to obtain a copy of the personal data we hold about you (Article 15)
• Right to rectification – to correct inaccurate or incomplete data (Article 16)
• Right to erasure – to ask us to delete your data (Article 17)
• Right to restriction of processing – to limit how we use your data (Article 18)
• Right to data portability – to receive your data in a structured, machine-readable format (Article 20)
• Right to object – to processing based on legitimate interests (Article 21)
• Right to withdraw consent – at any time, for processing based on consent (Article 7)
• Right to lodge a complaint with a supervisory authority (Article 77)

To exercise any of these rights, contact us at atanas@evalda.io. We will respond within one month, as required by GDPR Article 12(3).

If you are not satisfied with our response, you can lodge a complaint with the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), at cpdp.bg, or with the supervisory authority in your country of residence.

9. Data security

We use reasonable technical and organizational measures to protect your personal data, including encrypted connections (HTTPS), encrypted storage with our processors, access controls, and regular review of our processors' security postures. No system is completely secure, and we will notify you of any data breach affecting your personal data within 72 hours of becoming aware of it, as required by GDPR Article 33.

10. Children's data

Evalda is a B2B service intended for professional use in regulatory affairs work. It is not directed at, and we do not knowingly collect personal data from, individuals under the age of 16. If you believe we have collected data from a child, contact us immediately.

11. Changes to this policy

We may update this policy from time to time as our services and applicable law evolve. The effective date at the top reflects the most recent revision. Material changes will be highlighted on this page; for substantive changes affecting active commercial discussions, we will also notify you by email.

12. Contact

For questions about this policy or to exercise any of your rights:

• Email: atanas@evalda.io
• Company: ITNas Ltd.
• EIK: 208793733
• Registered address: 6 Mihail Sarafov Street, Sukhata Reka, Poduyane District, 1505 Sofia, Bulgaria