Privacy policy

1. Who we are (data controller)

This website is operated by FSB Web Solutions, a trade name of GALACTICA 24 EOOD, a company registered in Bulgaria (UIC 207635239), registered office 4 Georgi Damyanov Street, 5990 Telish, Bulgaria. We are the data controller for your personal data under the EU General Data Protection Regulation (GDPR).

For any privacy question or request, email info@fsbwebsolutions.com. We are not required to appoint a Data Protection Officer; privacy requests are handled directly by us at that address.

2. What data we collect

• Quote and contact requests — your name, email address and, if you give them, phone number, company, website, type of organisation, the services you are interested in, budget range, timeline, languages and your message.
• Chat assistant — the messages you type, the page and language you used, the time, and an email address if you choose to leave one.
• Client data — if you become a client: billing details, VAT or company number where applicable, and project content you share with us (texts, logos, images, access details).
• Technical data — server logs with IP address, browser and pages visited, kept for security. For spam and abuse limits on forms and the chat we store only a scrambled (hashed) version of your IP address, never the address itself.

We do not knowingly collect special-category (“sensitive”) data, we do not buy contact lists and we do not profile visitors for advertising.

3. How we use your data and on what legal basis

• To answer your request and prepare a quote — steps at your request before a contract (Art. 6(1)(b) GDPR).
• To deliver our services if you become a client — performance of a contract (Art. 6(1)(b)).
• To issue invoices and keep accounting records — legal obligation (Art. 6(1)(c)).
• To protect the website against spam, abuse and security incidents — our legitimate interest (Art. 6(1)(f)).
• To send you an occasional newsletter or other optional communication — only with your consent (Art. 6(1)(a)), which you can withdraw at any time.

We will never sell your personal data.

4. The chat assistant

The chat answers common questions using our own information. Your messages are stored so our team can follow up and improve the answers. If you leave an email address, your question is forwarded to our team as a request.

When AI answers are switched on, your messages (not your name or email unless you type them) are sent to an AI service provider to generate the answer. The provider acts as our processor, may not use the data to train its models under its business terms, and may process it outside the EEA under the safeguards described in section 6. Please do not type sensitive information into the chat.

5. Who we share data with

Only with service providers we need to run the website and deliver our services, each acting as a processor under a data processing agreement (Art. 28 GDPR):

• Hosting and email: Hostinger International Ltd.
• Domain name, security and spam protection: Cloudflare, Inc. (including Cloudflare Turnstile, when enabled on forms)
• AI answers in the chat, when enabled: the AI provider set in our dashboard (for example Anthropic or OpenAI)
• Invoicing, payment and accounting services, when you become a client

Some portfolio previews may be loaded from the WordPress.com screenshot service (Automattic Inc.), which then receives your IP address as with any image loaded from another website.

6. International transfers

We aim to keep your data within the European Economic Area. Where a provider processes data outside the EEA, we rely on the safeguards of Chapter V GDPR: an EU adequacy decision (including the EU–US Data Privacy Framework) or Standard Contractual Clauses.

7. How long we keep data

• Quote requests and chat questions that do not lead to a project: up to 24 months.
• Chat conversations: up to 12 months, then deleted automatically.
• Client project files: for the duration of the project plus 3 years.
• Invoices and accounting records: as long as the law requires (up to 10 years under Bulgarian tax and accounting rules).
• Server logs: up to 12 months. Login attempts to our dashboard: 30 days.

8. Security

We use HTTPS encryption, restricted and logged access to our dashboard, hashed passwords, encrypted storage of service keys and regular backups. No method of transmission over the internet is 100% secure, but we work to reduce the risks. If a data breach is likely to affect your rights, we notify the competent supervisory authority within 72 hours and, where the risk is high, inform you directly.

9. Your rights

You have the right to access, correct, delete, restrict or object to the processing of your data, and the right to data portability. Where processing is based on consent, you can withdraw it at any time. Email info@fsbwebsolutions.com; we reply within one month (Art. 12 GDPR).

10. Right to complain

You can lodge a complaint with a supervisory authority in any EU Member State, in particular where you live, work or where the issue occurred (Art. 77 GDPR). Our lead authority is the Commission for Personal Data Protection (CPDP), Sofia, Bulgaria — www.cpdp.bg. In Belgium this is the Data Protection Authority — www.dataprotectionauthority.be. The full list of EU authorities is on edpb.europa.eu.

11. Automated decisions and children

We do not make automated decisions with legal or similarly significant effects (Art. 22 GDPR); every quote and decision is made by a person. The chat assistant only gives information. Our services are aimed at businesses and adults; we do not knowingly collect data from children under 16.

12. Changes

We may update this policy; the date above shows the latest version. Significant changes that affect your rights will be highlighted on this page.