Privacy Policy

Scope and controller

This policy covers the Calltropic marketing website and the personal data handled when you browse it or send us an enquiry. It does not govern a Calltropic application, customer account or telephony service; those products have their own contractual and data-processing terms.

The company identified on our company details page operates this website and is the controller of the data described here under Regulation (EU) 2016/679 (GDPR). Use the contact details on that page for privacy questions or rights requests. We have not appointed a data protection officer.

Data we handle

Enquiries. The contact form asks for your name, email address and message. Company name is optional. Your selected area of interest is sent with the message. We use this information to understand the request, reply to you and, where relevant, arrange a demonstration.

Security and delivery data. Our hosting infrastructure processes standard request information such as IP address, browser details, requested page and time of access. The form also uses a hidden anti-spam field and a short-lived submission limit. Where configured, Cloudflare Turnstile processes browser and interaction signals to decide whether a submission is likely to be automated.

Consent and language choices. The browser stores your cookie-consent decision, its identifier and update time. If you deliberately switch language, it also remembers that choice. The consent record is shared across calltropic.com and its subdomains; it does not contain your enquiry.

Optional analytics. Vercel Web Analytics and Vercel Speed Insights do not load before you enable Analytics. Once enabled, they collect limited page-view, device and performance data for aggregated website and reliability measurements. Vercel states that Web Analytics does not use cookies and does not retain a cross-site or multi-day visitor identifier. We do not currently use advertising or remarketing tools on this website.

Purposes and legal bases

We process this data on the basis of our legitimate interest under Article 6(1)(f) GDPR, namely responding to business enquiries and pursuing a possible commercial relationship. You may object to this processing under Article 21 GDPR.

Website delivery, security logs, rate limiting and anti-abuse checks rely on our legitimate interest in keeping the site secure and available. The consent record is necessary to remember and demonstrate your choice, including a refusal.

Optional analytics and marketing processing is based on your consent under Article 6(1)(a) GDPR. Optional preference processing uses the same basis where it involves personal data. No optional script loads before the relevant opt-in, and you can withdraw consent at any time.

There is no legal or contractual duty to submit an enquiry. However, providing your name, email and message is necessary for us to reply; there is no obligation to provide them, but we cannot respond without them.

Recipients and international transfers

We do not sell personal data or share it for advertising. Access is limited to Calltropic staff handling the website and enquiries, and the suppliers needed to run those functions:

• Vercel Inc. — hosting, content delivery and, only with Analytics consent, website analytics and performance measurements.
• Resend / Plus Five Five, Inc. — sending the contact-form email to our business inbox.
• Cloudflare, Inc. — the Turnstile anti-abuse check, only where it is configured.
• Our business email provider — receiving and storing the enquiry after delivery.

We may also disclose information when required by law or to establish, exercise or defend legal claims.

Some suppliers process data in the United States. Transfers outside the EEA are made on the basis of the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework, where the recipient is certified under it, and/or on the basis of the European Commission's Standard Contractual Clauses. You may request information about the applicable safeguard from us.

Retention

We keep enquiry data for 12 months after our last contact with you, unless a commercial relationship begins, in which case it is kept for the duration of that relationship and any statutory retention period.

Security and server logs are kept according to the limited operational retention periods of our infrastructure providers. The consent record is retained for up to one year from the latest decision. Its local history is capped at 20 valid decisions and uses the same one-year validity limit. Analytics data is retained according to Vercel's service settings and is used in aggregated form.

Your rights

Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your personal data. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

Use Cookie preferences in the footer to change or withdraw optional cookie consent. For any other request, use the contact details on the company details page. We may need to verify your identity and will respond within the period required by the GDPR.

You may also complain to the Bulgarian supervisory authority:

Комисия за защита на личните данни (КЗЛД), гр. София 1592, бул. „Проф. Цветан Лазаров" № 2, kzld@cpdp.bg, cpdp.bg

Automated decisions

We do not make decisions about you based solely on automated processing and do not profile you. Turnstile assesses whether a form submission is automated; it does not produce a legal or similarly significant effect for you.

Changes

We may update this policy when the website or its suppliers change. The date above identifies the current version. Material changes to how the website handles personal data will be reflected here before the new processing begins.