01Data controller
This policy describes how CaptureValue.ai EOOD ("CaptureValue.ai", "we", "us") processes the personal data of visitors to the website capturevalue.ai (the "Site") and of the people who get in touch with us, in accordance with Regulation (EU) 2016/679 (the "GDPR"), the Bulgarian Personal Data Protection Act (Закон за защита на личните данни) and, for people residing in France, French Law No. 78-17 of 6 January 1978 (the "Informatique et Libertés" Act).
The data controller is:
- Company name
- CaptureValue.ai EOOD / Ltd. (« КепчърВелю.Ай » ЕООД)
- Legal form
- Single-member limited liability company under Bulgarian law (ЕООД)
- Share capital
- EUR 100
- Registration (UIC / EIK)
- 208895275 — Bulgarian Commercial Register (Търговски регистър), kept by the Registry Agency
- Registered office
- 13 George Washington Street, 1000 Sofia, Bulgaria
- Legal representative
- Ahmed Malek Abdelkamel, Managing Director
- contact@capturevalue.ai
Contact for personal data matters: contact@capturevalue.ai. We have not appointed a Data Protection Officer (DPO), as this is not mandatory given the nature of our processing. Should a DPO be appointed, their contact details will be published here.
02Data we process
Data you provide to us
When you contact us, request a meeting or exchange with us (by e-mail, telephone, an appointment-booking tool or during a scoping call): identity (surname, first name), professional contact details (e-mail address, telephone number), organisation and role, the content of your request and of our exchanges, and any information you choose to share with us.
Data collected automatically
When you browse the Site, our hosting provider and we collect technical data: IP address, browser type and version, operating system, pages viewed, date and time of the visit, referring site. This data is stored in the server's connection logs and is used to keep the Site secure and running properly.
Cookies and trackers
The Site only uses strictly necessary cookies. Cookies subject to consent (analytics, third-party content) are only set with your agreement. See our cookie policy.
Data processed on behalf of our clients
In the course of our services (in particular the Commodum and SetRecord solutions), we may process data on behalf of our clients. In that case we act as a processor within the meaning of Article 28 of the GDPR, on the documented instructions of the client, who remains the data controller. The data stays hosted in the client's environment and is not duplicated. Such processing is governed by a specific data processing agreement; data subjects are invited to exercise their rights directly with the client concerned.
03Purposes and legal bases
We only process your data for specified, explicit and legitimate purposes, on one of the legal bases provided for in Article 6 of the GDPR:
| Purpose | Data concerned | Legal basis |
|---|---|---|
| Responding to your contact requests and arranging a meeting | Identity, contact details, organisation, content of the request | Pre-contractual steps taken at your request (Art. 6(1)(b)); legitimate interest in responding to enquiries (Art. 6(1)(f)) |
| Managing the commercial and contractual relationship (quotes, contracts, invoicing, follow-up) | Identity, contact details, organisation, contractual and billing data | Performance of a contract (Art. 6(1)(b)); legal accounting and tax obligations (Art. 6(1)(c)) |
| Business-to-business prospecting, in connection with the role held | Identity, professional contact details, organisation, role | Legitimate interest in developing our business (Art. 6(1)(f), Recital 47), with the right to object at any time |
| Ensuring the security, availability and technical improvement of the Site | Connection logs, technical data | Legitimate interest in the security of our systems (Art. 6(1)(f)) |
| Measuring the Site's audience and embedding third-party content | Browsing data, cookie identifiers | Consent (Art. 6(1)(a)), collected through the cookie banner and withdrawable at any time |
| Handling your requests to exercise your rights and responding to authorities | Identity, contact details, elements of the request | Legal obligation (Art. 6(1)(c)) |
No decision producing legal effects concerning you is taken solely on the basis of automated processing.
04Where the data comes from
The data we process comes from:
- you directly, when you contact or exchange with us;
- your organisation, when a colleague passes on your contact details in the context of a project;
- publicly available professional sources (your organisation's website, professional social networks, directories), as part of our B2B prospecting. In that case, we inform you of the origin of your data at the latest at the time of our first communication, in accordance with Article 14 of the GDPR.
05Recipients
Your data is accessible, within the limits of their duties and on a need-to-know basis:
- to the members of the CaptureValue.ai team in charge of the commercial relationship, service delivery and administration;
- to our technical processors, who act on our instructions under an agreement compliant with Article 28 of the GDPR: the Site's hosting provider ([to be completed : hosting provider]), professional e-mail provider ([to be completed : e.g. Google Workspace, Microsoft 365]), appointment-booking and video-conferencing tool ([to be completed : e.g. Calendly, Google Meet]), invoicing and accounting tool ([to be completed : e.g. accounting firm, invoicing software]);
- to administrative or judicial authorities, where required by law.
We do not sell or rent your data to third parties.
06Transfers outside the European Union
CaptureValue.ai is established in the European Union and favours providers that host data within the European Economic Area (EEA).
Where a provider is located outside the EEA, or may access the data from outside the EEA, the transfer is governed by one of the mechanisms provided for in Chapter V of the GDPR: an adequacy decision of the European Commission (in particular the EU–US Data Privacy Framework, for companies that have joined it) or standard contractual clauses, supplemented where necessary by additional measures.
Typefaces. The Site's fonts are loaded from Google's servers (Google Fonts). When a page loads, your IP address is transmitted to Google LLC (United States), a company that has joined the Data Privacy Framework. This service sets no cookies. You can object by blocking requests to fonts.googleapis.com and fonts.gstatic.com with a browser extension; the Site remains readable with fallback fonts.
You can obtain a copy of the applicable safeguards by contacting us at the address given in section 1.
07Retention periods
We keep your data for as long as necessary for the purposes for which it was collected, then delete or anonymise it:
| Category | Retention period |
|---|---|
| Contact requests and prospects that did not lead to a contract | 3 years from your last contact |
| Clients: contractual and follow-up data | Duration of the contractual relationship, then 5 years under the limitation period (Art. 110 of the Bulgarian Obligations and Contracts Act) |
| Accounting and tax records (quotes, invoices) | 10 years from the end of the financial year concerned (Bulgarian Accountancy Act) |
| Connection logs | 12 months maximum |
| Cookie choices | 6 months |
| Requests to exercise rights | Time needed to handle the request, then archived for 5 years for evidentiary purposes |
08Security
We implement appropriate technical and organisational measures to protect your data against loss, alteration, unauthorised access or disclosure: encrypted communications (HTTPS), need-to-know access control, strong authentication on our tools, backups, selection of processors offering sufficient guarantees, and team awareness.
In the event of a data breach likely to result in a high risk to your rights and freedoms, we will inform you under the conditions set out in Article 34 of the GDPR.
09Your rights
Under Articles 15 to 22 of the GDPR, you have the following rights over your data:
- Access: obtain confirmation that your data is being processed and receive a copy of it;
- Rectification: have inaccurate or incomplete data corrected;
- Erasure: have your data deleted, in the cases provided for by the GDPR;
- Restriction: have the processing temporarily frozen;
- Portability: receive the data you provided to us in a structured, commonly used format;
- Objection: object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest, and unconditionally to commercial prospecting;
- Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (for cookies, via the "Manage cookies" link);
- Post-mortem instructions (people residing in France): decide what happens to your data after your death.
To exercise these rights, contact us by e-mail at contact@capturevalue.ai or by post to CaptureValue.ai EOOD, 13 George Washington Street, 1000 Sofia, Bulgaria. We may ask for proof of identity where there is reasonable doubt about your identity. We respond within one month of receiving the request, extendable by two months for complex or numerous requests, in which case you will be informed.
10Lodging a complaint with a supervisory authority
If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the competent supervisory authority:
- In Bulgaria (lead authority): Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia — www.cpdp.bg;
- In France: Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr;
- or with the supervisory authority of the EU Member State in which you habitually reside or work.
11Minors
The Site is aimed at professionals and is not intended for people under 18. We do not knowingly collect data about minors. If you believe a minor has provided us with data, please contact us so that we can delete it.
12Changes to this policy
We may amend this policy to reflect changes in our processing, in regulation or in the recommendations of supervisory authorities. The version in force is the one published on the Site; the date of the last update appears at the top of this page. In the event of a material change, we will inform you by any appropriate means.