E-SFLOWS ENGINEERING · LEGAL DOCUMENT

Privacy Policy

1. Purpose and scope

This Privacy Policy explains how S Flows Engineering LTD processes personal data in connection with e-sflows.com (the "Site"), enquiries, quotations, professional correspondence and engineering services. It applies to visitors, prospective clients, clients, suppliers, business partners and individuals acting for those organisations.

The company is established in Bulgaria and offers engineering services in Romania. We apply Regulation (EU) 2016/679 ("GDPR") and the Bulgarian, Romanian and EU rules that are mandatory for the relevant processing or service.

2. Controller and contact details

The controller is:

• S Flows Engineering LTD
• UIC / company identification code: 208832353
• VAT identification number: BG208832353
• Registered and contact address: 2 Kolednitsa Street, 1st floor, Ruse 7000, Bulgaria
• Privacy email: contact@e-sflows.com
• Telephone: +40 722 580 427

Where a separate project agreement identifies another party as controller or joint controller for project data, that agreement and the corresponding notice apply to that processing.

3. Whose data we process and where it comes from

We may process data relating to:

• Site visitors and people who contact us;
• prospective and existing clients, including their employees and representatives;
• consultants, contractors, suppliers, authorities and other project participants;
• persons mentioned in correspondence or project documents where relevant to a legitimate professional purpose.

We generally obtain data directly from the individual or the organisation they represent. We may also receive relevant professional information from a project participant, contractual partner, public authority, public register or other lawful public source. When Article 14 GDPR requires a separate notice, we provide it within the applicable period unless a statutory exception applies.

4. Categories of personal data

Depending on the relationship, we may process:

• identity and contact data, such as name, role, organisation, business address, telephone and email;
• enquiry and communication data, including messages, attachments, requested services, correspondence history and meeting information;
• professional and project data, such as qualifications, responsibilities, instructions, approvals, site or project involvement and information needed to prepare or perform engineering services;
• contract and billing data, including contractual records, invoicing details, payment status and information required by accounting or tax law;
• Site and consent data, such as a privacy choice and limited information necessary to deliver, protect and lawfully evaluate the Site;
• legal and compliance data, such as records needed to establish authority, comply with law, manage complaints or protect legal rights.

We do not ask Site visitors to provide special-category data or criminal-conviction data. Such information should not be sent unless it is genuinely necessary, lawfully requested and protected by an applicable Article 9 or Article 10 GDPR condition.

5. Purposes and legal bases

We process personal data only for specified purposes and on an applicable legal basis.

5.1 Responding to enquiries and preparing proposals

We use contact, communication and project information to understand a request, communicate with the requester and prepare a quotation or proposal. The basis is taking steps at the individual's request before entering into a contract under Article 6(1)(b) GDPR, or our legitimate interest in managing business enquiries under Article 6(1)(f) where the person acts for an organisation.

5.2 Concluding and performing contracts

We use the information needed to conclude, administer and perform an agreement, coordinate a project, document instructions and deliver agreed services. The basis is Article 6(1)(b) where the individual is a party, and Article 6(1)(f) for necessary business-to-business administration involving representatives and project participants.

5.3 Legal, professional and regulatory compliance

We process information required for accounting, taxation, authorisations, professional obligations, safety, public-authority requests and other legal duties. The basis is Article 6(1)(c) GDPR. Where a legal duty belongs to a client or another controller, our role is determined by the relevant agreement and the actual processing.

5.4 Business administration, service quality and legal claims

We may keep appropriate correspondence, project records and evidence to organise work, maintain professional standards, prevent misuse, manage complaints, establish authority and pursue or defend legal claims. The basis is our legitimate interest under Article 6(1)(f), balanced against the individual's rights, or Article 6(1)(c) where a legal duty applies.

5.5 Optional communications, analytics or other consent-based purposes

Where the law requires consent for an optional communication, cookie or similar purpose, the basis is Article 6(1)(a) GDPR together with applicable electronic-communications rules. Consent can be refused or withdrawn without affecting the requested core service. We do not extend consent from one purpose to another.

5.6 Protecting vital interests or performing a public-interest task

These bases are used only in exceptional circumstances where the legal conditions in Article 6(1)(d) or (e) GDPR are actually met; they are not treated as routine business bases.

6. Whether providing data is mandatory

Fields marked as required, and information necessary to understand an enquiry, conclude a contract or comply with law, must be provided if the corresponding service is requested. Without it, we may be unable to answer, quote or perform the service. Optional information may be withheld without adverse consequences unrelated to that information.

Please provide only information relevant to the request and do not disclose confidential personal data about another person unless you are authorised and have a lawful reason to do so.

7. Recipients and processors

Personal data are disclosed only where necessary and proportionate. Recipient categories may include:

• authorised personnel and professional collaborators who need the information for their duties;
• hosting, communication, document-management, accounting and other service providers acting under appropriate contractual and confidentiality obligations;
• engineers, designers, contractors, consultants and other project participants where needed for a requested service;
• accountants, auditors, insurers, banks and legal or professional advisers;
• public authorities, courts, regulators or law-enforcement bodies where disclosure is required or legally justified;
• a purchaser, successor or adviser involved in a genuine corporate transaction, subject to lawful safeguards.

We assess whether a recipient acts as our processor, an independent controller or a joint controller according to the facts. Processors may act only on documented instructions, unless law requires otherwise, and must provide the protections required by Article 28 GDPR.

We do not sell personal data.

8. International transfers

We seek to process data within the European Economic Area. Where a recipient or service arrangement involves a country outside the EEA, the transfer takes place only under Chapter V GDPR, for example on the basis of an adequacy decision, standard contractual clauses with any necessary supplementary measures, or a narrowly applicable statutory derogation.

You may ask us for information about the applicable transfer safeguard and, where legally available, a copy or meaningful description of it.

9. Retention

We retain personal data only for as long as necessary for the relevant purpose. The criteria used are:

• enquiries are kept while being handled and for a reasonable follow-up period, then deleted or anonymised when no longer needed;
• proposal, contract and project records are kept for the relationship and any mandatory professional, limitation, warranty or record-keeping period;
• accounting and tax documents are retained for the period required by applicable Bulgarian, Romanian or EU law;
• consent and privacy-choice records are retained only as long as needed to respect the choice and demonstrate compliance;
• complaint and legal-claim material is retained until the matter and any applicable limitation or enforcement period have ended;
• data subject request records are retained for the period needed to show that the request was handled lawfully.

When several periods apply, we use the longest lawful period required for the specific record. At the end of the period, data are deleted, anonymised or securely archived where continued storage is legally required. We suspend routine deletion where information must be preserved for a dispute, investigation or lawful authority request.

10. Cookies and online services

Our Cookie Policy explains the legal purposes and consent rules for storing or accessing information on a visitor's device. Optional cookies and equivalent functions are not activated before valid consent where consent is required.

We do not use this Privacy Policy as a substitute for a current consent choice. If an online function involves another organisation, its role, purpose and any international-transfer implications are assessed under the GDPR and communicated in the appropriate layer of information. The information made available to visitors is reviewed when the processing actually in use changes.

11. Security and personal data breaches

We maintain appropriate technical and organisational measures proportionate to the nature, context and risks of processing. These include governance, access, confidentiality, continuity, supplier and incident-response measures selected according to risk. No method can guarantee absolute security.

Where a personal data breach occurs, we assess it and notify the competent supervisory authority and affected individuals when Articles 33 and 34 GDPR require this. Individuals should promptly report suspected misuse or accidental disclosure to contact@e-sflows.com.

12. Your rights

Subject to the conditions and exceptions in law, you may request:

• access to your personal data and information about processing;
• rectification of inaccurate or incomplete data;
• erasure where there is no overriding lawful reason to retain the data;
• restriction of processing in the cases set out by Article 18 GDPR;
• data portability for data processed by automated means on consent or contract, where applicable;
• objection to processing based on legitimate interests, including an absolute right to object to direct marketing;
• withdrawal of consent at any time for future processing;
• protection from a decision based solely on automated processing that produces legal or similarly significant effects, where Article 22 applies.

These rights are not absolute. For example, legal obligations, professional records, the rights of others or the establishment, exercise or defence of legal claims may justify refusal or limitation. If we cannot comply fully, we will explain the lawful reason and available remedies.

13. Exercising a right

Send requests to contact@e-sflows.com or to our postal address. Please identify the relationship or communication concerned. We may request information reasonably necessary to verify identity and authority; we will not ask for disproportionate identification.

We normally respond within one month. For a complex request or several requests, the period may be extended by up to two further months, in which case we will notify you within the first month. Requests are generally free of charge. A reasonable fee or refusal may apply only to manifestly unfounded or excessive requests as permitted by Article 12 GDPR.

14. Automated decisions and children

We do not use Site data to make decisions based solely on automated processing that produce legal or similarly significant effects. If this changes, we will provide the information and safeguards required by Article 22 GDPR before such processing begins.

The Site and our engineering services are not directed at children. If we learn that a child has submitted personal data without a valid legal basis or appropriate authorisation, we will take reasonable steps to delete or otherwise lawfully handle it.

15. Complaints and judicial remedies

You have the right to complain to a supervisory authority, particularly in the Member State of habitual residence, place of work or alleged infringement, and to seek a judicial remedy.

Because our main establishment is in Bulgaria, the Bulgarian Commission for Personal Data Protection (CPDP) may be contacted at 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg. Individuals in Romania may also contact the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 G-ral Gheorghe Magheru Blvd., District 1, 010336 Bucharest, www.dataprotection.ro.

Contacting us first is welcome but is not a condition for exercising these remedies.

16. Changes, legal framework and contact

We may update this Policy to reflect changes in law or actual processing. The current version and effective date will be published on the Site. Where a change creates a new consent-based purpose, we will request consent rather than rely only on the updated text.

This Policy is intended to reflect the GDPR, the Bulgarian Personal Data Protection Act, Romanian Law no. 190/2018 and Law no. 506/2004 where applicable, and other mandatory Bulgarian, Romanian and EU rules relevant to the specific processing. It is an information notice and does not limit statutory rights.

S Flows Engineering LTD · 2 Kolednitsa Street, 1st floor, Ruse 7000, Bulgaria · contact@e-sflows.com · +40 722 580 427