E-SFLOWS ENGINEERING · LEGAL DOCUMENT

Cookie Policy

1. Who we are and what this Policy covers

This Cookie Policy explains the legal rules under which S Flows Engineering LTD ("E-sFlows", "we", "us") may use cookies and similar technologies on e-sflows.com (the "Site"). It applies to visitors in the European Union, including visitors in Romania.

Company identification

• Legal name: S Flows Engineering LTD
• UIC / company identification code: 208832353
• VAT identification number: BG208832353
• Registered and contact address: 2 Kolednitsa Street, 1st floor, Ruse 7000, Bulgaria
• Email: contact@e-sflows.com
• Telephone: +40 722 580 427

The company is established in Bulgaria and offers engineering services in Romania. This Policy should be read together with our Privacy Policy.

2. What cookies are

Cookies are small records placed on, or read from, a visitor's device when a website is used. Similar technologies may perform an equivalent function. For legal purposes, the decisive issue is not the technology's name, but whether information is stored on or accessed from a user's device and whether personal data are subsequently processed.

This Policy therefore identifies the purposes, legal conditions, responsible parties and choices relevant to visitors.

3. The legal rule we apply

We distinguish between:

• strictly necessary technologies, used only when essential to transmit a communication or provide a digital function expressly requested by the visitor; and
• optional technologies, which may be used for preferences, audience measurement, analytics, advertising, personalised content or other non-essential purposes.

Strictly necessary technologies may be used without consent only within the narrow exception permitted by applicable electronic-communications law. Optional technologies are not activated before the visitor has given valid consent.

Where consent is required, it must be freely given, specific, informed and unambiguous. Silence, continued browsing, scrolling, pre-selected options or inactivity do not constitute consent. Refusing optional cookies does not prevent access to the essential content and functions of the Site.

4. Purposes for which cookies may be used

Depending on the functions actually enabled on the Site, cookies may fall into the following legal-purpose categories:

4.1 Strictly necessary

These support essential functions expressly requested by the visitor, such as remembering a privacy choice, maintaining a requested session, protecting a submitted form or ensuring that the Site displays and communicates correctly. They are not used for advertising or unrelated profiling.

4.2 Preferences

These remember optional choices that improve convenience, such as language or display preferences. They are used only with consent unless the selected function is expressly requested and cannot reasonably be provided without them.

4.3 Audience measurement and analytics

These help us understand, in aggregate or identifiable form as applicable, how the Site is used and how content can be improved. They are activated only after consent where consent is required by law.

4.4 Marketing and personalised content

These may be used to measure campaigns, create profiles or tailor communications. They are activated only after specific consent and are not treated as necessary merely because they benefit the business.

4.5 Third-party content

Some external content or functions may allow another organisation to store or access information on a visitor's device. Where that use is not strictly necessary, the content or function is blocked until the visitor consents.

The consent panel displayed on the Site identifies the optional categories actually available at the time of the visitor's choice. If an optional category is not in use, it should not be presented as active or requested as a condition of access.

5. How consent is requested and recorded

When optional cookies are used, the Site presents a clear choice before activation. The visitor can accept or reject optional purposes and, where offered, make a more granular selection. The route to refusal must be as accessible as the route to acceptance and the interface must not use misleading pressure or design.

Consent is requested separately from acceptance of the Terms and Conditions. We may keep a limited record of the choice in order to respect it and demonstrate compliance. That record is not used to infer consent for a different purpose.

6. Duration, renewal and withdrawal

A cookie may last for a browsing session or for a limited period. Its duration must be proportionate to its stated purpose and must not be extended merely by reclassifying or repeatedly replacing it.

Where optional cookies are used, current information about their purpose, responsible party and duration is made available through the consent settings at the time of the choice. We review optional purposes periodically and request consent again when required because the purpose, responsible parties or legal conditions have materially changed.

The visitor may withdraw consent at any time through the Site's cookie settings or by contacting us. Withdrawal is as easy as giving consent and takes effect for future use; it does not affect the lawfulness of processing carried out before withdrawal. Browser settings may also delete or block cookies, although blocking strictly necessary technologies can affect a function expressly requested by the visitor.

7. Third parties and transfers outside the EEA

Where an optional function involves another organisation, that organisation may act as our processor, an independent controller or, in limited cases, a joint controller. Its role must be assessed according to the actual processing and reflected in the information provided at the time of consent and in the Privacy Policy.

Personal data are transferred outside the European Economic Area only where a lawful transfer mechanism under Chapter V GDPR applies, such as an adequacy decision, appropriate safeguards or a narrowly applicable statutory derogation. A visitor may request information about the relevant safeguard from us.

8. Personal data and your rights

Information associated with cookies may constitute personal data, particularly when linked to an identifier, device, account, communication or usage history. Such processing is governed by our Privacy Policy, which explains legal bases, recipients, retention criteria and the rights of access, rectification, erasure, restriction, portability and objection, as applicable.

Consent may be withdrawn without affecting other rights. A request can be sent to contact@e-sflows.com. We may ask for information reasonably necessary to verify identity before disclosing or changing personal data.

9. Children

The Site and the engineering services presented on it are not directed at children. We do not knowingly seek a child's consent for optional cookies. If we learn that information relating to a child was collected without a valid legal basis, we will take appropriate steps to remove or otherwise lawfully handle it.

10. Complaints

You may complain to the supervisory authority of your habitual residence, workplace or the place of the alleged infringement. Because our main establishment is in Bulgaria, the Bulgarian Commission for Personal Data Protection (CPDP) may be contacted at 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg. Visitors in Romania may also contact the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 G-ral Gheorghe Magheru Blvd., District 1, 010336 Bucharest, www.dataprotection.ro.

We invite you to contact us first so that we can examine the matter, but this is not a condition for lodging a complaint.

11. Changes to this Policy

We may update this Policy when legal requirements, the Site's purposes or the parties involved change. A new version will show its effective date. A policy update does not validate earlier non-compliant use and does not replace the need to obtain fresh consent when the law requires it.

12. Legal framework and contact

This Policy is intended to reflect Regulation (EU) 2016/679 (GDPR), Directive 2002/58/EC as amended, the Bulgarian Personal Data Protection Act, Romanian Law no. 506/2004, and other mandatory Bulgarian, Romanian and EU rules applicable to the specific processing.

For questions or to exercise a right, contact:

S Flows Engineering LTD · 2 Kolednitsa Street, 1st floor, Ruse 7000, Bulgaria · contact@e-sflows.com · +40 722 580 427