Privacy Policy

Initial version, pending legal review. This policy describes our current practice honestly and in detail, but it has not yet been reviewed by an external lawyer. We will update it after that review and whenever our processing changes.

Who is responsible for your data

Concreef is a 3D concrete printing initiative based in Sofia, Bulgaria.

Important: Concreef is not yet a registered legal entity. Until registration is complete, the controller of the personal data described here is the Concreef team — the founders operating the concreef.eu website — acting jointly. We will update this policy with the registered company name, company number and registered address as soon as the company is incorporated, and that update will be published on this page.

• Controller: the Concreef team (founders)
• Postal address: 95 Doctor G. M. Dimitrov Blvd., Studentski Kompleks, 1700 Sofia, Bulgaria
• Contact for all data protection matters: info@concreef.eu

We have not appointed a Data Protection Officer. We are not required to appoint one, because we do not carry out large-scale monitoring or large-scale processing of special categories of data. Write to info@concreef.eu and a founder will handle your request directly.

What we collect, why, and on what legal basis

We only collect data for the purposes below. We do not buy personal data, and we do not sell or rent it.

Enquiries sent through the contact form

When you send us an enquiry we store the name, email address, and — if you choose to fill them in — company, phone number, the project type you selected and the message you wrote. We also record the language version of the site you used, a human-readable reference number for your enquiry (for example CR-2609-4KJ7), whether you ticked the privacy consent box and the optional marketing box, and the time you did so. If you are signed in, the enquiry is linked to your account.

Alongside the enquiry we store simple attribution data: the page you first landed on, the referring website (if you came from another site), and any utm_source, utm_medium, utm_campaign, utm_term and utm_content parameters that were in the link you followed. This tells us which channels bring genuine enquiries. It is collected at submission time from data kept in your browser's session storage (see the Cookies Policy), not from a tracking cookie.

• Legal basis: Article 6(1)(b) GDPR — steps taken at your request before entering into a contract, and performance of a contract if we go on to work together.
• Answering the enquiry by email is part of the same purpose. We send a confirmation copy to you and a notification to our own inbox.

Anti-spam and abuse protection on the form

The form contains a hidden field that real visitors never see or fill in. If it is filled in, the submission is discarded as automated spam.

We also limit how many enquiries can be sent from the same network connection in a short window (currently five submissions per ten minutes). To do that we never store your IP address. We take your IP address, combine it with a secret key held only on our server, and store only the resulting SHA-256 hash. The hash cannot be reversed into an IP address, and it is used for nothing except counting recent submissions.

• Legal basis: Article 6(1)(f) GDPR — our legitimate interest in keeping the form usable and protecting our systems from spam and abuse. Your interest is protected by the fact that we store a one-way hash instead of the address itself.

Detailed project enquiries

Where you give us project details — application, location, dimensions, quantities and notes — we store them with your enquiry so we can prepare a meaningful answer or a quotation.

• Legal basis: Article 6(1)(b) GDPR — pre-contractual steps at your request.

User accounts

If you create an account, we store your name, email address, whether the email has been verified, your preferred language, an optional profile image, and — for email/password accounts — a securely hashed password. We never store your password in readable form. You may also add a company, role, phone number and country to your profile; these fields are optional.

You can sign up and sign in in two ways:

1. Email and password. We send a verification email; the account is usable once verified. We also send password reset and password change emails when you ask for them.
2. Google or GitHub. We receive from the provider the account identifier, your name, email address and profile picture, plus the tokens needed to complete the sign-in. We do not receive your password, and we do not post anything on your behalf.

While you are signed in we keep a session record containing a session token, its expiry, and the IP address and browser user agent of the device that signed in. This is standard security information: it lets us expire stale sessions and recognise suspicious activity.

• Legal basis: Article 6(1)(b) GDPR for creating and running your account; Article 6(1)(f) GDPR (security of our service) for the session security details and for rate limiting sign-in attempts.

Newsletter and marketing email

We only send marketing email to people who asked for it. We store the email address, the language you chose, the time and source of your consent, and — where we use confirmed opt-in — the time you confirmed. Every marketing email carries an unsubscribe link.

We also keep a suppression list: addresses that have unsubscribed, bounced or complained. Its only purpose is to make sure we never email those addresses again.

• Legal basis: Article 6(1)(a) GDPR — your consent, which you can withdraw at any time. The suppression list runs on Article 6(1)(f) GDPR — our legitimate interest, and yours, in honouring your unsubscribe permanently. The suppression list is also how we comply with Article 21(3) GDPR.

Analytics and the website itself

Two measurement tools run on the site, both non-essential and both loaded only after you consent: Google Analytics 4, which counts visits and pages, and Microsoft Clarity, which records how a page is used — mouse movement, scrolling and clicks — so the session can be replayed anonymously. Clarity masks text content by default, so what you type into a form is not captured.

The site also loads Google Tag Manager (container GTM-W429C2MV). It is a container rather than a measurement tool, and it currently deploys no tag of its own; the two tools above are loaded directly by our own code. The container script is fetched on every page regardless of your choice, but it stores nothing and measures nothing until a tag is added to it, and any tag we add would be consent-gated and listed in the Cookies Policy, where each cookie and its lifetime is set out.

Your chosen colour theme is kept in your browser's local storage and never sent to us.

Our hosting provider processes technical request data (IP address, request URL, user agent, timestamp) in server logs in order to serve the site and defend it against attack. These logs are kept by the provider under its own retention schedule.

• Legal basis: Article 6(1)(a) GDPR — consent — for analytics and any other non-essential tag. Article 6(1)(f) GDPR — legitimate interest in a secure, working website — for server logs and essential technical processing.

If your enquiry becomes a project

An enquiry that we take forward is copied into our customer records, so that we can work on it: a company entry, a contact entry with your name, email, phone and role, and a deal entry that tracks the stage it has reached. Our own notes about the work are stored alongside it, and so is the reason if it does not go ahead.

If we send you a quote, it is published at a long unguessable web address that is emailed to you. Anyone holding that address can open the quote without signing in, which is deliberate, so that you can forward it to a colleague. It contains the quote itself and the contact details it is addressed to. Tell us and we will withdraw the link.

• Legal basis: Article 6(1)(b) GDPR — steps taken at your request before entering a contract, and performance of the contract itself. Article 6(1)(f) GDPR — our legitimate interest in keeping an accurate record of our own commercial work.

Who we share data with

We do not sell personal data. We share it only with the service providers we need to run the site, each acting as our processor under a written data processing agreement, and only for the purposes above.

If you sign in with Google or GitHub, that provider processes the sign-in as its own controller under its own privacy policy. We receive only the profile information described above.

We may also disclose data where we are legally required to — for example to a competent authority acting under Bulgarian or EU law — and to professional advisers bound by confidentiality.

International transfers

Our hosting and database are configured to keep data in the EU (Frankfurt). However, Vercel, Neon, Google and GitHub are US-headquartered companies whose support and infrastructure operations can reach data from outside the EEA.

Where a transfer outside the EEA happens, it is covered by the safeguards in Chapter V GDPR: the European Commission's Standard Contractual Clauses, and — where the provider is certified — the EU–US Data Privacy Framework. You can ask us at info@concreef.eu for information about the safeguards that apply to a specific provider.

How long we keep data

These are our current retention periods. Where a legal obligation requires us to keep something longer (for example accounting records for a contract that actually goes ahead), that obligation prevails.

Automated decision-making

We do not carry out automated decision-making that produces legal effects for you or similarly significantly affects you, and we do not profile you within the meaning of Article 22 GDPR. The automated checks we do run — the hidden spam field and the rate limit — only decide whether a single form submission is accepted, and you can always reach us directly at info@concreef.eu instead.

Your rights

Under the GDPR you have the right to:

• Access — get confirmation of whether we process your data and a copy of it.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have your data deleted where one of the grounds in Article 17 applies.
• Restriction — have processing limited while a dispute about accuracy or legitimate interest is resolved.
• Data portability — receive the data you gave us in a structured, commonly used, machine-readable format, where processing is based on consent or contract and carried out by automated means.
• Object — object at any time to processing based on our legitimate interest, and object absolutely to direct marketing.
• Withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal. For marketing email, the unsubscribe link at the foot of every message is the fastest way.
• Not be subject to automated decision-making — see the section above.

How to exercise them

Write to info@concreef.eu with a short description of what you want. We will answer within one month of receiving your request. If the request is complex we may extend that by up to two further months and will tell you why within the first month. We may ask you for information that lets us confirm the request is yours — usually by replying from the email address the data is held under. Exercising your rights is free; we may charge a reasonable fee only for manifestly unfounded or excessive requests.

If you have an account, you can update your details and delete the account yourself from your account settings.

Complaints

If you believe we have handled your data unlawfully, please tell us first — we would rather fix it. You also have the right to complain to a supervisory authority, in particular the Bulgarian data protection authority:

Комисия за защита на личните данни (Commission for Personal Data Protection) 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria kzld@cpdp.bg · www.cpdp.bg

You may also complain to the supervisory authority of the EU country where you live or work.

Is providing data required?

Providing data is voluntary. However, we cannot answer an enquiry without a name, an email address and a message, and we cannot create an account without an email address. Marketing consent is entirely optional and refusing it has no effect on your enquiry.

Security

Data is transmitted over HTTPS. Passwords are stored only as hashes. IP addresses used for rate limiting are stored only as salted SHA-256 hashes. Access to the database and to the info@concreef.eu mailbox is limited to the founders and protected by two-factor authentication. No system is perfectly secure, but we will notify you and the supervisory authority as required by Articles 33 and 34 GDPR if a breach puts your data at risk.

Children

The site is aimed at businesses and professionals. We do not knowingly collect data from children under 16. If you believe a child has given us personal data, contact info@concreef.eu and we will delete it.

Changes to this policy

We will update this page when our processing changes, and always when the company registration is complete. The date at the top of this page shows the current version. Material changes to processing based on consent will be notified to you and, where required, re-consented.

Contact

Questions about this policy or about your data: info@concreef.eu, Concreef, 95 Doctor G. M. Dimitrov Blvd., Studentski Kompleks, 1700 Sofia, Bulgaria.