1. Who is responsible for your data
GridBit is a spin-off of ADD Bulgaria Ltd. The controller of your personal data within the meaning of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") is:
ADD Bulgaria Ltd., 141V Vassil Aprilov Blvd., 4027 Plovdiv, Bulgaria. Email: sales@gridbit.tech. Phone: +359 32 623 001.
In this policy "we" and "us" mean ADD Bulgaria Ltd., and "website" means www.gridbit.tech in all its language versions. For any question about this policy or about your personal data, write to us at the address above.
2. In short
- We process only the data that is needed to show you the website and to answer the requests you send us.
- With your consent the website uses Google Analytics and Microsoft Clarity to see how it is used. You choose in the cookie banner and can change your choice at any time.
- The contact form sends your request by email to our office. The website itself does not store it.
- The chat with the AI assistant answers questions about our products. It sends nothing before you write and stores data in your browser only after you open it.
- We do not sell or rent personal data.
- You can ask at any time which data we hold about you, have it corrected or erased, and object to its use.
3. Visiting the website
When you open the website, your browser automatically sends the technical data that is needed to deliver the pages: your IP address, the date and time of the request, the requested address, the referring address, the type and version of your browser and operating system, and the country derived from the IP address.
Our hosting provider Cloudflare processes this data on our behalf to deliver the pages, to protect the website against attacks and misuse, and to keep technical logs that we use to find and fix errors.
- Purpose
- Delivery of the website, security, error analysis.
- Legal basis
- Art. 6(1)(f) GDPR: our legitimate interest in a secure and reliable website.
- Retention
- Technical logs are deleted automatically after no more than 7 days, unless they are needed to investigate a specific security incident.
4. Contact and quote requests
When you send a request through the form on the website, we process the data you enter: name, company, email address, phone number (optional), the product you ask about (optional) and your message. The form also sends the language of the page and the address of the page from which you sent it, so that we can answer in your language and know what the request is about.
The website does not store the request. It forwards it as an email to sales@gridbit.tech through the email sending service Resend. We answer from there by email and, where needed, by phone. The same applies when you write to us or call us directly.
Name, email address and message are required: without them we cannot answer. All other fields are voluntary.
- Purpose
- Answering your request, preparing an offer and the related correspondence.
- Legal basis
- Art. 6(1)(b) GDPR: steps taken at your request before a contract is concluded. Where you write on behalf of a company, also Art. 6(1)(f) GDPR: our legitimate interest in answering business enquiries and in communicating with representatives of our clients and prospective clients.
- Retention
- As long as needed to answer the request and to follow it up. If no contract follows, we delete the request and the correspondence no later than 24 months after our last contact. If a contract follows, we keep the correspondence that relates to it for the term of the contract and for the periods required by law, in particular by accounting and tax law.
By ticking the box in the form you confirm that you want us to store your request in order to answer it.
5. Chat with the AI assistant
The website has a chat with an AI assistant. It answers questions about our solutions and modules from the content of this website and passes requests for a meeting or a call back to our team. To show you what it talks about, it can open another page of this website or scroll the page you are on. The assistant is a computer program, not a person, and the chat says so in its first message. Its answers can contain errors: technical data, offers and dates are binding only when our team confirms them.
Nothing is sent before you write. When you send a message, we process the messages you write and the replies of the assistant, the address and title of the page from which you write, with the names of its sections and links, the time of each message, and the IP address and browser type that the chat service needs to deliver and protect the chat. The service also writes a short summary of the conversation. If you ask for a meeting or for us to contact you, we also process the data you enter in the chat or in its contact form: name, email address, phone number (optional), company and your message, for example the time that suits you.
From the IP address, the platform determines the approximate location (country, region and city) and the network (the internet provider or the company that owns the address), with a database kept on its own servers. From the technical data of your browser, it determines the type of device, the operating system, the browser and the languages set in the browser. Our team sees this next to the conversation, so that it can tell visitors apart and answer each request. The full IP address is kept for 30 days and then shortened.
If you have allowed statistics cookies, the chat also keeps a random visitor ID in your browser, so that our team can see when a conversation comes from the same visitor as an earlier one. With the conversation, it then also sends the source of your visit (the referring website, the campaign parameters in the address and the first page of the visit), your time zone and the size of your screen. If you withdraw this consent under "Cookie settings", the chat deletes the ID from your browser and no longer sends these details.
The chat runs on the Opairator platform of Deploee Ltd., Bulgaria, which processes the data on our behalf (Art. 28 GDPR). The platform runs on servers of Hetzner Online GmbH in Helsinki, Finland. To write the replies, it sends the conversation to the Gemini language model of Google LLC, USA. A request for contact reaches our team as an email sent through Resend. A meeting that you book is entered in our Microsoft 365 calendar with your name, company, email address and phone number.
- Purpose
- Answering your questions about our solutions and hardware; arranging the meetings and contacts you ask for; telling visitors apart and protecting the chat.
- Legal basis
- Art. 6(1)(f) GDPR: our legitimate interest in answering the questions of visitors about our products. For a meeting or contact that you ask for, also Art. 6(1)(b) GDPR: steps taken at your request before a contract is concluded. For the visitor ID and the source of the visit: Art. 6(1)(a) GDPR, your consent.
- Retention
- The platform deletes the messages, the summary, your contact details in the chat and the location and device data 12 months after the conversation, and shortens the IP address after 30 days. Requests that reach our mailbox and meetings in our calendar are kept as described under Contact and quote requests.
Please do not write sensitive data in the chat, such as health data or bank details.
The chat stores data in your browser only after you open it, and only for the open tab; with your consent to statistics cookies, it also keeps the visitor ID: see the table under Cookies and similar technologies. It sets no cookies. The chat window is masked in Microsoft Clarity, so its content does not reach Microsoft.
6. Videos from YouTube
Some pages offer a video from YouTube. Nothing from YouTube loads together with the page. Only when you click to play the video does the player load from youtube-nocookie.com, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. From that moment Google receives your IP address and technical data about your browser and may store information on your device. Google processes this data under its own responsibility and according to its privacy policy.
- Legal basis
- Art. 6(1)(a) GDPR: your consent, which you give by starting the video. If you do not start a video, no data goes to Google.
Links to YouTube open youtube.com, a separate website with its own privacy policy.
7. Statistics and marketing with Google Analytics
The website uses Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It shows us how visitors find and use the website, so that we can improve it and see how many requests it brings.
Google Analytics records the pages you open and how you reached them (the referring address, a search engine or a campaign), the time on each page and how far you scroll, clicks on links, buttons, videos, images, filters and answers, the values you set in the savings calculator, whether a request was sent through the contact form (never your name, email address, phone number or message), the type of device, the operating system, the browser, the screen size and language, and the approximate location (country and city) that Google derives from your IP address. According to Google, Google Analytics 4 does not store IP addresses.
In the cookie banner you decide separately on two things. Statistics: Google Analytics sets its cookies and recognises your browser on later pages and visits. Marketing: in addition, Google Signals adds age, gender and interest categories from signed-in Google accounts and links visits from several devices. We only see aggregated reports and cannot identify you in them.
Before you decide, and if you refuse, the Google tag still loads and sends Google signals without cookies (Google Consent Mode). They contain the page, the time, the consent status and technical data of the browser, but no identifier that recognises you on the next page or visit. Google uses them to estimate the number of visits of visitors who did not consent.
- Purpose
- Statistics about the use of the website; with marketing consent also reports on the age, gender and interests of visitors and on visits across devices.
- Legal basis
- Art. 6(1)(a) GDPR: your consent for the cookies and the full measurement. For the signals without cookies before or without consent: Art. 6(1)(f) GDPR, our legitimate interest in counting the visits of the website in aggregated form.
- Retention
- Google Analytics deletes the data linked to cookies after 14 months. Your choice stays in your browser for 12 months; after that the banner asks again.
You can change or withdraw your consent at any time under at the bottom of every page. When you withdraw it, the website deletes the Google Analytics cookies from your browser. Google also offers a browser add-on that blocks Google Analytics on all websites.
8. Session recordings and heatmaps with Microsoft Clarity
The website also uses Microsoft Clarity, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity shows us how visitors move through the pages, as heatmaps of clicks and scrolling and as recordings of single visits, so that we can find and fix what is hard to use.
Clarity records the page as your browser shows it, mouse movements, clicks, taps and scrolling, the pages you open, the type of device, the operating system, the browser, the screen size and the approximate location (country) that Microsoft derives from your IP address. Clarity masks the content of input fields and drop-down lists in your browser, so it never reaches Microsoft; the website masks the whole contact form in addition. Clarity also receives the names of the events described above, for example that a request was sent, without their content.
With consent for statistics Clarity sets its cookies and joins the pages of a visit, and later visits, into one recording. Before you decide, and if you refuse, Clarity sets no cookies and records every page as a separate visit, without an identifier that recognises you on the next page. With consent for marketing Microsoft may also use its own cookies on Microsoft domains, which it uses for advertising as well.
Microsoft processes the data collected with Clarity as an independent controller under its privacy statement. It stores the data in its Azure cloud and may transfer it to Microsoft Corporation in the United States.
- Purpose
- Finding out how the pages are used and where visitors have difficulties, so that we can improve the website.
- Legal basis
- Art. 6(1)(a) GDPR: your consent for the cookies and for recordings that span several pages and visits. For recordings of single pages without cookies before or without consent: Art. 6(1)(f) GDPR, our legitimate interest in a website that works and is easy to use.
- Retention
- Microsoft deletes recordings after 30 days, and heatmaps, click data and the recordings we mark after 9 months.
You can change or withdraw your consent at any time under . When you withdraw it, Clarity deletes its cookies on this website and goes on without them. Cookies that Microsoft has set on its own domains (see the table below) can only be deleted in your browser settings.
10. Who receives your data
Only our employees who handle enquiries and projects have access to your requests. We use the following service providers, who process data on our behalf under a data processing agreement (Art. 28 GDPR):
| Provider | Service | Based in |
|---|---|---|
| Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA | Hosting and delivery of the website, protection against attacks, technical logs | USA |
| Resend, Inc., USA | Sending the contact form to our office as an email | USA |
| Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland | Email service (Microsoft 365) of our mailbox sales@gridbit.tech | Ireland (EU) |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Google Analytics: statistics about the use of the website; with marketing consent Google Signals | Ireland (EU); Google LLC, USA, as a sub-processor |
| Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland | Microsoft Clarity: session recordings and heatmaps, as an independent controller (see above) | Ireland (EU); Microsoft Corporation, USA |
| Deploee Ltd., Bulgaria | Opairator platform for the chat with the AI assistant, with Hetzner Online GmbH (servers in Helsinki, Finland), Google LLC (Gemini language model) and Resend, Inc. (email) as sub-processors | Bulgaria (EU); servers in Finland (EU); Google LLC and Resend, Inc., USA |
For Google Signals, Google uses data from signed-in Google accounts under its own responsibility. We disclose data to authorities, courts or other public bodies only where the law obliges us to do so. We do not sell or rent personal data.
11. Transfers outside the European Union
Cloudflare, Resend, Google LLC (for Google Analytics and for the language model of the chat) and Microsoft Corporation (for Microsoft Clarity) are based in the United States, so your data may be processed outside the European Economic Area. Such transfers take place only with appropriate safeguards: on the basis of the adequacy decision of the European Commission of 10 July 2023 on the EU-U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on the basis of the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR). You can ask us for a copy of these safeguards.
12. Your rights
Under the GDPR you have the right to:
- obtain confirmation whether we process data about you and a copy of it (Art. 15);
- have inaccurate data corrected and incomplete data completed (Art. 16);
- have your data erased (Art. 17);
- have the processing restricted (Art. 18);
- receive the data you gave us in a structured, commonly used and machine-readable format, or have it transmitted to another controller (Art. 20);
- object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21);
- withdraw a consent at any time, without affecting the lawfulness of the processing before the withdrawal (Art. 7(3)).
You can withdraw your consent to cookies and statistics at any time under .
To exercise these rights, write to sales@gridbit.tech. We answer within one month; for complex or numerous requests this period can be extended by two further months, and we will tell you why. We may ask you to confirm your identity before we disclose any data.
You also have the right to lodge a complaint with a supervisory authority. In Bulgaria this is the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg. You may also turn to the supervisory authority of the EU member state where you live or work.
13. No automated decisions
We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The AI assistant in the chat only answers questions and passes your requests to our team; it takes no decisions about you.
14. Security
All connections to the website are encrypted (HTTPS). The contact form is not stored on the website. Access to requests is limited to the employees who need them for their work, and our service providers are bound by contract to protect the data. No transmission over the internet is completely secure, so please do not send us sensitive data, such as health data, through the form.
15. Children
The website is aimed at businesses and public bodies, not at children. We do not knowingly process personal data of persons under 16.
16. Changes to this policy
We update this policy when the website, our services or the law change. The date of the last update is shown at the top of the page. We announce material changes on the website.
17. Language versions
This policy is available in Bulgarian, English, Turkish and German. If the versions differ, the Bulgarian version prevails.
Questions about your data?
Write to sales@gridbit.tech or call +359 32 623 001.