Privacy
Policy Home / Privacy Policy

Last updated: September 2026

1. General

This Privacy Policy explains how Grinfeld Group collects, uses, stores and protects personal data through the website grinfeldgroup.com.

Grinfeld Group respects your privacy and is committed to processing personal data in accordance with applicable data protection legislation, including Regulation (EU) 2016/679 (GDPR) and applicable Bulgarian legislation.

This Privacy Policy applies to personal data that may be provided through the website, including through contact forms, email communications or other means of communication.

2. Data Controller

Personal data collected through this website is processed by Grinfeld Group as the data controller.

For questions regarding the processing of your personal data or to exercise your rights, you may contact us using the contact details available on the website.

3. Personal Data We May Collect

Depending on how you use the website and the information you voluntarily provide, we may process:

  • name and surname;
  • email address;
  • telephone number;
  • information contained in messages you submit;
  • professional or business information where provided;
  • technical information relating to your use of the website;
  • IP address and other information that may be collected automatically when visiting the website.

Please do not provide personal information through our contact forms that is not necessary for processing your enquiry.

4. How We Collect Personal Data

Personal data may be collected:

  • when you complete a contact form;
  • when you contact us by email;
  • when you voluntarily provide information as part of a business communication;
  • automatically when you visit or use the website, where applicable.

Personal data should only be collected to the extent necessary for a specific and legitimate purpose, in accordance with the principles of data minimisation and purpose limitation.

5. How We Use Personal Data

Personal data may be processed for the following purposes:

  • responding to enquiries and messages;
  • communicating with you;
  • providing information about our services and activities;
  • establishing and maintaining business relationships;
  • processing requests and other communications relating to the activities of Grinfeld Group;
  • improving the functionality, security and content of the website;
  • complying with legal obligations;
  • protecting the legitimate rights and interests of Grinfeld Group.

6. Legal Basis for Processing

Depending on the circumstances, personal data may be processed on the basis of:

  • your consent;
  • taking steps at your request;
  • the performance of a contract or taking steps prior to entering into a contract;
  • compliance with a legal obligation;
  • the legitimate interests of Grinfeld Group, where those interests are not overridden by your rights and freedoms.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

7. Data Retention

Personal data is retained for as long as necessary to fulfil the purpose for which it was collected, unless a longer retention period is required or permitted by law.

Once the applicable retention period has expired, personal data will be deleted, destroyed or anonymised where technically and organisationally possible.

8. Sharing Personal Data with Third Parties

Grinfeld Group does not sell personal data.

Depending on the circumstances, personal data may be shared with service providers that support the operation of the website and our business activities, such as hosting providers, technical support providers, email providers or other IT service providers.

Such providers may process personal data only to the extent necessary to provide the relevant service and subject to appropriate safeguards.

Personal data may also be disclosed where required by law or where necessary to protect the legitimate rights and interests of Grinfeld Group.

9. International Data Transfers

Depending on the technical services and third-party providers used, personal data may be processed by service providers located outside the European Economic Area.

Where applicable, such transfers will be carried out in accordance with the requirements of the GDPR and subject to appropriate legal safeguards.

10. Cookies

The website may use cookies and similar technologies to ensure its proper operation, remember certain preferences, analyse website usage and improve the user experience.

Where consent is required for certain types of cookies, they will be activated in accordance with applicable requirements and your choices.

Further information about the cookies used by the website may be provided through the website’s cookie management mechanism.

11. Data Security

Grinfeld Group implements appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, destruction, alteration or unlawful disclosure.

However, no method of transmitting or storing information over the Internet can guarantee absolute security.

12. Your Rights

Subject to applicable legal conditions, you have the right to:

  • receive information about the processing of your personal data;
  • request access to your personal data;
  • request correction of inaccurate or incomplete data;
  • request deletion of your personal data;
  • request restriction of processing;
  • object to certain types of processing;
  • request data portability where applicable;
  • withdraw consent where processing is based on consent;
  • not be subject to certain decisions based solely on automated processing where the applicable conditions are met.

These rights are not absolute and may be subject to limitations provided by law.

13. Exercising Your Rights

To exercise your rights or obtain information about the processing of your personal data, you may contact Grinfeld Group using the contact details provided on the website.

Where necessary, we may request information to verify your identity in order to prevent unauthorised access to personal data.

Requests from data subjects will generally be handled without undue delay and within one month, subject to the conditions set out in the GDPR.

14. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes applicable data protection legislation, you have the right to lodge a complaint with the competent data protection supervisory authority.

In Bulgaria, this is:

Commission for Personal Data Protection (CPDP)

Official website: cpdp.bg

15. External Links

The website may contain links to websites and online resources operated by third parties.

Grinfeld Group is not responsible for the content, privacy policies or practices of such external websites. We recommend that you review their privacy policies before providing them with personal information.

16. Changes to This Privacy Policy

Grinfeld Group may periodically update this Privacy Policy to reflect changes in legislation, technology or the way the website operates.

The latest version will always be published on this website.