How SerafinIT Ltd collects, uses, and protects your personal data — in compliance with the EU General Data Protection Regulation (GDPR).
The data controller responsible for your personal data is:
SerafinIT Ltd is the entity that determines the purposes and means of processing your personal data. For any privacy-related questions, contact us at info@serafinit.com.
We collect personal and company data in the following contexts:
When you contact us via email or the website, we collect:
When you use our NIS2 Compliance Engine, we collect:
When you purchase a report via our payment provider (Stripe), we collect:
Payment card details are processed exclusively by Stripe and are never stored by SerafinIT. Stripe's privacy policy applies to payment processing: stripe.com/privacy.
When you visit serafinit.com, standard server logs may record your IP address, browser type, pages visited, and visit timestamps. This data is used for security and service improvement purposes only.
| Purpose | Legal Basis (GDPR) |
|---|---|
| Responding to enquiries and providing advisory services | Art. 6(1)(b) — Performance of a contract or pre-contractual steps |
| Processing payments and issuing invoices | Art. 6(1)(b) — Performance of a contract; Art. 6(1)(c) — Legal obligation |
| NIS2 compliance assessment and report generation | Art. 6(1)(b) — Performance of a contract |
| Maintaining accounting and tax records | Art. 6(1)(c) — Legal obligation under Bulgarian and EU tax law |
| Website security and fraud prevention | Art. 6(1)(f) — Legitimate interests |
We use your personal data exclusively for the following purposes:
We do not use your data for automated decision-making that produces legal effects, and we do not engage in profiling for marketing purposes.
We do not sell your personal data. We share data only with the following categories of processors, under contractual data processing agreements:
All third-party processors are contractually bound to process your data only on our instructions and in accordance with GDPR.
Some of our service providers (including Stripe) are based outside the European Economic Area. Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, including:
| Data Type | Retention Period |
|---|---|
| Contact and enquiry data | 3 years from last contact, unless an ongoing relationship exists |
| Assessment data (answers, scores, reports) | 12 months from assessment date, unless you request earlier deletion |
| Payment records and invoices | 10 years, as required by Bulgarian accounting and tax law |
| Website server logs | 90 days |
As a data subject, you have the following rights:
To exercise any of these rights, contact us at info@serafinit.com. We will respond within 30 days.
Serafinit.com uses only technically necessary cookies required for the website to function. We do not use tracking cookies, advertising cookies, or third-party analytics cookies without your explicit consent.
If we introduce optional cookies in the future, we will update this policy and request your consent in accordance with GDPR.
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted communications (HTTPS), access controls, and regular security reviews.
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, inform affected individuals without undue delay.
We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or regulatory guidance. The current version will always be available at serafinit.com/privacy-policy.html. Material changes will be communicated directly to clients with active engagements.
For any questions about this Privacy Policy or how we handle your personal data: