We are committed to protecting your privacy and processing personal data lawfully, fairly and transparently. This Policy applies to all individuals who use our website or services. Last reviewed: 2025.
1Introduction
1.1 This Privacy Policy (the "Policy") sets out the manner in which Formant EOOD, trading under the brand name "Nuvia" (hereinafter the "Company", "we", "us" or "our") collects, uses, discloses, transfers and otherwise processes personal data relating to individuals (hereinafter "you", "your", "data subject") in the course of providing digital services (including website design, development, SEO, copywriting and e-commerce services) and managing our website, communications and business relationships.
1.2 We are committed to protecting the privacy and security of your personal data and to complying with applicable data protection laws including the General Data Protection Regulation ("GDPR"). We adopt principles of lawful, fair and transparent processing of personal data.
1.3 This Policy applies to (i) individuals who use our website; (ii) clients, prospects, contacts and vendor/partner individuals; and (iii) individuals whose personal information we otherwise collect or process in connection with our business operations, within the territories in which we operate (including the European Economic Area).
1.4 By contacting us, registering with us, using our services or otherwise providing your personal data, you acknowledge that you have read and understood this Policy and consent to the collection, use and disclosure of your personal data in accordance with this Policy.
2Data Controller and Contact Details
2.1 The data controller (i.e., the entity which determines purposes and means of processing your personal data) is Formant EOOD (brand: Nuvia).
2.2 Our registered address: Sofia, Slatina, bl. 254, vh. B, et. 5, Bulgaria.
2.3 If you have any questions, requests or complaints regarding this Policy or our processing of your personal data, please contact us at info@nuvia-solutions.com.
2.4 If you are located in the European Union or European Economic Area and you believe that we have processed your personal data in violation of applicable law, you also have the right to lodge a complaint with a supervisory authority in your country.
3Categories of Personal Data Collected
3.1 We may collect or receive, in various contexts, the following categories of personal data:
- Identity data (such as name, title, job title, organisation, contact details).
- Contact data (email address, telephone number, mailing address).
- Website usage data (including IP address, device information, browser type and version, referral URLs, page views, time and date of visits, cookie identifiers and other online identifiers).
- Transaction and billing data (such as company name, billing address, payment details, invoices).
- Marketing and communications data (such as your preferences for receiving marketing communications).
- Project-specific data (such as content provided by you, files/uploads, project specifications, images, text and materials you supply).
- Other data you voluntarily provide to us (for example in forms, emails, chats, or during service delivery).
3.2 We endeavour to collect only personal data that is necessary for legitimate purposes. We apply the principle of data minimisation.
3.3 We do not routinely collect "special category" personal data (such as race, ethnicity, political opinions, health data) unless you have expressly provided it and we have a lawful basis for processing it. If we do receive such data inadvertently, we will treat it with heightened security.
4Purposes of Processing & Legal Bases
4.1 We process your personal data only for lawful purposes and where we have a legal basis under applicable law. Such legal bases may include:
- Performance of a contract with you (or the entity you represent).
- Compliance with a legal obligation.
- Our legitimate interests (provided such interests are not overridden by your rights).
- Your consent (where required).
4.2 We process personal data for the following categories of purposes:
- To provide and manage our digital design, development, copywriting, SEO and e-commerce services.
- To respond to enquiries, proposals, pre-sales communications and support requests.
- To manage our client, partner and supplier relationships.
- To issue invoices, manage billing and payments.
- To send relevant marketing communications (subject to your consent where required).
- To administer and improve our website (including analytics and tracking).
- To ensure IT security, prevent fraud or abuse, and manage regulatory compliance.
- To comply with legal or regulatory obligations (e.g., tax, accounting, data protection law).
4.3 For each type of processing we will also document the legal basis in our internal records, and if we rely on "legitimate interests" as a basis, we ensure your rights are not overridden.
5Cookies, Tracking Technologies & Third-Party Tools
5.1 Our website uses cookies and similar technologies (e.g., web beacons, pixels, local storage) to collect and store information about your interactions.
5.2 When you visit our site, you will be presented with a cookie banner. You have the choice to accept or decline non-essential cookies. If you decline non-essential cookies, analytics and tracking will be disabled.
5.3 We may share certain usage data with our third-party service providers who help us operate the website and analyse traffic. These third parties process the data under strict contractual obligations and appropriate safeguards.
5.4 Further details regarding cookies and tracking technologies can be found in our Cookie Policy.
6Disclosure of Personal Data / Recipients
6.1 We may share your personal data with the following categories of recipients:
- Service providers and subcontractors (e.g., hosting providers, payment processors, analytics providers, email service providers) who assist us in delivering services and who process personal data on our behalf under data-processing agreements.
- Affiliates or business partners (where relevant and subject to contractual restrictions).
- Legal or regulatory authorities (where required by law, e.g., tax authorities, courts, law enforcement).
- Potential buyers or investors in the event of a sale or restructuring of our business (with confidentiality safeguards).
6.2 Whenever we transfer personal data to any third party, we ensure that they are bound by appropriate contractual obligations and provide at least the same level of protection as we apply.
6.3 In the event that personal data is transferred outside the European Economic Area (EEA) or to an international organisation, we will ensure that appropriate safeguards are in place (such as EU standard contractual clauses) unless an adequacy decision applies. We will always inform you if such transfers occur and we will provide details of the safeguards.
7Retention of Personal Data
7.1 We will retain personal data only as long as is necessary to fulfil the purposes for which it was collected (including any legal, accounting, tax or reporting requirements).
7.2 The criteria we use to determine retention periods include:
- The nature of the personal data and its sensitivity.
- The purposes for which we process the data.
- Our legal obligations (e.g., statutory retention periods).
- The existence of any applicable contractual obligations.
7.3 When personal data is no longer required, we will securely delete or anonymise it.
8Your Rights as a Data Subject
8.1 Under the GDPR, you have the following rights (subject to certain limitations or exemptions):
- Right of access: you may request a copy of your personal data that we hold.
- Right of rectification: you may ask us to correct inaccurate or incomplete data.
- Right of erasure ("right to be forgotten"): you may request deletion of your personal data where appropriate.
- Right to restriction of processing: you may ask us to suspend processing in certain circumstances.
- Right to object: you may object to our processing of your data on grounds relating to your particular situation.
- Right to data portability: in some cases, you may request your data in a structured, commonly used format and transfer it to another controller.
- Right to withdraw consent: if our processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of processing conducted prior to withdrawal.
8.2 To exercise any of these rights, please contact us at info@nuvia-solutions.com. We may request additional information from you to confirm your identity prior to fulfilling your request.
8.3 We will normally respond to your request within one month. That period may be extended by a further two months for complex requests, and we will inform you of such an extension.
8.4 If you are resident in the EU/EEA and believe that we are not handling your personal data lawfully, you have the right to lodge a complaint with your national data protection supervisory authority.
9Security of Personal Data
9.1 We take appropriate technical and organisational measures to safeguard your personal data from unauthorised access, disclosure, alteration or destruction. These measures evolve with changing technology and risk landscape.
9.2 We implement and maintain measures including but not limited to: encryption, access controls, secure backups, network monitoring, incident detection, and secure disposal of data no longer required.
9.3 However, while we endeavour to protect your data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.
10Minors and Children's Privacy
10.1 Our website and services are not directed at children under the age of sixteen (16) unless specifically stated. We do not knowingly collect personal data from children under the age of sixteen.
10.2 If you believe we have collected personal data from a child without proper consent, please contact us and we will promptly delete that data.
11Automated Decision-Making & Profiling
11.1 We currently do not engage in automated decision-making (including profiling) that produces legal or similarly significant effects on you.
11.2 If we do in future introduce such processing, we will notify you separately and explain your rights in relation to the processing.
12International Data Transfers
12.1 Because our business operates internationally, your personal data may be transferred to, stored in, or processed in countries outside the European Economic Area (EEA).
12.2 Whenever such transfers occur, we will only rely on appropriate safeguards (such as EU Standard Contractual Clauses) or ensure that the recipient country has been deemed adequate under EU law.
12.3 You may request details of the specific safeguards applied.
13Changes to this Policy
13.1 We may update this Policy from time to time (for example, due to changes in law or our business practices).
13.2 We will publish the revised Policy with an updated effective date. Where required under applicable law, we will seek to notify you of significant changes and obtain your consent if needed.
13.3 Your continued use of our website or services after such changes constitutes your acceptance of the revised Policy.
14Links to Other Websites
14.1 Our website may contain links to other websites operated by third parties. This Policy does not apply to those websites.
14.2 We encourage you to read the privacy notices posted on each of those websites as their data practices may differ from ours.
15Legal Basis for Processing – Additional Detail
15.1 Under the GDPR, processing personal data requires a lawful basis. The following are the key lawful bases we rely upon:
- Consent: you have given consent to the processing of your personal data for one or more specific purposes.
- Contract: processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract.
- Legal obligation: processing is necessary for compliance with a legal obligation to which the Company is subject.
- Legitimate interests: processing is necessary for the purposes of our legitimate interests (or those of a third party) except where such interests are overridden by your interests or fundamental rights and freedoms.
15.2 Where processing is based on our legitimate interests, we will notify you of such interests and ensure appropriate safeguards are in place so that your rights are not unduly impacted.
16Data Subject Rights – Additional Considerations
16.1 Right to Receive Information: When we collect personal data directly from you, at the time of collection we will inform you of the identity and contact details of the controller, the purposes for processing, the lawful basis, possible recipients, retention period or criteria, your rights as a data subject, and any other relevant information.
16.2 Right to Withdraw Consent: If we rely on consent for processing, you may withdraw that consent at any time. That withdrawal will not affect the lawfulness of any processing carried out prior to withdrawal.
16.3 Right to Object: You can object to our processing of your personal data for direct marketing, profiling, or processing based on legitimate interests. If you object, we must stop processing unless we can demonstrate compelling legitimate grounds.
16.4 Right to Restrict Processing: You can ask us to restrict processing of your data in certain circumstances, e.g., while we verify your objection or correct inaccurate data.
16.5 Right to Erasure: In circumstances where retention is no longer necessary or processing is unlawful, you may request erasure of personal data.
16.6 Right to Receive Personal Data: Where processing is based on consent or contract and uses automated means, you may request the data in a structured, commonly used format.
17Retention and Deletion – Additional Detail
17.1 Specific retention periods: While retention may vary by project, typical retention periods include:
- For marketing enquiries and lead records: up to 2 years after last contact.
- For client records and billing: up to 10 years (or longer as required by accounting/tax law).
- For website analytics and usage data: typically up to 24 months, unless you choose to anonymise earlier.
17.2 At the end of the retention period, personal data will be securely deleted or anonymised unless further retention is required by law.
18Security – Additional Safeguards
18.1 We implement security controls such as:
- Encryption in transit and at rest.
- Access control and authentication for systems storing personal data.
- Regular backups and disaster-recovery planning.
- Logging and monitoring of access and processing events.
- Training and awareness of staff regarding data protection.
18.2 Despite these safeguards, no system can guarantee absolute security. You acknowledge that risk remains and that we cannot warrant that malicious attacks, data loss, or corruption will never occur.
19Data Breach Notification
19.1 In the event of a personal data breach (i.e., a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data), we will assess the incident and, where required by law, notify the relevant supervisory authority without undue delay and, if feasible, within 72 hours.
19.2 Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly, providing details of the nature of the breach, potential consequences and measures taken or to be taken to mitigate harm.
20International & Cross-Border Transfers – Additional Detail
20.1 Because our infrastructure and partners may reside globally, personal data may be transferred to countries outside the EEA.
20.2 We ensure adequate protection for such transfers by using legal mechanisms such as EU Standard Contractual Clauses (SCCs), binding corporate rules or entering into agreements with processors that guarantee equivalent safeguards.
20.3 You may request a copy of the appropriate safeguards in place by contacting us at info@nuvia-solutions.com.
21Use of Personal Data for Marketing
21.1 If you have opted-in (or not opted-out where permitted) to receive marketing communications from us, we may contact you by email, telephone, SMS or other lawful means to promote services that we believe may be of interest to you.
21.2 You may withdraw your consent or opt-out of marketing messages at any time by following the unsubscribe instructions included in our communications or contacting us.
21.3 Even if you opt-out of marketing, we may still contact you with necessary service-related messages (e.g., changes to your account, invoice notifications) which do not require consent.
22Links to Third-Party Sites & Social Media
22.1 Our website may contain links to third-party websites and social media platforms. We do not control these external services and this Policy does not apply to them.
22.2 We recommend that you review the privacy policies of each external site you visit as their practices may differ from ours.
23Governing Law & Jurisdiction
23.1 This Policy and any processing of personal data by us shall be governed by and construed in accordance with the laws of the Republic of Bulgaria.
23.2 You agree that the courts of Bulgaria shall have exclusive jurisdiction in respect of any dispute arising from or connected with this Policy or the processing of your personal data by us.
24Definitions of Key Legal Principles
24.1 Lawful, fair and transparent processing: We process your personal data lawfully (we have a legal basis), fairly (we treat you reasonably) and transparently (we inform you about what we do).
24.2 Purpose limitation: We collect personal data for specified, explicit and legitimate purposes and will not further process it in a way incompatible with those purposes.
24.3 Data minimisation: We ensure that personal data we collect is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.
24.4 Accuracy: We endeavour to ensure personal data is accurate and current; you should inform us of any changes.
24.5 Storage limitation: Personal data will be kept in a form permitting identification of data subjects for no longer than necessary for the processing purposes.
24.6 Integrity and confidentiality: Personal data is processed in a manner that ensures appropriate security including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.
24.7 Accountability: We are responsible for and must be able to demonstrate compliance with the above principles.
25Commercial-Client Specific Processing
25.1 For Clients (businesses or individuals) engaging our Services, we may process additional data such as project folders, brand assets, website login credentials, sub-contractor information, communication records and feedback. These are processed under contract performance and legitimate interests (such as to maintain client relations, deliver and support services).
25.2 Unless otherwise agreed, we shall not act as "data processor" handling personal data on behalf of the Client for their customers; the Client remains responsible for ensuring compliance of their website or digital solution with data protection law, including obtaining necessary consents from end-users.
26Updating Your Personal Data
26.1 Where you have provided personal data directly (e.g., as a website user or client contact), you may notify us to correct, update or remove your data by contacting info@nuvia-solutions.com. We will handle your request in accordance with your rights (see Section 8).
27Consequences of Non-Provision of Data
27.1 If you choose not to provide required personal data when requested (for example, to enter into a contract or to pay for our Services), we may be unable to perform the requested Services, or may have to suspend or terminate the Project. In such event we will inform you accordingly where appropriate.
28Third-Party Processors and Sub-Processors
28.1 We may engage third-party processors (sub-contractors) to assist in data processing activities in connection with our Services. Prior to engagement, we undertake due diligence to ensure they provide adequate safeguards and we enter into written data-processing agreements with them.
28.2 Should we change processors we will ensure the new processor meets our standards of data protection and security.
29Audit, Compliance & Record-Keeping
29.1 We maintain records of processing activities in accordance with Article 30 of the GDPR and adopt internal policies to ensure ongoing compliance (including staff training, incident response, audits).
29.2 We monitor changes in relevant data-protection legislation, guidance from supervisory authorities and industry standards to ensure our practices remain compliant.
30Severability, Waiver and Entire Agreement
30.1 Should any provision of this Policy be found invalid or unenforceable under applicable law, such invalidity will not affect the remaining provisions.
30.2 No waiver of any right under this Policy shall be effective unless in writing and signed by an authorised representative of the Company.
30.3 This Policy, together with any referenced documents (such as our Cookie Policy), constitutes the entire agreement between you and the Company with respect to personal data.
31Contact, Queries and Amendments
31.1 Contact: info@nuvia-solutions.com
31.2 For any queries, complaints or requests relating to your personal data or this Policy, please email us at the above address. We aim to respond promptly and in any event within the time-frames required by applicable law.
31.3 We reserve the right to amend this Policy at any time. A notice of the effective date will be published on our website and where required we will seek your consent for material changes.
Thank you for reading our Privacy Policy. We value your trust and are committed to safeguarding your personal data.