Privacy Policy

Last updated: September 2026. Applies to harnesscode.com, to anything you submit through it, and to the personal data we handle in the ordinary course of doing business with you.

1. Who we are

The data controller is HARNESS CODE LTD (ХАРНЕС КОД ООД), a company registered in Bulgaria.

ЕИК (company number) 204135467
VAT BG204135467
Registered seat: 12 Dospat Street, floor 1, apt. 1, 1606 Sofia, Bulgaria
Correspondence address: Prof. Aleksandar Tanev St. 11, fl. 2, Mladost 4, Sofia 1715, Bulgaria
info@harnesscode.com, +359 2 411 00 69, Mon to Fri, 09:00 to 18:00 EET

We process personal data in line with Regulation (EU) 2016/679 (the General Data Protection Regulation, in force since 25 May 2018) and the Bulgarian Personal Data Protection Act.

We act in two different roles, and which one applies changes what you can ask of us:

• As a controller, for the personal data of our own customers, suppliers and contacts. Here we decide why and how the data is used, and this policy describes that.
• As a processor, for personal data a counterparty hands us so we can carry out a contract with them. Here we follow that company's instructions, and their privacy notice governs the data, not ours. If you reach us about data in this category, we will tell you who the controller is so you can go to the right place.

2. Who this policy is for

It applies to you whether you are a customer, a potential customer, a supplier or other counterparty, a named contact or representative of a company we deal with, or simply a visitor to this website. The purpose and the lawful basis change from case to case. The care does not.

3. What we collect, and where it comes from

Not all of it comes from you directly, so it is worth being plain about the three routes.

What you send us

Whatever you choose to put in the quote request and contact forms, or in an email or a phone call: your name, company, country, email address, phone number, the part numbers you ask about, and any message you write.

What we receive from the company you work for

When we do business with a company, that company gives us the details of the people we need to deal with. If you are named as a contact on an order, a delivery or an invoice, we will hold your name, your role, and your work contact details without having collected them from you.

What is already public

We sometimes use information from official public registers and comparable published sources, for example to confirm that a company and its representatives are who they say they are.

The categories in practice

• Identification: name, and where we are contracting with you as an individual rather than with a company, the address and identity document details the law requires us to record.
• Contact: phone number, email address, postal address, job title, and the equivalent details of contacts connected to you.
• Commercial: your enquiries, quotes, orders, delivery and payment records, and the correspondence around them.
• Website use: see the Cookie Policy, which sets out exactly which analytics are used and what they store.

We do not ask for special categories of data (health, beliefs, biometrics and the like), and we have no need for them. We do not profile you, and no decision that affects you is made about you by automated means.

4. Why we use it, and on what lawful basis

• To answer your enquiry and prepare a quote. Basis: steps taken at your request before entering a contract, and our legitimate interest in responding to the person who contacted us.
• To perform a contract. Drawing up an agreement at your request, and carrying out orders, deliveries and payments, whether the contract is with you or with the company you work for. Basis: performance of a contract, and our legitimate interest in performing contracts with corporate customers.
• To meet obligations the law puts on us. Issuing and keeping invoices and accounting records under Bulgarian accounting and VAT legislation, and reporting to the National Revenue Agency and other state and supervisory bodies where they are entitled to ask. Basis: compliance with a legal obligation.
• To establish, exercise or defend legal claims. Settling disputes, instructing lawyers, and dealing with court proceedings. Basis: our legitimate interest in defending our rights, and compliance with a legal obligation where a court requires it.
• To understand how this website is used. Basis: your consent, which you give or refuse in the cookie banner and can withdraw at any time.

5. How long we keep it

We keep personal data for as long as the purpose we collected it for still exists, and no longer. When the purpose falls away, the data goes.

• Accounting and tax records are kept for the statutory retention period. For records of this kind that is commonly ten years, counted from the end of the relationship or the reporting period they belong to. This is a period the law sets, not one we choose.
• Contract and order records are kept for as long as the contract runs and then for as long as a claim arising from it can still be brought.
• An enquiry that does not lead to an order is kept while it is still useful to a possible future order, and then deleted. The exact period for this category is one of the items being confirmed with our legal counsel, and we would rather say so than print a number we do not yet apply.

A period may run longer where we need the data to exercise or defend a legal right, and shorter where no statutory period applies at all.

6. Who we share it with

We do not sell your data, and we do not trade it. It is seen by:

• Our own staff, and only those who need it to do their job.
• Service providers who process data on our behalf, under a written contract that binds them to our instructions and to that purpose alone. These are the categories of provider that run the website, our email, and our analytics. The analytics tools are named in the Cookie Policy.
• Professional advisers and partners in the ordinary course of trade, such as accountants, auditors, lawyers, and the carriers who deliver your order, where a delivery or a claim cannot be completed without them.
• State and supervisory authorities, where the law requires us to report or to disclose.

7. Transfers outside the European Economic Area

Where a recipient sits outside the EEA, we transfer personal data only where an adequate level of protection is in place under European and Bulgarian law, or on the basis of your explicit and freely given consent. In either case we limit what is made available to the minimum the purpose needs.

We are confirming, and will name here, the specific providers involved and the transfer mechanism each one relies on.

8. How we protect it

We apply organisational and technical measures appropriate to the risk: access limited to the people whose work requires it, accounts that belong to named individuals rather than shared logins, and this website served over an encrypted connection throughout.

9. Your rights

Under the GDPR you have the following rights over your personal data. They are free to exercise.

• Access. Ask what we hold about you, why we process it, who receives it, and where we got it from if it did not come from you.
• Rectification. Have data that is wrong or incomplete corrected.
• Erasure. Have your data deleted where we have no remaining lawful ground to keep it.
• Restriction. Have us hold the data but stop using it while something is in dispute.
• Portability. Receive the data you gave us in a structured, commonly used, machine readable format, and have it sent to another controller.
• Objection. Object to processing we base on our legitimate interest. If your objection concerns direct marketing, we stop, unconditionally and without weighing anything against it.
• Withdrawal of consent. Withdraw consent at any time where consent is the basis we rely on, including for analytics cookies. Withdrawing does not affect what was lawful before you withdrew.

How to exercise them

Email info@harnesscode.com and describe what you want in enough detail for us to act on it. We answer within one month, and if a request is complex enough to need longer we will tell you inside that month and explain why.

We may ask you to confirm your identity before we hand over personal data or delete it, because the alternative is handing your data to someone impersonating you. We ask for the least that will settle the question.

Where we hold your data because a third party gave it to us, your employer for instance, and that party processes it for its own purposes too, a complaint about what they did with it goes to them directly.

Exercising these rights does not override our obligation to give personal data to the competent authorities for the prevention, investigation and detection of criminal offences.

Complaining to the supervisory authority

If our answer does not satisfy you, you can complain to Bulgaria's supervisory authority, the Commission for Personal Data Protection (Комисия за защита на личните данни, КЗЛД).

2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
kzld@cpdp.bg
www.cpdp.bg

You may also complain to the supervisory authority in the EU country where you live or work.

10. Cookies and analytics

Cookies, what the analytics measure, and how to give or withdraw consent are covered in full in the Cookie Policy. In short: the analytics for this site have been chosen but are not installed yet, so no analytics cookie is set at present, and when they are installed the one tool among them that uses cookies will load only if you accept.

11. Changes to this policy

We may update this policy. The current version is always the one published here at harnesscode.com, and we will say so on the website if a change is significant.

12. Questions

For anything about this policy, or about data we hold on you, email info@harnesscode.com or call +359 2 411 00 69.

Every inquiry answered by a person. Not a bot.

---

Harness Code Ltd, ЕИК 204135467, VAT BG204135467. Prof. Aleksandar Tanev St. 11, fl. 2, Mladost 4, Sofia 1715, Bulgaria. info@harnesscode.com. Mon to Fri, 09:00 to 18:00 EET.