PRIVACY POLICY

Expo Studio LTD

Website: https://www.expostudioltd.com
Last updated: 2 November 2026

1. Introduction

Expo Studio LTD ("we", "us", or "our") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you visit our website, www.expostudioltd.com, communicate with us or use our services.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Bulgarian data protection legislation.

By using our website, you acknowledge that you have read this Privacy Policy.

2. Data Controller

The company responsible for processing your personal data is:

Expo Studio LTD

Company Registration Number: 206790425
Registered address: Izgrev District, g.k. East, Blvd. G. M. Dimitrov No. 60, Bulgaria
Email: info@expostudioltd.com
Website: www.expostudioltd.com

For any questions regarding this Privacy Policy or the processing of your personal data, please contact us using the email address above.

3. Personal Data We Collect

Depending on how you interact with our website and services, we may collect the following categories of personal information:

Information you provide voluntarily:

Full name
Email address
Telephone number
Company name
Information included in contact forms or email correspondence
Project details, inquiries and other information you choose to share with us

Automatically collected information: When you visit our website, certain technical information may be collected automatically, including:

IP address
Browser type and version
Device and operating system information
Pages visited and time spent on the website
Referral sources
Date and time of website visits

Cookies and similar technologies:

We may use cookies and similar technologies to ensure the proper functioning of our website, understand website usage and improve the user experience. Further information is provided in Section 8.

4. How We Use Your Personal Data

We may process your personal information for the following purposes:

To respond to inquiries and requests.
To communicate with existing and potential clients.
To provide information about our services.
To prepare proposals, quotations and business offers.
To manage business relationships and contractual obligations.
To improve website functionality and user experience.
To maintain website security and prevent fraudulent or malicious activity.
To comply with applicable legal and regulatory requirements.
To send marketing communications where we have an appropriate legal basis.

We only process personal data for legitimate, specified and lawful purposes.

5. Legal Basis for Processing

Under Article 6 of the GDPR, we rely on one or more of the following legal bases:

Consent: Where you have explicitly agreed to the processing of your personal data, such as receiving marketing communications or accepting non-essential cookies.

Contractual necessity: Where processing is necessary to provide requested services, prepare a contract or fulfil contractual obligations.

Legitimate interests: Where processing is necessary for our legitimate business interests, provided that these interests do not override your fundamental rights and freedoms. Examples include responding to business inquiries, maintaining website security and improving our services.

Legal obligations: Where processing is necessary to comply with applicable laws, accounting requirements, tax obligations or other legal responsibilities.

6. Sharing Your Personal Data

We do not sell, rent or trade your personal information.

However, we may share personal data with trusted third parties when necessary for the operation of our business and website, including:

Website hosting and infrastructure providers.
IT support and website maintenance providers.
Email and communication service providers.
Analytics providers, where applicable.
Professional advisers, accountants and legal representatives.
Public authorities or regulatory bodies where legally required.

Third-party service providers are only permitted to process personal data in accordance with applicable data protection requirements and the relevant contractual arrangements.

7. International Data Transfers

Some of our service providers may process personal data outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we will ensure that appropriate safeguards are implemented in accordance with the GDPR.

These safeguards may include:

An adequacy decision issued by the European Commission.
Standard Contractual Clauses approved by the European Commission.
Other legally recognised transfer mechanisms.

8. Cookies and Tracking Technologies

Our website may use cookies and similar technologies.

Cookies are small text files stored on your device when you visit a website.

They may be used for the following purposes:

Strictly necessary cookies: Required for the proper functioning, security and basic operation of the website.

Analytics cookies: Used to understand how visitors interact with the website and help us improve its performance.

Functional cookies: Used to remember preferences and improve website functionality.

Marketing cookies: Used, where applicable, to measure advertising effectiveness or provide relevant advertising.

Where required by law, non-essential cookies will only be activated after you provide your consent.

You can manage your cookie preferences through the website's cookie settings, where available, or through your browser settings.

Please note that disabling certain cookies may affect website functionality.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected or to comply with legal obligations.

Our general retention approach is as follows:

General inquiries: Normally up to 12 months after the last communication, unless further retention is necessary.
Client and contractual information: For the duration of the business relationship and any additional period required by applicable law.
Accounting and financial records: For the legally required retention period.
Marketing information: Until you withdraw your consent or object to the relevant processing, as applicable.
Technical and website data: For the period necessary for security, operational and analytical purposes.

When personal data is no longer required, it will be securely deleted or anonymised.

10. Your Rights Under GDPR

Under applicable data protection legislation, you have the following rights:

Right of access: You can request confirmation of whether we process your personal data and obtain a copy.

Right to rectification: You can request correction of inaccurate or incomplete personal information.

Right to erasure: You can request deletion of your personal data where the legal requirements are met.

Right to restriction: You can request that we restrict the processing of your personal information in certain circumstances.

Right to data portability: You can request your personal data in a structured, commonly used and machine-readable format, where applicable.

Right to object: You can object to certain types of processing, including processing based on legitimate interests and direct marketing.

Right to withdraw consent: Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Right to lodge a complaint: You have the right to submit a complaint to the relevant data protection supervisory authority.

To exercise any of these rights, please contact us at:

**info@expostudioltd.com**

We will respond to your request in accordance with the applicable GDPR deadlines.

11. Data Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures may include access controls, secure hosting environments, encryption where appropriate, and regular security monitoring.

However, no method of internet transmission or electronic storage is completely secure. Therefore, we cannot guarantee absolute security.

12. Third-Party Websites

Our website may contain links to third-party websites, platforms or services.

We are not responsible for the privacy practices, content or security of external websites.

We recommend reviewing the privacy policies of any third-party websites you visit.

13. Children's Privacy

Our website and services are not intentionally directed at children.

We do not knowingly collect personal information from children without the appropriate legal authorisation.

If we become aware that personal data has been collected from a child in circumstances where such collection is unlawful, we will take appropriate steps to delete that information.

14. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy from time to time to reflect changes in our business operations, website functionality or applicable legislation.

Any updates will be published on this page, together with the revised "Last updated" date.

We encourage visitors to review this page periodically.

15. Contact Information

If you have any questions, concerns or requests relating to this Privacy Policy or the processing of your personal data, please contact us:

Expo Studio LTD

Company Registration Number: 206790425

Address: Izgrev District, g.k. East, Blvd. G. M. Dimitrov No. 60, Bulgaria

Email: info@expostudioltd.com

Website: https://www.expostudioltd.com