Privacy Policy

Last updated · 2026-06-06

This Privacy Policy explains how XPAND ("we", "us") collects, uses, and protects personal data when you visit xpand.bg or interact with our services. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Bulgarian Personal Data Protection Act.

1. Data controller

XPAND is the controller of personal data collected through this website. You can reach us at [email protected] or at our address in Varna, Bulgaria.

2. What we collect

  • Contact form: name, email, company, message.
  • Job application form: name, email, phone, CV/portfolio, cover note.
  • Analytics & marketing data: IP, device, browser, pages visited, referrer, ad interactions — only with your consent.
  • Server logs: technical data needed to keep the site running and secure.

3. Why we use it

  • To respond to your enquiries (legal basis: pre-contractual / legitimate interest).
  • To process job applications (legal basis: pre-contractual / consent).
  • To measure traffic and ad performance (legal basis: your consent — see Cookie Policy).
  • To meet legal, accounting, and security obligations.

4. Who we share it with

We share data only with processors who help us run the site and our business: Sanity (content), Resend (email delivery), Google (Analytics, Ads), Meta (Pixel), and our hosting provider. These processors act on our instructions and under data-processing agreements. Some are based outside the EEA; we rely on the EU Standard Contractual Clauses for those transfers.

5. How long we keep it

Contact and application data is kept for as long as needed to handle your request and for a reasonable period afterwards (typically up to 24 months). Analytics and ad data follows the retention set in Google Analytics and Meta. You can ask us to delete your data at any time.

6. Your rights

Under GDPR you have the right to access, correct, delete, restrict, port, and object to processing of your personal data. You can also withdraw consent at any time. To exercise these rights, email [email protected]. You also have the right to complain to the Bulgarian Commission for Personal Data Protection (CPDP) at cpdp.bg.

7. Changes

We may update this policy. The "Last updated" date at the top reflects the most recent change.