Privacy Policy

1. Who we are

Flexy is a product of Control Net Ltd, a company registered in the Republic of Bulgaria. For the purposes of the General Data Protection Regulation (GDPR), Control Net Ltd is the controller of the personal data described in this policy.

For data-protection questions or to exercise your rights, email [email protected].

2. What this policy covers

This policy covers this website and the requests you send us through the contact or demo form.

Once Flexy launches as a product, the data your business manages inside the system (orders, customers, staff, and so on) is governed by a separate data processing agreement. There, your business is the controller and we act as a processor on your instructions.

3. What we collect and why

We collect only the data we need for a specific purpose:

• Demo or enquiry requests: name, email, phone, town/city, venue type, and — optionally — company name, number of sites, business size, current system, fiscal-printer brand, and your message. The purpose is to respond, prepare a demo, and get in touch with you.
• Marketing (only with your consent): if you tick the relevant box, we may occasionally send product news and tips. You can unsubscribe at any time.
• Anonymous analytics: aggregate, cookieless usage statistics (pages viewed, approximate region, device type) via our own analytics tool, self-hosted in the EU. No cross-site tracking and no advertising profiles. This runs at all times because it sets no cookies and stores no personal data.
• Google Analytics (only with your consent): if you accept analytics cookies, we load Google Analytics 4, which sets cookies and processes your IP address to measure visits. Without your consent, Google Analytics is never loaded at all. You can withdraw consent at any time — see section 5.
• Bot protection: when you submit the form, a security check runs to limit spam and automated abuse.

4. Legal bases

• Responding to your enquiry and taking steps at your request before a contract — pre-contractual steps and our legitimate interest (Art. 6(1)(b) and (f) GDPR).
• Marketing emails — your consent (Art. 6(1)(a)), which you can withdraw at any time.
• Our own cookieless analytics and security — our legitimate interest in running and protecting the site (Art. 6(1)(f)).
• Google Analytics — your consent (Art. 6(1)(a)), given through the cookie bar and withdrawable at any time.

5. Cookies and tracking

We don't use advertising cookies and we don't track you across sites for advertising. Fonts are served from our own server, so your visit isn't shared with third-party font providers.

Our own analytics is cookieless and always on. In addition we use Google Analytics 4, but only after your explicit consent: on your first visit we show a consent bar, and until you press "Accept" no Google cookies are written and no data is sent to Google. We use Google's consent mode, with the advertising signals permanently switched off because we do not run ads.

Withdrawing consent: your choice is stored locally in your browser. To change it, clear this site's data in your browser settings (or use a private window) — the bar will reappear and you can decline. Declining does not limit your use of the site in any way.

6. Who we share data with

We don't sell your data. We rely on a small number of trusted providers that act on our instructions and process data only to deliver their service:

• An email-delivery provider that relays your submitted form to us (in the EU).
• A bot-protection provider that runs the security check when you submit the form.
• An EU hosting provider where the site is hosted.
• Google Ireland Limited — only if you accepted analytics cookies. Google processes your visit data (including your IP address, which is truncated) as our processor for Google Analytics 4. Without your consent, no data is sent to Google.

7. Where data is stored

Data is hosted in the European Union. If any provider processes data outside the European Economic Area, we rely on appropriate safeguards (such as Standard Contractual Clauses).

Specifically for Google Analytics: our contract is with Google Ireland Limited, but Google may transfer data to the United States. That transfer relies on the EU–US Data Privacy Framework, in which Google participates, together with Standard Contractual Clauses. If you would rather avoid the transfer, simply decline analytics cookies — Google Analytics is then never loaded.

8. How long we keep data

We keep enquiry data for as long as needed to respond and for a reasonable period afterwards, then delete or anonymise it. We keep marketing consent until you withdraw it.

Google Analytics data is retained for up to 14 months, after which Google deletes it automatically. Your cookie choice is stored locally in your browser until you clear this site's data.

9. Your rights

Under the GDPR you have the right to:

• access your data and obtain a copy of it;
• rectify inaccurate data;
• erasure (the "right to be forgotten");
• restrict processing;
• data portability;
• object to processing based on legitimate interest;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

10. Complaints

To exercise your rights, email us at [email protected]. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), www.cpdp.bg, if you believe we process your data unlawfully.

11. Security

We apply appropriate technical and organisational measures: EU hosting, encryption in transit (HTTPS), access controls, and minimising the data we collect.

12. Children

Our site and services are aimed at businesses, not children. We don't knowingly collect children's data.

13. Changes to this policy

We may update this policy. The current version carries the date shown at the top. We will note any material changes here.

14. Contact

Questions about this policy: [email protected].