Privacy Policy

1. Who we are and what this policy covers

Scale West Ltd. (Скейл Уест ЕООД), company registration number (EIK) 204514691, Sofia, Bulgaria, operates this website under the ScaleWest brand. We are the controller of personal data collected through our website and business enquiries. Contact us at [email protected] with any privacy question or request.

This policy covers visitors to our website and people who contact us about our software development, dedicated team and related services. Personal data processed on a client's behalf during a project is governed by the relevant service agreement and data processing agreement. That client's privacy notice may also apply.

2. Personal data we receive

• Enquiries: first and last name, email address, phone number, subject, message and any business or project information you choose to include. We also retain relevant follow-up correspondence.
• Technical information: IP address, requested pages, time of access, browser and device information, referring pages and error or security events may be recorded by the website infrastructure and the external services described below.
• Anti-spam information: a reCAPTCHA verification token and the technical signals Google uses to distinguish legitimate visitors from automated activity.

We receive enquiry information directly from you. Technical information is generated when your browser connects to the website or an integrated provider. Please do not send passwords, production access credentials, payment card details, sensitive personal data or personal information about other people unless it is necessary and you are authorised to share it.

3. Why we use data and our legal grounds

• Responding to enquiries and discussing a project: taking steps at your request before entering a contract, where you are the prospective contracting party (GDPR Article 6(1)(b)). For business representatives and general enquiries, our legitimate interest is communicating with potential clients and responding to their requests (Article 6(1)(f)).
• Operating and protecting the website: our legitimate interests in delivering the website, preventing spam and misuse, diagnosing faults and protecting our systems and visitors (Article 6(1)(f)), subject to the requirements for accessing information on your device.
• Legal obligations and disputes: compliance with applicable obligations (Article 6(1)(c)), and our legitimate interest in establishing, exercising or defending legal claims (Article 6(1)(f)).
• Optional advertising technologies: consent where required (Article 6(1)(a) and applicable cookie rules). Submitting an enquiry or continuing to browse does not itself constitute consent to advertising tracking.

Optional form protection and advertising are activated on your consent (Article 6(1)(a)). The contact form marks certain fields as required to process a submission. There is no general legal obligation to submit an enquiry; if you prefer not to use the form, email us instead. Sending a message does not subscribe you to a newsletter.

4. Cookies, integrations and external services

External services can receive information when your browser loads their resources, even if you do not submit the contact form. Their own notices explain their processing in more detail.

• Google reCAPTCHA: Google's anti-spam service loads only after you enable Form protection in Cookie settings. It can process IP addresses, device and browser information and interaction signals, and uses the _GRECAPTCHA cookie for risk analysis. Other Google cookies may also be involved depending on your browser and Google settings. See Google's Privacy Policy and Terms of Service.
• Fonts: website fonts are served from our own website. Browsing does not load Google Fonts.
• Meta Pixel: after you enable Advertising in Cookie settings, case-study pages can load Meta Pixel, an advertising measurement integration that can send page-view, browser and device information to Meta and use cookies or similar identifiers. See Meta's Privacy Policy. Advertising tracking requires prior consent where applicable; this notice is not a request for, or a substitute for, that consent.
• LinkedIn and other external links: following a link takes you to a separate service with its own privacy rules. A plain social link is different from an embedded social plugin.

Use Cookie settings in the footer to accept, reject or change individual categories at any time. Optional categories start disabled. Rejecting optional services does not block browsing, and email is an alternative to the protected web form. Continuing to browse is not consent.

We remember acceptance and refusal equally for 180 days in this browser’s local storage, using scalewest.privacy.v1. This necessary record contains your category choices, the preference version and the time saved; it is not an advertising identifier. If the choice expires or its version changes, we ask again. If browser storage is unavailable, choices apply to the current page only.

Turning off an active category reloads the page to stop that service. On advertising withdrawal, we also request removal of first-party _fbp and _fbc cookies accessible on this domain. We cannot directly remove cookies belonging to a different provider’s domain or erase data it has already received. You can review or remove stored cookies using your browser settings. Blocking third-party resources may affect form verification. Browser settings do not replace any consent controls that are legally required. You can contact us by email if you prefer not to use reCAPTCHA.

5. Who may receive your data

Relevant ScaleWest personnel and authorised contractors may access information needed to handle your enquiry. Hosting, infrastructure, email and security providers may process it to deliver their services. Professional advisers, authorities or courts may receive information where necessary for legal obligations or claims. We limit disclosure to what is relevant for the purpose.

Providers acting on our instructions must be subject to appropriate data protection terms. Some integrated providers also process information under their own terms and responsibilities, as described in their privacy notices.

6. International transfers

Our business is based in Bulgaria, within the European Economic Area (EEA). Using international infrastructure or integrated services may involve processing outside the EEA, including in the United States. Where we transfer personal data to a recipient outside the EEA, an applicable legal transfer mechanism is required: for example, a relevant adequacy decision, or the European Commission's Standard Contractual Clauses with supplementary safeguards where necessary. Such safeguards do not mean that every country has identical data protection laws. Contact us for information about the mechanism applicable to a particular transfer and how to obtain a copy of relevant safeguards.

7. How long information is kept

Retention depends on the purpose and the record. Enquiries and correspondence are kept for the time reasonably needed to answer the request, conduct related business discussions and maintain a relevant record of the relationship. If a project begins, contract, accounting and related records follow the applicable contractual and statutory retention requirements. Technical logs are retained according to operational and security needs and the infrastructure provider's settings.

Relevant records may be kept longer where a legal duty, an active dispute or an applicable limitation period requires it. Records should be deleted or anonymised once no longer needed; backup copies may remain until the normal backup rotation replaces them. External providers set their own retention periods for data they control. You can ask us about retention for your specific correspondence.

8. Your choices and rights

Subject to the conditions and exceptions in applicable law, you can request access to your personal data, correction, erasure, restriction of processing and data portability. You can object to processing based on legitimate interests, including on grounds relating to your particular situation. You can object to direct marketing at any time. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.

Email [email protected] to exercise a right. We may need proportionate information to verify your identity. We normally respond within one month; if a lawful extension is needed, we will explain why and inform you within that period. Requests are normally free of charge, subject to the legal rules for manifestly unfounded or excessive requests.

You can complain to the Bulgarian Commission for Personal Data Protection, or to the competent supervisory authority in the country of your habitual residence, workplace or the alleged infringement. You do not need to contact us first to exercise that right.

9. Security, automated decisions and children

Data protection requires appropriate access controls, secure handling and safeguards proportionate to the information and risks involved. No internet transmission or storage system is completely risk-free. Please contact us if you suspect a security issue involving information you sent us.

The website contact workflow does not make decisions producing legal or similarly significant effects about you. reCAPTCHA automatically assesses activity for spam prevention and may block a form submission; email remains an alternative contact route.

This website is directed at business audiences and is not intended to collect information from children. If you believe a child has supplied personal data, please let us know so we can assess and address it.

10. Changes and contact

We may revise this policy as the website, our services or legal requirements change. The date above identifies the current version. Where required, we will provide additional notice or seek fresh consent for a new use. Questions can be sent to [email protected].