Privacy statement
This privacy statement explains how Sonaria Ltd. handles personal data when you visit sonaria.ltd, contact us or work with us. We process only the data we need, for clear purposes, in line with the EU General Data Protection Regulation (GDPR) and the Bulgarian Personal Data Protection Act.
1. Who we are
The controller of your personal data is:
Sonaria Ltd. (Сонария ЕООД)
10 Stefan Karadzha Str., fl. 3, 1000 Sofia, Bulgaria
UIC 203533849 · VAT BG203533849
Director: Heinz Wagner
Email: hw@sonaria.ltd
We have not appointed a Data Protection Officer, as the law does not require one for our activities. Questions about privacy go to the email address above.
2. What data we process and why
| Situation | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Visiting the website | IP address, browser type, pages requested, date and time (server logs) | Delivering the site securely, preventing abuse | Legitimate interest (art. 6(1)(f)) |
| Contacting us by email | Name, company, email, phone number, content of your message | Answering your question, planning an introduction | Steps prior to a contract (art. 6(1)(b)) or legitimate interest (art. 6(1)(f)) |
| Working with us as a client | Contact persons' names, roles, business contact details, correspondence, invoicing details | Performing the agreement, invoicing, accounting | Contract (art. 6(1)(b)) and legal obligation (art. 6(1)(c)) |
| Business relations and prospects | Name, company, role, business contact details | Keeping in touch about our services | Legitimate interest (art. 6(1)(f)); you can object at any time |
We do not use your data for automated decision-making or profiling with legal or similarly significant effects. We do not sell personal data.
We do not knowingly collect special categories of personal data. Please do not send such data unless an assignment requires it and we have agreed how it will be handled.
3. Client data we handle on your behalf
In many assignments, such as setting up Salesforce, building AI automations or preparing GDPR documentation, we work with personal data that belongs to our client. In that case the client is the controller and Sonaria acts as processor. We then process the data only on the client's documented instructions, under a data processing agreement as required by article 28 GDPR. This privacy statement does not cover that processing; the client's own privacy statement does.
4. Who receives your data
We share personal data only where needed for the purposes above:
- Hosting and email providers that run our website and mailbox, including Cloudflare (website hosting and security) and Mijndomein (email).
- Our accountant and tax advisers in Bulgaria, for bookkeeping and statutory obligations.
- Software tools we use to deliver assignments, such as Salesforce, under the client's agreement or ours.
- Authorities, when the law requires us to.
All service providers that process data for us are bound by a data processing agreement.
5. Transfers outside the EU
Some providers may process data outside the European Economic Area, for example in the United States. We only allow this where an adequate level of protection is ensured: an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework for certified companies) or the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
6. How long we keep data
| Data | Retention |
|---|---|
| Server logs | Up to 30 days, unless needed to investigate an incident |
| Enquiries that do not lead to an assignment | Up to 2 years after our last contact |
| Client correspondence and project files | For the duration of the agreement and up to 5 years afterwards, for claims and accountability |
| Invoices and accounting records | As long as Bulgarian accounting and tax law requires, generally up to 10 years |
After these periods we delete or anonymise the data.
7. Security
We take appropriate technical and organisational measures to protect personal data against loss and unauthorised access. These include encrypted connections (HTTPS), access restricted to people who need it, multi-factor authentication on our accounts, and careful selection of service providers.
8. Cookies
Our website does not use tracking, analytics or advertising cookies. Our hosting provider may place strictly necessary technical cookies to secure the site against abuse; these do not require your consent. If this changes, we will update this statement and ask for your consent where the law requires it.
9. Your rights
You have the right to:
- access the personal data we hold about you;
- have incorrect data corrected;
- have data erased, unless we must keep it by law;
- restrict processing;
- receive your data in a structured, machine-readable format (data portability);
- object to processing based on legitimate interest, including direct marketing;
- withdraw consent at any time, where processing is based on consent.
Send your request to hw@sonaria.ltd. We respond within one month. We may ask you to confirm your identity first.
10. Complaints
If you believe we handle your data incorrectly, please contact us first. You also have the right to lodge a complaint with the Bulgarian supervisory authority, the Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg, or with the authority in the EU country where you live or work.
11. Changes
We may update this statement. The latest version is always published on sonaria.ltd, with its date.
Version 1.0 – 10 November 2026