Privacy Policy - Optimasoft

This Privacy Policy explains how SODO TRADE Ltd., operating the platform and brand Optimasoft ("Optimasoft", "we" or the "Controller"), collects, uses and protects personal data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable data-protection law.

Optimasoft is built in the European Union, with hosting and data storage in the EU. Data protection is designed into our products, not added afterwards.

1. Who is the data controller

Legal name: SODO TRADE Ltd. ("СОДО ТРЕЙД" ЕООД)
Company ID (EIK): 205452171
VAT number: BG205452171
Registered seat: 16 Zora, fl. 4, ap. 18, Primorski district, Varna 9000, Bulgaria
Contact email for data matters: privacy@optimasoft.io

For personal data relating to this website, marketing and user accounts, Optimasoft acts as a controller. For the data that our customers enter and process within the platform, Optimasoft acts as a processor on the customer's behalf, under a separate Data Processing Agreement (DPA).

2. Data Protection contact

For questions about the processing of personal data and the exercise of your rights, you can contact our data protection contact:

Contact person: Yavor Dobrev
Email: privacy@optimasoft.io

3. What personal data we collect

We collect different categories of data depending on how you interact with us:

Website visitors: IP address, device and browser type, pages viewed, language preference (cookie).
Demo requests and contact forms: name, business email, phone, company, job title, message content.
Job applicants: name, email, CV and any documents you send us.
Account users (customers): account holder name, business email, login credentials, billing details, support requests, usage telemetry.
Customer data in the platform: the data our customers choose to process in Optimasoft is governed by the Data Processing Agreement (DPA), not by this policy.

4. Purposes and legal bases

We process personal data only where we have a valid legal basis under Art. 6 GDPR:

Purpose	Data subjects	Legal basis (Art. 6 GDPR)
Providing the service and account support	Customers	Performance of a contract - Art. 6(1)(b)
Responding to an enquiry or demo request	Prospects	Legitimate interest - Art. 6(1)(f)
Processing job applications	Applicants	Pre-contractual steps / consent - Art. 6(1)(b)/(a)
Invoicing and accounting	Customers	Legal obligation - Art. 6(1)(c)
Marketing and newsletters	Prospects	Consent - Art. 6(1)(a)
Website security and abuse prevention	Visitors	Legitimate interest - Art. 6(1)(f)

Where we rely on legitimate interest, we have carried out a balancing assessment between our interest and your rights. Where the basis is consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

5. Recipients and processors

We do not sell personal data. We share data only with providers that help us deliver the service, and only as far as necessary:

hosting and cloud infrastructure provider (in the EU);
email and communications provider;
support and customer-relationship tools;
professional advisers (accounting, legal) where needed.

All processors act on our written instructions and are bound by contractual confidentiality and data-protection obligations under Art. 28 GDPR.

6. International transfers

Personal data is stored and processed within the European Union (hosting in a data centre in Germany). We do not transfer personal data outside the EU/EEA. This is a deliberate choice at the core of our "built in the EU" position.

7. Retention

We keep personal data only as long as necessary for the relevant purpose:

enquiries and demo requests - up to 24 months from the last contact, if no contractual relationship arises;
customer account data - for the duration of the contract and applicable limitation periods thereafter;
accounting and invoicing records - for the period required by the Bulgarian Accountancy Act (generally up to 10 years);
job applications - until the recruitment process ends, unless you consent to us keeping them for future roles;
cookies - per the periods set out in the Cookie Policy.

8. Your rights

Under the GDPR you have the following rights regarding your personal data:

right of access (Art. 15) - to obtain information and a copy of your data;
right to rectification (Art. 16);
right to erasure ("right to be forgotten", Art. 17);
right to restriction of processing (Art. 18);
right to data portability (Art. 20);
right to object (Art. 21), including an unconditional right to object to direct marketing;
right not to be subject to a solely automated decision with legal effects (Art. 22);
right to withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email us at privacy@optimasoft.io. We respond within one month of receiving the request.

9. Right to complain

If you believe we process your data unlawfully, you have the right to lodge a complaint with the supervisory authority:

Commission for Personal Data Protection (CPDP) Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria Phone: +359 2 915 3519 Email: kzld@cpdp.bg Website: www.cpdp.bg

You may also complain to the supervisory authority in your EU member state of residence.

10. Automated decision-making

In relation to this website and user accounts, we do not carry out solely automated decision-making that produces legal effects concerning you or similarly significantly affects you.

The Optimasoft platform includes artificial-intelligence features (such as recommendations and analytics) that our customers use in their own operations. Where such features process personal data, this happens under the control of the relevant customer as controller, governed by the agreement between them and us.

11. Security

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit, access control and hosting on certified EU infrastructure. Read more in the Security section.

12. Cookies

This website uses a minimal set of cookies. See the Cookie Policy for details.

13. Children

Our services are aimed at business users and are not directed at persons under 16. We do not knowingly collect personal data from children.

14. Changes to this policy

We may update this policy from time to time. The current version is always available on this page with a "last updated" date. For material changes, we will make reasonable efforts to notify you.

15. Contact

For any questions about this policy or the processing of your personal data:

Email: privacy@optimasoft.io
Controller: SODO TRADE Ltd., 16 Zora, fl. 4, ap. 18, Varna 9000, Bulgaria