1. Introduction
1.1. This Privacy Policy explains how Superstate DPK ("Superstate", "we", "us" or "our") processes personal data in connection with the website www.superstate.one (the "Website"), in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, the "GDPR") and the Bulgarian Personal Data Protection Act.
1.2. This Privacy Policy applies to the Website only. Personal data that we process when providing services to our clients is governed by the relevant client agreement and, where applicable, the data processing agreement concluded with that client.
2. Summary
- We collect contact details only when you submit the contact form.
- Visitor statistics are collected with a cookieless tool that does not process personal data.
- Google Analytics is activated only with your prior consent.
- We do not sell personal data.
- You may exercise your rights at any time by writing to hello@superstate.one.
3. Controller
3.1. The controller of your personal data is Superstate DPK („Суперстейт“ ДПК), a variable capital company incorporated under Bulgarian law and registered in the Commercial Register and Register of Non-Profit Legal Entities, UIC 208470096, VAT number BG208470096, with its registered office and address of management at Yavorov residential complex, bl. 73, fl. 11, apt. 24, Slatina district, 1111 Sofia, Bulgaria. Superstate operates under the brand name "Superstate".
3.2. Contact for all data protection matters: hello@superstate.one, +359 886 399 081.
3.3. We have not appointed a data protection officer, as we are not required to do so under Article 37 GDPR.
4. Personal data we process, purposes and legal bases
4.1. Contact form enquiries
(a) Data processed: your email address and/or telephone number (at least one is required); your name (optional); the button used to open the form, and the page and language from which the form was submitted; and, where you have consented to analytics cookies, the campaign parameters (UTM parameters) of the link through which you reached the Website.
(b) Purposes: to respond to your enquiry, to arrange and prepare an initial meeting, and to measure which of our communications generate enquiries.
(c) Legal bases: taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR) or, where you contact us on behalf of a company, our legitimate interest in responding to business enquiries (Article 6(1)(f) GDPR); and, for the source and campaign data, our legitimate interest in measuring the effectiveness of our communications (Article 6(1)(f) GDPR). Campaign parameters are stored in your browser only with your consent, as described in our Cookie Policy.
(d) Providing your data is voluntary. Without an email address or a telephone number, we are unable to respond to your enquiry.
(e) Enquiries are sent by email to hello@superstate.one through our email delivery provider, Resend, and answered from that address. The Website does not store them. Submitting an enquiry does not subscribe you to any newsletter, and we will not use your contact details for direct marketing on that basis.
(f) If you contact us through LinkedIn, LinkedIn's own privacy policy applies to LinkedIn's processing of your message.
4.2. Visitor statistics without cookies
We measure visits to the Website with Simple Analytics, provided by Simple Analytics B.V. (the Netherlands). Simple Analytics sets no cookies, processes no personal data and does not allow us to identify individual visitors. Its use therefore does not require your consent.
4.3. Google Analytics (subject to consent)
(a) Google Analytics 4 is loaded only after you click "Accept" in the analytics banner. Until then it is disabled and is not loaded by your browser. We use Google Consent Mode, with all consent signals set to "denied" by default. Advertising features and Google Signals are disabled.
(b) If you consent, Google sets cookies and collects information such as the pages you view, your device and browser type, and your approximate location. Google Analytics is provided by Google Ireland Limited.
(c) Legal basis: your consent (Article 6(1)(a) GDPR and Article 4a of the Bulgarian Electronic Communications Act). You may withdraw your consent at any time through the "Cookie Settings" link at the bottom of every page. Withdrawal does not affect the lawfulness of processing carried out before it.
4.4. Server logs
The Website is hosted on servers of Hetzner Online GmbH in Germany. Our web server records standard server logs: IP address, date and time of access, the page requested and browser type. These logs are used to keep the Website secure and operational. Legal basis: our legitimate interest in ensuring the security and proper functioning of the Website (Article 6(1)(f) GDPR).
4.5. Language and country detection
When you open www.superstate.one, the server determines the country of your connection in order to display the Bulgarian version to visitors from Bulgaria. For this purpose, a list of IP address ranges stored on our own server is used, without involving any third party. This information is not stored. Your language preference and your analytics choice are stored on your device only, as set out in the Cookie Policy.
4.6. Third-party content
Fonts, images and videos are hosted on our own infrastructure. Your browser does not connect to Google Fonts or any other third-party service to load them.
5. Retention
| Data | Retention period |
|---|---|
| Contact form enquiries | 24 months after our last contact with you. Where a contract is concluded, the retention provisions of that contract apply. |
| Google Analytics data (only with consent) | 2 months, in line with the retention setting of our Google Analytics account. Aggregated reports that do not identify individuals may be retained longer. |
| Google Analytics cookies | Up to 2 years, or until you delete them or withdraw your consent, whichever is earlier. |
| Server logs | 14 days. |
| Simple Analytics | No personal data is processed. |
6. Recipients
6.1. We share personal data only with the following service providers, which act as processors on our behalf, on our documented instructions and under data processing agreements in accordance with Article 28 GDPR:
- Hetzner Online GmbH (Germany): hosting of the Website and server logs;
- Resend, Inc. (USA): delivery of contact form enquiries by email to hello@superstate.one;
- Google Ireland Limited (Google Workspace): email services for hello@superstate.one;
- Simple Analytics B.V. (the Netherlands): cookieless visitor statistics, without personal data;
- Google Ireland Limited (Google Analytics): website analytics, only with your consent.
6.2. We may disclose personal data to courts or public authorities where we are required to do so by law.
6.3. We do not sell personal data and do not disclose it to any other third parties.
7. International transfers
7.1. Some of our service providers are located in, or may process data in, the United States.
7.2. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Commission Implementing Decision (EU) 2023/1795, Article 45 GDPR).
7.3. Resend, Inc. is established in the United States. Transfers to Resend are based on the standard contractual clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914, Article 46(2)(c) GDPR), which form part of our agreement with it.
8. Security
We apply appropriate technical and organisational measures to protect personal data. These include restricting access to contact form enquiries to the persons responsible for handling them and transmitting all data over an encrypted connection (HTTPS).
9. Your rights
9.1. Under the GDPR, you have the right to:
- access your personal data (Article 15);
- rectification of inaccurate or incomplete data (Article 16);
- erasure of your data (Article 17);
- restriction of processing (Article 18);
- data portability (Article 20);
- object to processing based on our legitimate interests (Article 21);
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Article 7(3)).
9.2. To exercise your rights, please write to hello@superstate.one. We will respond within one month of receipt. This period may be extended by two further months where necessary, taking into account the complexity and number of requests; in that case, we will inform you of the extension and the reasons for it within the first month. We may ask you to verify your identity. Requests are handled free of charge, unless they are manifestly unfounded or excessive (Article 12 GDPR).
9.3. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).
10. Complaints
10.1. If you believe that we process your personal data unlawfully, we encourage you to contact us first so that we can address your concern.
10.2. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg, or with the supervisory authority of the EU Member State of your habitual residence, place of work or place of the alleged infringement (Article 77 GDPR).
11. Children
The Website is intended for businesses and is not directed at children. We do not knowingly collect personal data from persons under the age of 16.
12. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The current version is always published on this page, with the date of the last update indicated at the top.