Privacy Policy

Dilmach is provided by ALBOSSE EOOD (UIC/PIC 206877257, VAT BG206877257), registered at 1 Khan Asparuh Street, village of Petarch 2234, Bulgaria ("Dilmach", "we", "us" or "our").

Our primary privacy contact is dpo@dilmach.com. Our legal contact is legal@dilmach.com.

This Privacy Policy applies to personal data processed by Dilmach in connection with our website, marketing, account registration, the Dilmach CRM/workspace platform, billing, support and related services (together, the "Services"). It does not govern the practices of third parties we do not control.

The most important distinction in this Privacy Policy is between Dilmach's own processing and Customer Content processed on behalf of Dilmach customers.

For Dilmach's own processing — such as website visitor data, account registration, user account administration, billing administration, support, security monitoring, service communications, and marketing where applicable — Dilmach generally acts as a controller.

For Customer Content uploaded into the CRM by a Dilmach customer, the customer generally determines the purposes and means of processing and acts as controller, while Dilmach generally acts as processor. The applicable role depends on the specific processing activity; Dilmach is not always controller and is not always processor.

We process the following categories of personal data:

• Identity and contact information — name, business email, phone number where provided, company, job title where provided.
• Account information — account identifiers, workspace membership, role, permissions, preferences, authentication-related information.
• Customer Content — CRM contacts, companies, leads, deals, tasks, notes, communications, files, and other information entered by customers.
• Billing information — subscription, invoices, billing contact, transaction information.
• Support information — support requests, correspondence, troubleshooting information.
• Technical and security information — IP address, browser, device, operating system, logs, diagnostics, security events.
• Cookie information — cookie identifiers, consent preferences, analytics information where applicable.

We collect personal data:

• Directly from you, such as when you create an account or contact support.
• Automatically, through your use of the Services (e.g. logs, cookies).
• From customers who submit Customer Content that may include personal data about you.
• From our infrastructure providers as part of operating the Services.

We process personal data to provide, secure, maintain, support and improve the Services, to administer accounts and billing, to communicate with users, to comply with legal obligations, and, where applicable, for marketing.

The table below summarises the legal bases we rely on for our own processing activities.

Customers are responsible for determining the purposes and lawful means of processing personal data that they submit to Dilmach as Customer Content. Where Dilmach processes such personal data solely on the customer's documented instructions in order to provide the Services, Dilmach generally acts as a processor and the customer generally acts as controller.

Customers must ensure that they have an appropriate legal basis and all required notices and permissions for personal data they submit to the Services.

Dilmach is not designed to require customers to submit special categories of personal data. Customers should avoid submitting such information unless its processing is necessary, lawful and appropriately safeguarded.

We share personal data with infrastructure and service providers who process data on our behalf (see Subprocessors), with professional advisers, and where required by law, regulation or legal process. We do not sell personal data.

Dilmach uses a limited set of infrastructure and service providers actually used in production, including providers for application hosting and file storage, database infrastructure, payment processing, transactional email, AI-assisted features, and website analytics. A full, audited description of our subprocessors, including their role and links to their respective security and trust documentation, is available on our Subprocessors page.

Some service providers may process personal data in jurisdictions outside the European Economic Area. Where a restricted transfer under Chapter V GDPR occurs, Dilmach will rely on an applicable lawful transfer mechanism, which may include an adequacy decision, an applicable certification mechanism, Standard Contractual Clauses or another legally recognised safeguard.

Vercel's own official documentation states that Vercel is certified under the EU-U.S. Data Privacy Framework. This is reflected here only as a provider-specific fact and is not a representation that all Dilmach data remains within, or leaves, any particular region.

We retain personal data only for as long as reasonably necessary for the relevant purpose, taking into account contractual, legal, security, accounting, dispute-resolution and regulatory requirements. Exact retention periods by data category are documented on our Data Retention page. Retention and deletion of Customer Content are also governed by the applicable customer agreement and Data Processing Agreement.

We implement technical and organisational measures designed to protect personal data. Further detail is available on our Security page. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Dilmach maintains processes for detecting, assessing, responding to and documenting personal data incidents. Where Dilmach acts as processor, we will notify the relevant customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, subject to applicable law and the applicable Data Processing Agreement. Where required by applicable law, we will notify affected individuals and/or supervisory authorities regarding breaches affecting data for which we act as controller.

Subject to applicable law, you may have the right to:

• access personal data we hold about you;
• request rectification of inaccurate personal data;
• request erasure of personal data;
• request restriction of processing;
• request data portability;
• object to processing;
• withdraw consent at any time where processing is based on consent; and
• exercise rights relating to automated decision-making, as described below.

You may contact us at dpo@dilmach.com to exercise applicable rights.

We will respond without undue delay and, in any event, within one month of receiving your request, subject to applicable law. Where permitted by law, this period may be extended by up to two further months depending on the complexity and number of requests.

Dilmach does not currently use your personal data to make decisions that produce legal effects or similarly significantly affect you based solely on automated processing, without human involvement. If this changes, we will update this Privacy Policy and our AI Policy accordingly.

We use cookies and similar technologies as described in our Cookie Policy, which explains the categories of cookies we use and how you can manage your preferences.

Where permitted by applicable law, we may send marketing communications about Dilmach. Where consent is the applicable legal basis, you may withdraw consent at any time. You can opt out of marketing communications using the unsubscribe mechanism included in those communications or by contacting legal@dilmach.com.

The Services are intended for business use and are not directed to children. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above, and, where required by applicable law, communicated to affected users.

Questions about this Privacy Policy can be directed to dpo@dilmach.com.

ALBOSSE EOOD
1 Khan Asparuh Street, village of Petarch 2234, Bulgaria
UIC/PIC: 206877257 · VAT: BG206877257

Our lead supervisory authority is the Commission for Personal Data Protection (CPDP) (Bulgaria).

You may also have the right to lodge a complaint with a supervisory authority in the EU/EEA country where you normally live, work, or where an alleged infringement occurred, as applicable.