Privacy Policy

1. Who we are

You Plus We Ltd is a software and web development studio registered in Bulgaria under Company ID (ЕИК) 202843243, with a registered address at Kapitan Raicho 44, Plovdiv 4000, Bulgaria, represented by its manager Aleksandar Atanasov. We are the data controller for the personal data described in this policy.

For any question about this policy or your data, write to hello@youpluswe.com or call +359 889 86 17 18.

2. What we collect

We collect two kinds of data - what you send us yourself, and what is recorded automatically when you browse the site.

• +Contact form and email: your name, organization, email address, and anything you choose to write in your message.
• +Client and project data: contact details, contract and billing information, and correspondence, for the people we actually work with.
• +Analytics data, through Google Analytics: pages visited, referring page, approximate location derived from IP, device, browser and language, and how you move through the site.
• +Advertising data: the Meta (Facebook) Pixel records visits and actions such as opening the contact page, so we can measure and target our own advertising.
• +Technical logs: our hosting provider records IP addresses and request data for security and availability.
• +Country lookup: on your first visit to an English page, your IP address is sent once to ip-api.com so we can offer you the Bulgarian version if you are browsing from Bulgaria. Only the country comes back to us - we do not store your IP for this, and the result is kept in your own browser so the check never runs again.

We do not ask for and do not want special-category data - health, political views, and similar. Please do not include it in your messages.

3. Why we use it, and on what legal basis

• +To answer your enquiry and to prepare an offer - because it is necessary to take steps at your request before entering into a contract (Art. 6(1)(b) GDPR).
• +To deliver and support projects and to invoice - performance of a contract (Art. 6(1)(b) GDPR).
• +To keep accounting and tax records - compliance with a legal obligation (Art. 6(1)(c) GDPR).
• +To keep the site secure and available - our legitimate interest in protecting our infrastructure (Art. 6(1)(f) GDPR).
• +To show the site in the language of the country you are browsing from - our legitimate interest in presenting our own site usefully (Art. 6(1)(f) GDPR). You can always switch language yourself, and your choice is respected from then on.
• +To measure how the site is used through Google Analytics, and to measure and target advertising through the Meta Pixel - your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

4. Cookies and tracking

Cookies strictly necessary to serve the site are always set. Analytics and advertising cookies - including those used by the Meta Pixel - are set only after you consent, and you can change or withdraw that choice at any time in your browser settings or by contacting us.

Declining analytics and advertising cookies has no effect on your ability to use the site or to contact us.

5. How long we keep it

• +Enquiries that do not lead to a project: up to 12 months from our last exchange, then deleted.
• +Client records and correspondence: for the duration of the engagement and 5 years after it ends, so we can handle warranty, support and legal claims.
• +Accounting and tax documents: 10 years, as required by Bulgarian law.
• +Analytics and advertising data: up to 14 months in aggregated or pseudonymised form.
• +Server logs: up to 12 months.

6. Who has access

We do not sell your data, and we do not share it with third parties for their own marketing or any other purpose of their own.

Beyond ourselves, the only recipients of your data are Google Analytics and the Meta (Facebook) Pixel for the measurement described above, ip-api.com for the one-off country lookup, and the providers we need in order to operate - our hosting and email providers and our accountants. Nobody else receives it. Each acts on our instructions under a data processing agreement, except where they are independent controllers for their own platform data.

We may also disclose data where we are legally required to do so - for example to a competent authority acting within its powers.

7. Transfers outside the EEA

Some of our providers, including the analytics and advertising services, may process data outside the European Economic Area. Where that happens, the transfer is covered by an adequacy decision of the European Commission or by the European Commission's Standard Contractual Clauses.

8. Your rights

Under the GDPR you have the right to:

• +Access the personal data we hold about you and receive a copy of it.
• +Have inaccurate data corrected and incomplete data completed.
• +Have your data erased where we no longer have a valid reason to keep it.
• +Restrict or object to processing, including processing based on our legitimate interest.
• +Receive your data in a portable, machine-readable format.
• +Withdraw consent at any time, without affecting processing carried out before the withdrawal.

Write to hello@youpluswe.com to exercise any of these rights. We reply within one month.

If you believe we have handled your data incorrectly, you may also complain to the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blv, Sofia 1592, or to the supervisory authority in your country of residence.

9. Security

The site is served over HTTPS, access to client data is limited to the people working on the project, and accounts are protected by strong authentication. No system is perfectly secure, but we treat your data with the same care we apply to our clients' systems.

10. Changes to this policy

If we change how we handle personal data, we will update this page and the date above. Material changes affecting you as a client will also be communicated directly.