This Privacy Policy explains how PLANA Digital Ltd. ("PLANA Pulse", "we", "us", or "our") collects, uses, and protects personal data when you visit planapulse.ai or use the PLANA Pulse Business Operating System ("Service"). We are committed to processing personal data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Bulgarian data-protection law.
1. Data Controller
| Company | PLANA Digital Ltd. |
|---|---|
| VAT | BG206624296 |
| Address | 95-99 Tsar Asen str., 1463 Sofia, Bulgaria |
| Liable person | Chudomir Monevski |
| contact@planapulse.ai |
For questions about this policy or to exercise your rights, contact us at the e-mail above or by post at the address above, marked "Data Protection".
2. What We Collect
2.1 Website visitors
- Usage data — pages visited, referrer URL, browser type, device type, and approximate country (via anonymised IP). Collected via first-party analytics only; no cross-site tracking.
- Contact-form submissions — name, business e-mail, company name, phone (optional), and message content.
2.2 Service (BOS) users
- Account data — name, work e-mail, job title, company name.
- Usage & audit logs — actions taken inside the platform, timestamps, and IP addresses, for security and support purposes.
- Business data — financial, operational, and CRM data that your organisation loads into the Service. This data is processed as a data processor on your behalf under a Data Processing Agreement (DPA) — it is yours, not ours.
2.3 Data we do not collect
We do not collect payment card data (handled by certified PSPs), national ID numbers, biometric data, or data about children under 16.
3. Purposes & Legal Basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Responding to contact-form enquiries and sales conversations | Art. 6(1)(b) — pre-contractual steps at your request |
| Providing, operating, and improving the Service | Art. 6(1)(b) — performance of contract |
| Sending product updates, security notices, and invoices | Art. 6(1)(b) — performance of contract |
| Sending marketing e-mails about PLANA Pulse features | Art. 6(1)(f) — legitimate interest (existing customers only); Art. 6(1)(a) — consent (prospects) |
| Complying with legal obligations (tax, accounting) | Art. 6(1)(c) — legal obligation |
| Security monitoring and fraud prevention | Art. 6(1)(f) — legitimate interest |
| Website analytics (anonymised, aggregate) | Art. 6(1)(f) — legitimate interest |
4. Data Retention
- Contact-form submissions — retained for up to 3 years or until you request deletion, whichever is sooner.
- Account data — retained for the duration of your contract plus 5 years (Bulgarian accounting-law requirement).
- Audit logs — retained for 12 months for security purposes, then automatically deleted.
- Business data you load into the Service — retained while your subscription is active; deleted within 30 days of contract termination unless you export it first or law requires longer retention.
- Cookies — session cookies expire when you close the browser; persistent cookies expire as stated in our Cookie Policy.
7. Your Rights
As a data subject under GDPR you have the right to:
- Access — obtain a copy of the personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure ("right to be forgotten") — request deletion where no legal basis for continued processing exists.
- Restriction — ask us to pause processing while a dispute is resolved.
- Portability — receive your data in a structured, machine-readable format.
- Object — opt out of processing based on legitimate interest, including direct marketing.
- Withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal.
To exercise any right, e-mail contact@planapulse.ai. We will respond within 30 days. You also have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov blvd., Sofia 1592, Bulgaria — www.cpdp.bg.
8. Security
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction. Measures include TLS encryption in transit, encryption at rest, role-based access controls, audit logging, and regular security reviews. In the event of a data breach affecting your rights and freedoms, we will notify the CPDP within 72 hours and inform affected individuals without undue delay.
9. Children
The Service is designed for business use by adults. We do not knowingly collect personal data from individuals under 16. If you believe a child has submitted data to us, please contact us and we will delete it promptly.
10. Changes to This Policy
We may update this policy as our practices evolve or legal requirements change. Material changes will be notified by e-mail (to active Service users) and by posting a notice on this page at least 14 days before taking effect. The "Effective date" at the top of this page always reflects the current version.
11. Contact
Questions, requests, or complaints about this policy:
PLANA Digital Ltd.Attn: Data Protection
95-99 Tsar Asen str., 1463 Sofia, Bulgaria
contact@planapulse.ai