Effective Date: June 19, 2026
At Laterna EOOD, we architect secure, deterministic systems. We apply this same strict engineering standard to your personal data. This Privacy & Cookie Policy explains how we collect, use, and protect your data when you visit our website or interact with our services.
As a business operating from Sofia, Bulgaria, we comply strictly with the General Data Protection Regulation (GDPR) and applicable local laws.
Laterna EOOD
ul. Persenk 49, Sofia, Bulgaria
Email: privacy@laterna.bg
UIC: 205365389
We practice data minimization. We do not use marketing CRMs, newsletters, or invasive tracking scripts. We only collect data necessary for technical functionality and handling your direct inquiries.
Communication Data: If you contact us via email or book a consultation, we collect your name, email address, and the contents of your message. We use this exclusively to fulfill your request and engage in pre-contractual discussions (GDPR Art. 6(1)(b)).
Scheduling Data: Discovery calls are booked and conducted using Proton Calendar and Proton Meet. This ensures end-to-end encryption for your scheduling data and meeting contents.
Technical & Security Data: (Cloudflare Turnstile): To protect our site from bots and spam, we use Cloudflare Turnstile. Turnstile verifies that you are a human by analyzing standard browser and telemetry data. It does not use tracking cookies or store personally identifiable data. The services may process temporary technical data (such as IP addresses and browser headers) strictly to ensure the security, availability, and performance of our website (GDPR Art. 6(1)(f)). Please note: Submitting any form on our website is subject to Cloudflare Turnstile verification.
Analytics: We use Vercel Web Analytics to monitor basic website performance. Vercel Analytics does not track individual users, track visitors across different websites, or store IP addresses. All data is strictly anonymized. For full transparency, you can read the Vercel Analytics Privacy Policy here.
Technical Hosting Data (Server Logs): Because our application is hosted on Vercel's global edge network, basic request metadata (such as your IP address, browser type, and timestamp) is automatically and temporarily processed by Vercel’s servers. This is strictly necessary to deliver the website securely to your screen, route traffic, and prevent DDoS attacks (GDPR Art. 6(1)(b) and Art. 6(1)(f)).
Unlike most websites, we do not require a disruptive cookie banner because we do not use tracking, marketing, or third-party advertising cookies.
Our architecture uses only strictly necessary technical cookies or session tokens required for core functionality. Because these are strictly necessary for the secure operation of the site, they are exempt from standard cookie consent requirements under the ePrivacy Directive.
We do not engage in user profiling. We do not track your behavior, build profiles about you, or use automated decision-making that produces legal or significant effects on you.
We do not sell, rent, or trade your data. To run our architecture securely, we utilize highly vetted, privacy-first infrastructure partners. Because of the encryption and anonymization standards we deploy, your personal communication contents are not readable by these providers:
Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland: Provides our email, calendar, and video meeting infrastructure. Proton utilizes zero-access, end-to-end encryption. This means your data is never "shared" with them in a readable format; even Proton cannot decrypt, read, or access the contents of your communications or scheduled events.
Vercel Inc., 650 California St, San Francisco, CA 94108, USA: Provides our Next.js website hosting, edge routing, and anonymized web analytics. Vercel acts strictly as our Data Processor under a legally binding Data Processing Addendum (DPA). Because Vercel operates a global network, temporary routing of technical data (like IP addresses) may occur outside the European Economic Area; this is strictly governed by EU Standard Contractual Clauses (SCCs) to ensure full GDPR compliance.
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA: Provides Turnstile bot protection, analyzing non-identifiable telemetry data strictly for security verification.
We keep your personal data only for as long as necessary to fulfill the purposes outlined in this policy. Inquiries that do not lead to a client relationship are routinely purged from our encrypted systems. Data related to active or completed projects is retained subject to standard commercial and tax laws in Bulgaria.
Our website may contain links to external case studies, tools, or GitHub repositories. We are not responsible for the privacy practices of external websites. Once you leave our domain, their respective policies apply.
We are committed to resolving any complaints regarding your privacy directly and efficiently. However, please note that Laterna EOOD is neither obliged nor willing to participate in dispute settlement proceedings before a consumer arbitration board (Alternative Dispute Resolution).
Under the GDPR, you have complete control over your data. You have the right to:
Access the personal data we hold about you.
Rectify inaccurate or incomplete data.
Erase your data ("Right to be Forgotten").
Restrict or Object to our processing of your data (including automated processing).
Data Portability (receive your data in a structured, machine-readable format).
To exercise any of these rights, please contact us directly at the specified contact email address. We will respond to all requests within 30 days.
If you believe our processing of your personal data violates data protection laws, you have the right to lodge a complaint with our governing supervisory authority:
Commission for Personal Data Protection (CPDP / КЗЛД)
Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Email: kzld@cpdp.bg
Website: www.cpdp.bg