Privacy Policy

Last updated: 30 June 2026

1. Introduction

This Privacy Policy explains how TiltOrbit OOD ("TiltOrbit", "we", "us" or "our") processes personal data relating to visitors to our website at tiltorbit.com (the "Site"), prospective clients, clients and other individuals who interact with us. We are committed to protecting your privacy and handling your personal data transparently, lawfully and securely.

We process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") and the Bulgarian Personal Data Protection Act (Закон за защита на личните данни). This Policy applies to all personal data we collect through the Site, by email, by telephone, through our contact forms and in the course of providing our marketing services.

Please read this Policy carefully. By using the Site or otherwise providing us with your personal data, you acknowledge that you have read and understood the practices described here.

2. Data Controller

The data controller responsible for your personal data is:

TiltOrbit OOD
ul. Tsar Ivan Shishman 23
1000 Sofia, Bulgaria
Telephone: +359 2 491 7820
General enquiries: hello@tiltorbit.com
Privacy enquiries: privacy@tiltorbit.com

If you have any questions about this Policy or about how we handle your personal data, please contact our privacy team at privacy@tiltorbit.com.

3. What Personal Data We Collect

We collect and process the following categories of personal data, depending on how you interact with us:

• Contact form data. When you submit an enquiry or request a proposal through our contact forms, we collect the information you provide, which typically includes your name, email address, telephone number, company name, and the content of your message.
• Analytics and usage data. When you visit the Site, we may automatically collect technical information such as your IP address (which may be truncated or anonymised), browser type and version, device type, operating system, referring URLs, the pages you view, and the dates and times of your visits.
• Cookies and similar technologies. We use cookies and similar technologies to operate the Site, remember your preferences and understand how the Site is used. See our Cookie Policy for full details.
• Communications. When you correspond with us by email, telephone or other channels, we keep a record of that correspondence and any information you choose to share with us.
• Client and engagement data. Where you become a client, we process information necessary to provide our services and administer our relationship, such as billing details, account credentials you authorise us to use, and project-related information.

We do not intentionally collect special categories of personal data (such as data revealing health, religious beliefs or political opinions). Please do not submit such information to us unless it is strictly necessary and we have asked for it.

4. Legal Basis for Processing

We only process personal data where we have a valid legal basis to do so under Article 6 of the GDPR. Depending on the activity, we rely on one or more of the following:

• Consent (Art. 6(1)(a)). Where you have given us clear, affirmative consent to process your personal data for a specific purpose — for example, accepting non-essential cookies or subscribing to marketing communications. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Performance of a contract (Art. 6(1)(b)). Where processing is necessary to enter into or perform a contract with you, such as delivering the marketing services you have engaged us for or responding to your request to receive a proposal.
• Legitimate interests (Art. 6(1)(f)). Where processing is necessary for our legitimate interests — such as understanding how the Site is used, securing our systems, preventing fraud, and promoting our services — provided those interests are not overridden by your rights and freedoms. We carry out a balancing assessment before relying on this basis.
• Legal obligation (Art. 6(1)(c)). Where processing is necessary to comply with a legal obligation to which we are subject, such as accounting, tax and record-keeping requirements under Bulgarian and EU law.

5. How We Use Your Data

We use personal data for the following purposes:

• To respond to your enquiries, prepare proposals and communicate with you;
• To provide, manage and improve our marketing services and our relationship with clients;
• To operate, maintain, secure and improve the Site and our internal systems;
• To analyse Site usage and measure the effectiveness of our content and campaigns;
• To send service-related communications and, where you have consented or where otherwise permitted, marketing communications about our services;
• To process payments, manage invoicing and keep accurate financial records;
• To comply with our legal and regulatory obligations and to establish, exercise or defend legal claims.

6. Cookies

We use cookies and similar technologies to make the Site work, to remember your preferences and to understand how visitors use the Site. Non-essential cookies (such as analytics and marketing cookies) are only set with your consent, which you can give or decline through our cookie banner and manage at any time. For a full description of the cookies we use and how to control them, please see our Cookie Policy.

7. Third Parties & Processors

We do not sell your personal data. We may share personal data with carefully selected third parties who process it on our behalf as data processors, or who act as independent controllers where appropriate. These include:

• Web analytics providers that help us measure and understand how the Site is used;
• Cloud hosting and infrastructure providers that host the Site and store data securely;
• Email service providers that help us send and manage communications;
• Professional advisers such as accountants, auditors and lawyers, where necessary;
• Public authorities and regulators where we are required to disclose information by law.

We require all our processors to provide appropriate guarantees that they will protect personal data in line with the GDPR, and we enter into written data processing agreements with them. Where a processor is located outside the European Economic Area (EEA), we ensure an appropriate transfer mechanism is in place, such as the European Commission's Standard Contractual Clauses (SCCs). See section 10 below.

8. Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting or reporting requirements. The applicable retention period depends on the nature of the data and the purpose of processing:

• Contact form and enquiry data is generally retained for up to 24 months after our last meaningful interaction, unless a client relationship is established;
• Client and engagement records, including invoices and accounting documents, are retained for the periods required under Bulgarian tax and accounting legislation (typically up to 10 years);
• Analytics data is retained for the period configured with our analytics providers, after which it is deleted or aggregated;
• Marketing consent records are retained for as long as you remain subscribed and for a reasonable period afterwards to evidence consent.

When personal data is no longer required, we securely delete or anonymise it.

9. Your Rights as a Data Subject

Under the GDPR (Articles 15–22), you have the following rights in relation to your personal data:

• Right of access (Art. 15). You can request confirmation of whether we process your personal data and obtain a copy of it, together with information about how we use it.
• Right to rectification (Art. 16). You can ask us to correct inaccurate personal data and to complete incomplete data.
• Right to erasure (Art. 17). You can ask us to delete your personal data where there is no good reason for us to continue processing it ("the right to be forgotten").
• Right to restriction of processing (Art. 18). You can ask us to suspend the processing of your personal data in certain circumstances.
• Right to data portability (Art. 20). Where processing is based on consent or a contract and carried out by automated means, you can ask to receive your data in a structured, commonly used, machine-readable format, or to have it transmitted to another controller.
• Right to object (Art. 21). You can object to processing based on our legitimate interests, and you can object at any time to processing of your data for direct marketing purposes.
• Right to withdraw consent. Where we rely on your consent, you can withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at privacy@tiltorbit.com. We will respond to your request within one month, as required by the GDPR. There is normally no fee, although we may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive. We may need to verify your identity before fulfilling your request.

10. International Transfers

Your personal data is primarily processed within the European Economic Area. However, some of our service providers may process personal data in countries outside the EEA. Where we transfer personal data outside the EEA, we ensure it is protected by appropriate safeguards, such as:

• transfers to countries that the European Commission has determined provide an adequate level of protection (an "adequacy decision"); or
• the use of the European Commission's Standard Contractual Clauses (SCCs), together with any supplementary measures required to ensure an essentially equivalent level of protection.

You may request a copy of the safeguards we have put in place by contacting privacy@tiltorbit.com.

11. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include access controls, encryption in transit, secure hosting, regular backups, and staff confidentiality obligations. While we take security seriously, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals without undue delay.

12. Children's Privacy

The Site and our services are intended for businesses and adults. We do not knowingly collect personal data from children under the age of 16. If you believe that a child has provided us with personal data, please contact us at privacy@tiltorbit.com and we will take steps to delete it.

13. Complaints

If you have any concerns about how we handle your personal data, we encourage you to contact us first at privacy@tiltorbit.com so that we can try to resolve the matter. You also have the right to lodge a complaint with the Bulgarian supervisory authority:

Commission for Personal Data Protection (Комисия за защита на личните данни / CPDP)
2 Prof. Tsvetan Lazarov Blvd
Sofia 1592, Bulgaria
Website: cpdp.bg

If you are located in another EU/EEA country, you may also lodge a complaint with the supervisory authority in your country of residence or place of the alleged infringement.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements or for other operational reasons. When we make changes, we will revise the "Last updated" date at the top of this Policy. Where changes are significant, we will provide a more prominent notice. We encourage you to review this Policy periodically.

15. Contact Us

If you have any questions, requests or concerns about this Privacy Policy or our processing of your personal data, please contact us:

TiltOrbit OOD
ul. Tsar Ivan Shishman 23, 1000 Sofia, Bulgaria
Telephone: +359 2 491 7820
Privacy enquiries: privacy@tiltorbit.com
General enquiries: hello@tiltorbit.com