Privacy policy
In short:
- We collect what you send us and what the site needs to run.
- We use it to answer you, and for analytics and ads only if you say yes.
- We never sell it, and you can ask us to delete it at any time.
Who we are
Buxten EOOD (Бъкстен ЕООД), Sofia, Bulgaria ("Buxten", "we") is the controller of the personal data described here. Buxten runs buxten.com, the Regoria compliance product and Buxten consulting.
Questions about privacy: info@buxten.com.
What we collect
- Enquiries. What you send through our forms: your name, work email, company, type of firm, where you are regulated and, if you choose, the text of a clause. Please leave out names and confidential details; we will send an NDA first if you ask.
- Campaign information. If you arrived from one of our ads or links, the campaign tags in that link (for example utm_source) and the page section you landed on are attached to your enquiry.
- Correspondence. Emails you send us and our replies.
- Technical data. Our hosting provider records standard server logs, including IP addresses, to deliver the site and keep it secure.
- Cookies and similar storage. Only as described in our cookie policy, and only with your consent where the law requires it.
Documents you share with Regoria as a customer are handled under your customer agreement and data processing agreement, not this policy.
Why we use it and our legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to your enquiry, arranging a call or a first verdict | Steps you asked for before a contract, Art. 6(1)(b) |
| Following up with a business contact about our services | Our legitimate interests, Art. 6(1)(f). You can object at any time. |
| Keeping the site secure and working | Our legitimate interests, Art. 6(1)(f) |
| Cookieless visit counts (Plausible) | Our legitimate interests, Art. 6(1)(f) |
| Cookie-based analytics and measuring our advertising | Your consent, Art. 6(1)(a), given through the cookie banner |
| Keeping records we are required to keep | Legal obligation, Art. 6(1)(c) |
We do not sell personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.
Who we share it with
Only with service providers that process data for us under contract:
- Netlify: website hosting and form submissions.
- Plausible Analytics (EU-hosted): counts page visits and button clicks without cookies and without storing personal data, so it runs without a cookie choice.
- Google Workspace: email.
- Advertising and analytics providers, only if you consent to those cookies. They are named in our cookie policy once enabled.
Some providers are based in the United States. Where data leaves the EEA, we rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
How long we keep it
- Enquiries that do not lead to a contract: up to 24 months after our last contact, then deleted.
- Customer correspondence: for the length of the relationship and as long as the law requires afterwards.
- Server logs: for the period set by our hosting provider, normally a few weeks.
- Your cookie choice: 180 days, then we ask again.
Your rights
Under the GDPR and, for UK visitors, the UK GDPR, you can:
- ask for a copy of your data (access, Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data deleted (Art. 17);
- have processing restricted while a question is resolved (Art. 18);
- receive the data you gave us in a machine-readable format (Art. 20);
- object to processing based on our legitimate interests, and to direct marketing at any time (Art. 21);
- withdraw consent at any time, without affecting earlier processing. For cookies, use Cookie settings.
Email info@buxten.com to use any of these rights. We reply within one month.
Security
We use access controls, encryption in transit and providers with recognised security practices. No system is perfectly secure, so please do not send confidential policy text through the open form; ask for an NDA first.
Complaints
Our supervisory authority is the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, cpdp.bg. You can also complain to the authority where you live or work, or, in the UK, to the Information Commissioner's Office (ICO).
Changes to this policy
We will update this page when our practices change and show the new date at the top.