Privacy Statement

This Statement describes how Finite Software Systems Ltd. ("the Company", "we") processes personal data of visitors to the website finite-soft.com (the "Site"). It is prepared in accordance with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act (ЗЗЛД).

1. Controller identity and contact

The controller of personal data processed through the Site is:

• Name: Finite Software Systems Ltd.
• Registered seat: 4 Gorotzvet Str., 1421 Sofia, Bulgaria
• Address of management: 180 Vitosha Blvd., 1408 Sofia, Bulgaria
• UIC (ЕИК): 175276896
• VAT: BG175276896
• Email for general matters: info@finite-soft.com
• Email for privacy matters: info@finite-soft.com
• GDPR data subject requests: /dsr or info@finite-soft.com
• Phone: +359 2 439 21 00 (central office)

2. Data Protection Officer

We have not designated a Data Protection Officer (DPO), as the Company does not fall under the obligation in GDPR Art. 37(1). For any privacy-related questions, please contact info@finite-soft.com.

3. Processing operations

3.1 Server logs

• Purpose: site security, abuse detection, troubleshooting, maintenance.
• Data categories: IP address, request URL, user-agent, date and time.
• Lawful basis: legitimate interest (GDPR Art. 6(1)(f)) — securing the Site against abuse.
• Recipients: internal technical team only. The Site is hosted on the Company's own infrastructure in Bulgaria; there is no third-party hosting provider.
• Retention: up to 30 days.

3.2 Contact form and info@finite-soft.com

• Purpose: respond to inquiries from visitors.
• Data categories: name, email, phone (optional), message content.
• Lawful basis: pre-contractual measures at the request of the data subject (GDPR Art. 6(1)(b)) and/or consent (Art. 6(1)(a)) for extended correspondence.
• Recipients: internal team. Email infrastructure is operated on our own servers.
• Retention: up to 12 months from the close of the conversation, unless we have entered into a continuing contractual relationship.

3.3 Job applications (jobs@finite-soft.com)

• Purpose: review of job applications.
• Data categories: data you choose to include in your application (typically: name, contact details, CV, cover letter, sometimes a photo, information on education, work experience, languages, technologies).
• Lawful basis: pre-contractual measures at the data subject's request (GDPR Art. 6(1)(b)).
• Recipients: HR and management team.
• Retention: up to 12 months from submission, unless you give explicit consent for longer retention for future positions.

3.4 Google reCAPTCHA on forms

The Site uses Google reCAPTCHA on the contact form to protect against automated abuse.

• Purpose: prevent spam and automated requests.
• Data categories: IP address, user-agent, behavioural signals in the browser (observed by the reCAPTCHA script).
• Lawful basis: legitimate interest (GDPR Art. 6(1)(f)) — protecting online forms.
• Recipients: Google LLC (USA) and Google group affiliates.
• Retention: as determined by Google's policy.
• International transfer: data is transferred to the USA; see section 5.

3.5 Google Maps on the Contact page

On /contact we embed Google Maps to show the office addresses.

• Purpose: show office locations.
• Data categories: IP address, user-agent (when the map is loaded from Google).
• Lawful basis: legitimate interest (GDPR Art. 6(1)(f)).
• Recipients: Google LLC (USA).
• Retention: as determined by Google.
• International transfer: see section 5.

3.6 Google Analytics 4 (GA4)

The Site uses Google Analytics 4 to understand how visitors use the Site — only after your consent through the cookie banner.

• Purpose: understand how visitors use the Site, in order to improve it.
• Data categories: pseudonymous identifier, page/event, time, device and browser information, approximate geography (city/country level).
• Lawful basis: consent (GDPR Art. 6(1)(a)), withdrawable at any time via the "Cookie settings" link in the footer.
• Recipients: Google LLC (USA).
• Retention: as configured in GA4 (default 14 months).
• International transfer: see section 5.

3.7 Cookies and similar technologies

For a full description of cookies and similar technologies, see the Cookie Policy.

4. Recipients and processors

Categories of recipients:

• Internal team of Finite Software Systems Ltd. — for all internal processing.
• Google LLC (USA) — for reCAPTCHA, Google Maps, and Google Analytics 4.

We do not share personal data with any other third party except:

• with your explicit consent;
• where the transfer is necessary to perform a contract with you;
• where required by a competent authority under Bulgarian or EU law.

The Site does not use a third-party hosting provider, third-party email provider, third-party CDN for JavaScript or fonts, or any analytics platform other than those disclosed above.

5. International transfers

When you use Google services (reCAPTCHA, Maps, Analytics) on the Site, your personal data is transferred to Google LLC in the USA.

Such transfers are protected by:

• Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on adequacy under the EU-U.S. Data Privacy Framework (DPF). Google is DPF-certified and the transfer relies on the adequacy mechanism.
• For recipients that are not DPF-certified, we apply Standard Contractual Clauses (SCC) under Commission Decision 2021/914.

You can review Google's DPF certification at dataprivacyframework.gov.

6. Retention periods

After expiry, data is deleted or anonymized within a reasonable period.

7. Your rights

Under the GDPR you have the following rights regarding your personal data:

• Information and access (Art. 15): obtain confirmation and a copy of your data.
• Rectification (Art. 16): correction of inaccurate or incomplete data.
• Erasure ("right to be forgotten", Art. 17) in the cases listed in the GDPR.
• Restriction of processing (Art. 18) in specific cases.
• Portability (Art. 20): receive your data in a structured, commonly-used, machine-readable format.
• Objection (Art. 21): to processing based on legitimate interest.
• Withdraw consent (Art. 7(3)) at any time, without affecting prior lawful processing.
• Lodge a complaint with the Bulgarian Commission for Personal Data Protection (KZLD, kzld.bg) and the right to an effective judicial remedy.

To exercise these rights, see the Data Subject Request page.

8. Statutory or contractual requirement

Providing personal data through the Site is not a statutory or contractual obligation. You are free to withhold data — but without the necessary data we will not be able to respond to an inquiry, review a job application, or provide certain Site functions.

9. Automated decision-making

We do not perform automated decision-making, including profiling, which produces legal effects for you or significantly affects you (GDPR Art. 22).

10. Source of data

Personal data is collected directly from you. Exceptions:

• IP address and user-agent are collected automatically on visit.
• For reCAPTCHA, Google Maps, and Google Analytics 4, additional data is collected by Google according to its policy at policies.google.com/privacy.

11. Changes to this Statement

We may update the Statement from time to time. The current version is always available on this page, with the "last updated" date shown at the bottom.

For material changes that affect your rights, we will notify you appropriately (for example with a banner on the Site).

12. Translation

The Statement is published in Bulgarian and English. In case of discrepancy between the two versions, the Bulgarian version prevails.

13. Contact

Questions about this Statement and exercise of rights:

• Email: info@finite-soft.com
• GDPR requests: /dsr
• Postal: Finite Software Systems Ltd., 4 Gorotzvet Str., 1421 Sofia, Bulgaria

Last updated: 27 April 2026

Last updated: 2026-04-27 · Version 1.0.0