Privacy Policy - Harmonica

1. Who We Are

This Privacy Policy explains how Bio Bulgaria AD („we“, „us“, or „our“) collects, uses, and protects your personal data when you interact with us, including when you download materials from our website or sign up to receive communications from us.

For any privacy-related queries or requests, please contact us at:

Email: info@harmonica.bg

This policy applies to all personal data we collect and process as a data controller under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

2. What Personal Data We Collect

When you complete a form on our website, we may collect the following information:

• Full name

• Business email address

• Phone number

• Company name and job title

• Company size and industry

• Country or region

• Your interest in our products or services

We collect only the data necessary to provide you with the materials or services you have requested and to follow up with you appropriately.

We process the following categories of personal data:

identity data (name), contact data (business email, phone), professional data (company, , industry), technical data (IP address, device and browser information), and marketing preferences.

Data is collected directly from you via forms and indirectly via cookies and analytics providers.

3. How We Use Your Data

We use your personal data for the following purposes:

• To send you the documents or materials you have requested (e.g. our company presentation or product catalogue)

• To contact you about our products and services as part of our sales process

• To send you marketing communications, where you have given your consent

• To improve our website and understand how visitors engage with our content (via analytics tools)

We will not use your data for any purpose that is incompatible with the purposes listed above.

4. Legal Basis for Processing

We rely on the following legal bases to process your personal data:

Consent – where you have explicitly agreed to receive marketing communications from us. You may withdraw this consent at any time.
Contract performance – for fulfilling requests and supplying materials
Legitimate interests – for sales follow-up and to provide the materials or information you have requested, where we have assessed that our interests are not overridden by your rights and interests.

5. Third-Party Tools and Data Processors

We use a number of trusted third-party service providers to help us operate our business. These providers may process your personal data on our behalf, under our instruction, and are bound by data processing agreements:

• Salesforce – our customer relationship management (CRM) platform, used to manage and track communications with leads and customers.

• Mailchimp (Intuit) – our email marketing platform, used to send marketing and communications emails.

• Google Analytics – used to collect anonymised data about how visitors use our website, to help us improve it.

We do not sell your personal data to third parties, nor do we share it with any party other than those listed above and as required by law.

6. International Data Transfers

Some of our third-party service providers, including Salesforce, Mailchimp, and Google, are based in the United States or operate servers outside the EU and UK. As a result, your personal data may be transferred to and stored in countries that do not have the same data protection laws as the EU or UK.

Where such transfers occur, we ensure they are carried out in accordance with applicable data protection law, using one or more of the following safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission

• The UK International Data Transfer Agreement (IDTA)

• Adequacy decisions issued by the European Commission or the UK Secretary of State

7. How Long We Keep Your Data

We will retain your personal data for as long as you remain an active contact – that is, until you unsubscribe, withdraw your consent, or request that we delete your data.

Once you opt out or request deletion, we will remove your personal data from our active systems within 30 days.

We may retain certain minimal records (such as a record of your opt-out) for legal and compliance purposes.

Marketing contacts: retained for up to 3 years from last engagement;

CRM records for contractual relationships: retained for 10 years after contract end;

Website logs and analytics: retained for up to 26 months or anonymised sooner. We keep minimal records of opt-outs indefinitely for compliance.

8. Your Rights

Under the GDPR and UK GDPR, you have the following rights regarding your personal data:

• Right of access – you can request a copy of the personal data we hold about you.

• Right to rectification – you can ask us to correct inaccurate or incomplete data.

• Right to erasure – you can ask us to delete your personal data (the “right to be forgotten”).

• Right to restrict processing – you can ask us to limit how we use your data.

• Right to data portability – you can request your data in a structured, machine-readable format.

• Right to object – you can object to us processing your data on the basis of legitimate interests, including for direct marketing.

• Right to withdraw consent – where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at info@harmonica.bg. We will respond within one month of receiving your request.

In the event of a personal data breach we will notify the supervisory authority within 72 hours.

9. Right to Lodge a Complaint

If you are based in the EU and believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with your local supervisory authority.

If you are based in the UK, you may contact the Information Commissioner’s Office (ICO):

Website: www.ico.org.uk | Helpline: 0303 123 1113

10. Cookies

Our website uses cookies, including analytics cookies from Google Analytics. These help us understand how visitors use our site so we can improve it. Where required by law, we will ask for your consent before placing non-essential cookies on your device.

You can manage or disable cookies at any time through your browser settings.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the updated policy on our website with a revised “Last updated” date. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

Bio Bulgaria AD