Privacy Policy and Personal Data Protection Notice

Version: 1.0
Last updated: 24 October 2026

This Privacy Policy explains how ВИВАН ХЕЛТ ПРОДЖЕКТС ООД (Vivan Health Projects Ltd.) ("we", "us", "our"), collects, uses, and protects your personal data when you visit our corporate website https://vivanheltprodjekts.com/ (including its English and Bulgarian pages), when you submit an offer request, when you interact with our AI chat assistant on the website, and when you contact us through our official business channels on Facebook Messenger and WhatsApp Business.

This document is prepared in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), the Bulgarian Personal Data Protection Act (ЗЗЛД), the Bulgarian Electronic Commerce Act (ЗЕТ), and Regulation (EU) 2024/1689 (the EU Artificial Intelligence Act).

1. Who is the Data Controller?

The data controller is:

• Name: ВИВАН ХЕЛТ ПРОДЖЕКТС ООД (Vivan Health Projects Ltd.)
• Company ID (EIK): 204317046
• VAT number: BG204317046
• Registered address: Sofia 1000, Sveta Troitsa, bl. 376, ent. G, fl. 2, ap. 76, Bulgaria
• Managers: Viktoria Aleksandrova Aleksieva and Valentin Ivanov Kirilov
• Contact email for privacy and data protection inquiries: valentin.kirilov@vivanheltprodjekts.com
• Website: https://vivanheltprodjekts.com/

We are not required to appoint, and have not appointed, a formal Data Protection Officer (DPO) under Article 37 GDPR. For any questions regarding your personal data or to exercise your rights, please write directly to the email address above.

2. Scope of this Policy and Distinction from Our Software Products

1. When this policy applies: This policy applies where we act as an independent data controller for visitors to vivanheltprodjekts.com, for prospective clients requesting an offer or contacting us about our services (websites, web and mobile apps, KPI dashboards, AI assistants, AI agent departments, SEO, and website care), and for users who message our AI assistant or team via the website chat, Facebook Messenger, or WhatsApp Business.
2. Our standalone software products: Our standalone software products — SnapReceipt (https://snapreceipt.net), Taskinger (https://taskinger.app), and Mamino (https://mamino.app) — are governed by their own dedicated Privacy Policies and Terms of Service published on their respective domains.
3. Where we act as a Data Processor for business clients (Article 28 GDPR): When we build, host, or maintain a website, software application, or AI assistant for a business client (such as a medical or dental clinic or a company), our client is the data controller for its customers' or patients' personal data, and Vivan Health Projects acts as a data processor under a written Data Processing Agreement pursuant to Article 28 GDPR.

3. What Personal Data We Collect, Why, and on What Legal Basis

The website vivanheltprodjekts.com has no user accounts, no login area, and no visitor database. We process only the following categories of data depending on how you interact with us:

3.1. Offer Requests (via the website form or the chat assistant) and Direct Business Correspondence

• What data we process:
  • Your name (required field, up to 120 characters);
  • Email address and/or phone number (you must provide at least one reply channel — email or phone — depending on your chosen contact preference; the other is optional);
  • Company or organisation name (optional, up to 160 characters);
  • Selected services, indicative timeline, preferred contact method (email, phone, or either), and optional project description;
  • Technical metadata attached to the submission: website language (EN or BG), whether the request was sent from the chat assistant's lead card, and the exact timestamp of your consent.
• How the request is handled technically: When you press send, your browser submits the form fields to our serverless function in the European Union (Belgium, europe-west1), which formats them into a single email sent to our company mailbox (valentin.kirilov@vivanheltprodjekts.com). The website does not store the submission in a database after the email is sent. To prevent automated spam, the function checks a hidden honeypot field and accepts up to 5 requests per hour from one IP address. When that limit is exceeded, the IP address is written to the function's technical log (see Section 3.4).
• Purpose: Solely to review your inquiry, contact you via your chosen channel (email or phone), discuss your requirements, and prepare a tailored written offer.
• Legal basis:
  • Article 6(1)(b) GDPR – taking steps at your request prior to entering into a contract;
  • Article 6(1)(a) GDPR – your explicit consent given when submitting the form to retain the correspondence while handling the inquiry and for up to 12 months after the last contact if no contract is concluded;
  • Article 6(1)(c) and Article 6(1)(f) GDPR – where a contract is concluded: compliance with statutory tax and accounting obligations (under the Bulgarian Accountancy Act and the Tax and Social Insurance Procedure Code) and our legitimate interest in establishing, exercising, or defending legal claims.
• Whether providing data is required (Article 13(2)(e) GDPR): Providing your name, at least one selected service, and at least one valid reply channel (email address or phone number) is necessary for us to review your request and send you an offer. Without these details, the form cannot be submitted.

3.2. Website AI Chat Assistant (vivanheltprodjekts.com)

• AI transparency disclosure (Article 50(1) of Regulation (EU) 2024/1689 – EU AI Act): The "Vivan Chat Assistant" on our website is an automated artificial intelligence system. You are clearly informed in the chat header and greeting that you are interacting with an AI assistant. It answers questions strictly from the published pages of vivanheltprodjekts.com and the official descriptions of our products. It does not provide medical, legal, or tax advice, cannot negotiate discounts, and cannot enter into binding commitments on our behalf.
• What data is processed during a chat:
  • The question you type (up to 500 characters per message), the active website language (EN or BG), and up to the last 6 turns of the current conversation in your open browser window (up to 600 characters per turn) so the assistant can understand follow-up questions.
  • Your question and conversation context are sent through our server function in the EU (europe-west1) to Google Cloud Vertex AI in the European Union (eu multi-region) (Google Gemini models and the gemini-embedding-2 semantic search model), which generates the answer on our behalf as a data processor.
• Do we store the conversation?
  • No. We do not store your chat conversations in a database, and Google Cloud (Vertex AI) does not use your questions or the assistant's answers to train its models. For answered turns, our server logs record only anonymous operational counters (language, number of retrieved page chunks, model ID, and response time in milliseconds), without the conversation text and without your IP address.
  • Single exception (unanswered questions / gap log): When the assistant cannot answer a question from the published pages, we log only that single question (truncated to 200 characters) in Google Cloud Logging for up to 30 days so that we can add the missing answer to our website. Before logging, our code automatically strips email addresses ([email]), web links ([link]), and any sequence of 6 or more digits such as phone numbers or company/personal IDs ([number]). Please note that if you type a person's name in plain words inside your question, it may remain in that log entry until it is automatically deleted after 30 days; therefore, please do not enter personal, confidential, or medical data into the chat.
• Per-IP rate limiting: Your IP address is checked only transiently in the server function's memory (up to 20 questions per hour per IP) to prevent abuse and protect the daily inquiry cap. We do not log your IP address alongside chat questions (for Google Cloud's standard infrastructure logs, see Section 3.4 below).
• Legal basis:
  • Article 6(1)(b) GDPR – taking pre-contractual steps at your request when you ask about our services, pricing, and terms;
  • Article 6(1)(f) GDPR – our legitimate interest in providing accurate automated answers about our services, improving our website pages based on contact-scrubbed unanswered questions (kept for up to 30 days), and protecting the service against abuse.

3.3. Communication and AI Assistant on Facebook Messenger and WhatsApp Business (from November 2026)

When you message us on the official Vivan Health Projects page on Facebook Messenger or on our WhatsApp Business number:

• How the channel works and AI transparency (Article 50(1) of Regulation (EU) 2024/1689):
  • The same Vivan AI assistant (powered by Google Cloud Vertex AI in the European Union) replies in these channels and clearly informs you in its first reply that you are speaking with an AI assistant.
  • The assistant answers inquiries about our services, prices, and terms within Meta's standard 24-hour customer service window after you message us.
  • Human handoff (Human-in-the-loop): When the assistant has no answer to your question, or when you write that you want to talk to a person (for example "human"), it tells you that a person from our team will reply and creates an internal task for our team.
• What personal data we receive and process via the Meta platform:
  • On Facebook Messenger: your Page-Scoped User ID (PSID), the text of the messages you send, and the ID of each message.
  • On WhatsApp Business: your phone number, the text of the messages you send, and the ID of each message.
  • We do not read or store your Facebook or WhatsApp profile name. To messages that are not text (photos, voice messages), the assistant replies that it accepts text only.
• Where and how Messenger and WhatsApp data is stored:
  • While the AI assistant answers automatically, the message is processed via our EU server function (europe-west1) and Google Cloud Vertex AI in the EU (eu), without being used to train AI models. Message IDs (so that we never answer the same message twice) and the last 6 turns of the conversation (for context) are kept only in the server function's memory, for up to 24 hours after your last message, and are lost when the function restarts. They are not written to a database.
  • When a conversation is handed over to a person on our team, the channel, your ID (Messenger PSID or WhatsApp phone number), the time, the reason for the handoff, and the last 6 turns of the conversation are recorded as an internal task for our team in our task management system (Taskinger, hosted on Google Cloud / Firebase in the European Union), and the thread remains visible in our official Meta business inbox so our team can reply to you.
  • We do not send unsolicited marketing messages outside the 24-hour customer service window following your inquiry, unless you have given prior explicit opt-in consent.
• Purpose and legal basis:
  • Article 6(1)(b) GDPR – answering your inquiry and taking steps at your request prior to entering into a contract;
  • Article 6(1)(f) GDPR – our legitimate interest in responding promptly to inquiries through the messaging channels our prospective clients choose to use;
  • Article 6(1)(a) GDPR – your explicit consent, if you opt in to receive follow-up notifications outside an active inquiry.

3.4. Technical Security Logs and Anonymous Cookieless Campaign Measurement (UTM)

• Hosting and server function security logs: Our website and serverless functions are hosted in the European Union (Belgium, europe-west1) on Firebase Hosting and Cloud Functions provided by Google Ireland Ltd. As with any web server, when you load a page or call a function, Google's infrastructure automatically records your IP address, request timestamp, requested URL path, HTTP status code, and browser/device information (User-Agent) in technical logs for up to 30 days.
  • Purpose and legal basis: Ensuring network and information security, preventing abuse (DDoS, automated attacks), and troubleshooting, based on Article 6(1)(f) GDPR (legitimate interest pursuant to Recital 49 GDPR).
• Anonymous cookieless campaign measurement (UTM counter): When you visit our website via a link from one of our articles or social media posts carrying standard campaign parameters (utm_source, utm_medium, utm_campaign, utm_content), we increment only an aggregated anonymous daily counter (by UTC date and the campaign parameters, in Firebase Firestore in the EU). This counter does not set or read any cookies or device storage, does not record your IP address, User-Agent, or any unique identifier in the counter database, and does not profile visitors (while Google Cloud's standard 30-day technical security logs described above are never used for marketing analytics or linked to the campaign counter).

4. Cookies and Local Storage on Your Device (Article 4a of the Electronic Commerce Act)

The website vivanheltprodjekts.com does not use advertising, marketing, analytics, or tracking cookies, and does not load third-party tracking pixels or scripts. For that reason, we do not interrupt your visit with a tracking cookie banner.

Only the following strictly necessary technical items are stored in your browser (sessionStorage, which is cleared when you close the tab):

1. Light or dark theme preference (vivan-theme): Stores only your chosen visual theme (light or dark) when you click the theme switch so your choice persists across pages.
2. Whether the intro animation and the chat assistant's start screen have already been shown (vivan-intro-seen, asst-booted): So that they do not repeat on every page.

The chat conversation itself is not stored in your browser: it lives only in the memory of the open page and is gone when you reload the page or move to another one.

Under Article 4a(4) of the Bulgarian Electronic Commerce Act (ЗЕТ) (transposing Article 5(3) of Directive 2002/58/EC), this local storage is strictly necessary to provide features you explicitly request and is never used for tracking. You can clear your browser's local storage at any time through your browser settings.

5. Data Recipients, Processors (Article 28 GDPR), and International Transfers

We do not sell, rent, or share your personal data with third parties for their own marketing or advertising purposes.

To operate the website and messaging channels, we use the following data processors under written agreements pursuant to Article 28 GDPR, acting strictly on our instructions:

1. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland):
   • Role: Cloud infrastructure provider in the European Union — Firebase Hosting, Cloud Functions (europe-west1, Belgium), Cloud Firestore in the EU (for internal team tasks and the anonymous campaign counter), Google Cloud Vertex AI in the eu multi-region (for the AI chat assistant), and Google Workspace (for our company email valentin.kirilov@vivanheltprodjekts.com).
   • Location and transfer safeguards: Server functions and Vertex AI models run in European Union data centres (europe-west1 and the eu multi-region). Where incidental support access outside the EEA by Google LLC (USA) may occur, it is covered by the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR) and Google LLC's certification under the EU-U.S. Data Privacy Framework (Article 45 GDPR).
2. Resend, Inc. (2261 Market Street #5039, San Francisco, CA 94114, USA):
   • Role: Transactional email delivery provider that delivers the email to our company mailbox when you submit the offer request form on the website.
   • International transfer safeguard: The transfer of form submission data to Resend in the United States is governed by a Data Processing Addendum (DPA) incorporating the European Commission's Standard Contractual Clauses (SCCs) under Article 46(2)(c) GDPR.
3. Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) and Meta Platforms, Inc. (1 Meta Way, Menlo Park, CA 94025, USA):
   • Role: Applicable only when you choose to message us via Facebook Messenger or WhatsApp Business. Meta routes your messages across its platform (acting as an independent data controller for your Facebook/WhatsApp account under its own privacy policies at https://www.facebook.com/privacy/policy and https://www.whatsapp.com/legal/privacy-policy-eea, and as a processor for WhatsApp Business Cloud API messages under the WhatsApp Business Data Processing Terms). We connect directly to Meta's Messenger Platform and WhatsApp Cloud API, with no intermediary.
   • International transfer safeguard: Transfers from Meta Platforms Ireland Limited to Meta Platforms, Inc. (USA) rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Article 45 GDPR) and the Standard Contractual Clauses (Article 46(2)(c) GDPR).

Apart from the processors listed above, data may be disclosed only to competent public authorities (such as the National Revenue Agency, the Commission for Personal Data Protection, or courts) when strictly required by applicable law.

6. How Long We Keep Your Personal Data

We follow the storage limitation principle (Article 5(1)(e) GDPR) and retain data only for as long as necessary for the respective purpose:

7. Your Rights under the GDPR and How to Exercise Them

Under Chapter III of the GDPR, you have the following rights, which you may exercise free of charge at any time by writing to valentin.kirilov@vivanheltprodjekts.com:

1. Right of access (Article 15 GDPR): To obtain confirmation as to whether we process your personal data and receive a copy of it.
2. Right to rectification (Article 16 GDPR): To request the correction of inaccurate data or completion of incomplete data.
3. Right to erasure – "right to be forgotten" (Article 17 GDPR): To request the deletion of your personal data where it is no longer needed for its purpose, where you withdraw your consent, or where you object to processing.
4. Right to restriction of processing (Article 18 GDPR): To request that we restrict processing while accuracy or legitimate grounds are verified.
5. Right to data portability (Article 20 GDPR): For data you provided based on consent or contract, to receive it in a structured, commonly used, and machine-readable format.
6. Right to object (Article 21 GDPR): To object at any time to processing based on our legitimate interests (Article 6(1)(f) GDPR).
7. Right to withdraw consent (Article 7(3) GDPR): Where processing is based on your consent, you may withdraw that consent at any time by emailing valentin.kirilov@vivanheltprodjekts.com, without affecting the lawfulness of processing prior to withdrawal.
8. No automated individual decision-making (Article 22 GDPR): We do not use your personal data for profiling or for automated decision-making that produces legal effects concerning you or similarly significantly affects you.

We respond to all requests without undue delay and within 1 month of receipt pursuant to Article 12(3) GDPR.

8. User Data Deletion Instructions (including for Facebook Messenger and WhatsApp)

In accordance with Article 17 GDPR and Meta Platforms' requirements for User Data Deletion Instructions, any user who has submitted an inquiry through our website or messaged our AI assistant or team on Facebook Messenger or WhatsApp Business can request the complete deletion of their data from the systems of Vivan Health Projects Ltd. in any of the following ways:

1. By email (direct deletion request):
   • Send an email to valentin.kirilov@vivanheltprodjekts.com with the subject line "Data Deletion Request" (or "Изтриване на лични данни").
   • Please state the channel you used to contact us: your email address, your phone number (for WhatsApp), or the name/profile from which you messaged us on Facebook Messenger.
2. Directly inside Facebook Messenger or WhatsApp:
   • Write "human" in the chat and ask for your data to be deleted. The conversation is handed to a person on our team, who carries out the request.
3. Deleting the conversation in your app:
   • You can also delete the conversation thread in your Messenger or WhatsApp app. This removes it from your device; the data we hold is deleted as described in points 1 or 2.
4. What we delete and within what timeframe:
   • Upon receiving your request, we permanently delete all records stored in our systems linked to your Page-Scoped User ID (PSID), phone number, or email address: internal team tasks in Taskinger, offer request correspondence, and messages in our business mailbox (except where a contract has been signed or an invoice issued that must be kept by law under the Bulgarian Accountancy Act).
   • Deletion is completed without undue delay, typically within 5 business days and no later than 30 calendar days from receipt of your request, after which we send you a written confirmation that your data has been erased.

9. Right to Lodge a Complaint with a Supervisory Authority

If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the competent Bulgarian supervisory authority under Article 77 GDPR and Article 38 of the Bulgarian Personal Data Protection Act:

• Commission for Personal Data Protection (CPDP / КЗЛД)
• Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
• Phone: +359 2 91 53 519; +359 2 91 53 555
• Email: kzld@cpdp.bg (complaints sent by email must be signed with a Qualified Electronic Signature – QES, submitted via the Secure Electronic Delivery System, or filed in paper form)
• Website: https://www.cpdp.bg

10. Children's Data and Special Categories of (Sensitive) Data

1. Business-to-Business (B2B) services: The website vivanheltprodjekts.com and our services are intended for businesses, medical and dental practices, and adults (18 years and older). We do not knowingly collect personal data from individuals under 18 (or under the age of 14 for digital consent under Article 25c of the Bulgarian Personal Data Protection Act). If we become aware that such data has been submitted without basis, we delete it immediately.
2. Do not send medical or patient data through our forms or chat: Although we build software and websites for clinics and healthcare providers, the offer request form and the chat assistant on vivanheltprodjekts.com (as well as our Messenger and WhatsApp channels) are strictly for business inquiries. Please do not submit health data, medical records, patient information, or any other special category data under Article 9 GDPR through these channels.

11. Language and Changes to This Privacy Policy

1. This Privacy Policy is published in Bulgarian (https://vivanheltprodjekts.com/bg/privacy/) and English (https://vivanheltprodjekts.com/privacy/) with identical meaning. In the event of any discrepancy in interpretation between the two language versions, the Bulgarian version prevails.
2. Whenever our data processing practices, technologies, or legal requirements change, we update this page and display the new version number, effective date, and a summary of changes at the top of the document.