1. Introduction

This Privacy Policy describes how 10ATA LTD, company identification number (EIK) 208901696, with registered address at 12 Matei Staikov St, Sopot 4330, Bulgaria (“we”, “us”, “our”) processes personal data of users of the Maistorlak platform.

This Policy applies to the website, applications, user accounts, communications, orders, payments, reviews, and related services we provide.

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR), the Bulgarian Personal Data Protection Act, and applicable Bulgarian and EU law.

2. Data controller and contact details

The controller of your personal data is 10ATA LTD.

For privacy-related questions, requests, or complaints, you may contact us at [email protected] or at 12 Matei Staikov St, Sopot 4330, Bulgaria.

3. Categories of personal data we process

Depending on your role and how you use the Platform, we may process the following categories of data:

• identity and registration data, such as your name, email address, telephone number, user role, and registration or activation details;
• profile and company data, such as company profile title, description, business website, company identification number, address, activities, locations, gallery items, projects, and other information you submit;
• security data, such as hashed passwords, sessions, login logs, MFA data, and technical anti-abuse records;
• order and communication data, such as requests, orders, statuses, descriptions, replies, in-app notifications, and related operational data;
• review, rating, and report data, such as review content, ratings, reports, moderation notes, and action history;
• payment and accounting data, such as payment identifiers, amounts, currency, status, billing details, and references where needed for accounting and support;
• technical data, such as IP address, browser and device type, language, logs, cookies, usage information, and diagnostics;
• marketing and communication preferences, such as consent records, opt-outs, notification preferences, and newsletter-related data.

4. Data we do not directly store

When you pay through Stripe, card and payment instrument data is processed directly by Stripe. We do not normally store full card numbers or CVV codes.

We typically receive only limited payment information such as transaction identifiers, status, amount, currency, and billing or contact details where needed for support, accounting, refunds, or fraud prevention.

5. Why we use personal data

We use personal data to:

• create and maintain user accounts and company profiles;
• connect customers and contractors and process requests, orders, statuses, and reviews;
• provide security, abuse prevention, auditability, and technical support;
• send mandatory service notifications and, where permitted, selected marketing communications;
• process payments, issue accounting documents, and manage refunds;
• moderate content, review reports, and enforce our Terms of Use;
• improve functionality, measure usage, and develop the product.

6. Legal bases under the GDPR

We process personal data on one or more of the following legal bases:

• performance of a contract or steps prior to entering into a contract, for account creation, orders, notifications, payments, and profile features;
• legal obligation, for accounting, tax compliance, lawful responses to public authorities, and retention where required by law;
• legitimate interests, for security, abuse prevention, moderation, service improvement, evidence, and protection of our rights or the rights of other users;
• consent, for non-essential cookies, certain marketing communications, and any other situations where we specifically ask for your permission.

7. Recipients and processors

We may share data with:

• hosting, infrastructure, email, analytics, and technical service providers acting on our instructions;
• Cloudflare where we use Turnstile or related tools to protect forms and flows against bots and abuse;
• Stripe and related payment subprocessors for payment handling, refunds, and anti-fraud checks;
• other Platform users to the extent necessary to provide the service, for example public profile details, reviews, or contact details at the appropriate stage of an order flow;
• lawyers, accountants, IT suppliers, and other professional advisers where needed and subject to appropriate confidentiality;
• public and regulatory authorities where required by law or necessary to protect rights and security.

8. Cookies and similar technologies

We use cookies and similar technologies for sign-in, security, language preferences, core functionality, usage measurement, and, where applicable, marketing or advertising when the required legal basis is available.

To protect certain forms and flows, we may use Cloudflare Turnstile or similar protections that process technical signals to limit automated abuse.

Where enabled and legally permitted, we may also use advertising or analytics tools such as Google AdSense, and the relevant provider may use cookies under its own policy.

More detailed information is available in the separate Cookies Policy on the Platform.

9. International transfers

Some of the providers we use may process data outside the European Economic Area.

Where that happens, we aim to rely on appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or other mechanisms permitted under the GDPR.

10. Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer period is required by law.

Account and profile data is typically kept for the lifetime of the account and for a reasonable period afterwards where needed for security, abuse prevention, or legal defence.

Payment, accounting, and certain security records may be kept for longer due to statutory, tax, audit, or evidential requirements.

When data is no longer needed, we delete it, anonymise it, or restrict access to it under our internal rules.

11. Your rights

Subject to applicable law, you have the right to:

• access your personal data;
• rectify inaccurate or incomplete data;
• request erasure where applicable;
• request restriction of processing;
• object to certain processing;
• request data portability where applicable;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with a supervisory authority.

12. Service notifications and marketing messages

Some emails and notifications are an essential part of the service, such as registration confirmations, order updates, security notices, review prompts, payment notices, moderation actions, and related operational messages. These are not ordinary marketing communications.

We send newsletters and other marketing communications only where we have the required legal basis. You may unsubscribe at any time using the method shown in the communication or the account settings where available.

13. Children

The Platform is not intended for persons under 18 years of age.

If we learn that we received personal data relating to a child in breach of applicable law, we will take reasonable steps to delete that data.

14. Complaints and supervisory authority

If you believe we process your personal data unlawfully, we encourage you to contact us first so we can try to resolve the matter quickly and in good faith.

You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection or another competent supervisory authority in the European Union.

15. Changes to this Policy

We may update this Policy where laws, providers, product functionality, or our processing practices change.

The updated version will be published on the Platform together with the new effective date.

16. Important note

This Policy is intended to reflect how Maistorlak actually operates as of the effective date. It should be reviewed periodically with qualified legal counsel, especially when adding new channels, providers, or monetisation models.