This Privacy Policy explains how Edevos EOOD, trading as Sitedote ("Sitedote", "we", "us"), collects and uses personal data when you visit sitedote.com (the "Site"), contact us or buy our WordPress security, repair and maintenance services (the "Services").
As a controller, we decide why and how we use personal data collected through our own operations: website visits, enquiries, sign-ups, orders, billing and communication with you. This Privacy Policy covers that processing.
As a processor, we handle personal data that sits inside our customers' websites while we clean, repair or maintain them. For that data, the website owner is the controller and we act on its instructions. That relationship is governed by our Data Processing Addendum and our Terms of Service, not by this Privacy Policy. If you are a visitor or customer of a website we maintain, please contact that website's owner about your data.
The legal bases refer to Article 6(1) of the GDPR and the UK GDPR: (a) consent, (b) contract or steps before a contract, (c) legal obligation, (f) legitimate interests.
| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Website visits (server logs) | IP address, browser and device type, operating system, pages visited, date and time, referrer | Keep the Site working and secure, detect abuse and attacks | (f) network and information security | Up to 12 months |
| Cookies and similar technologies | Cookie identifiers, consent choices, IP address | Site functions, remembering your choices; with consent: chat, analytics, marketing (see Cookie Policy) | (a) consent; strictly necessary cookies: (f) | As stated in the Cookie Policy; consent record 12 months |
| Traffic analysis (Google Analytics 4) | Shortened IP address, cookie ID, pages and sequence, session length, device and browser, approximate city, traffic source | Understand how the Site is used and improve it | (a) consent | Up to 14 months |
| Advertising and conversion measurement | Cookie and advertising IDs, IP address, device and browser, pages and actions on the Site, traffic source, ad clicks | Measure campaigns and show relevant ads to earlier visitors | (a) consent | Per Cookie Policy (15 minutes to 13 months) |
| Contact form and email | Name, email, phone (if given), website address, message | Reply to your enquiry and prepare a quote | (b) steps before a contract | 12 months after the last contact if no contract follows |
| Chat and support tickets | Name, email, conversation content, IP address, page you came from | Give technical support and answer questions | (b) contract or steps before a contract | 24 months after the conversation ends |
| Free site-check tool | Website address you check, your IP address, time of request | Run the check and prevent misuse of the tool | (f) providing and protecting a free tool; (b) if it leads to an order | 6 months |
| Free report | Name, email, website address, analysis results | Prepare and send the report | (b) | 12 months after sending |
| Account and client profile | Name, email, phone, address; for companies also company name, registration and VAT number, representative | Create and manage your account and give you access to the Services | (b) | While the account exists and 12 months after closure |
| Orders, payments and invoices | Order details, amount, date, transaction ID, billing data | Perform the contract, issue invoices, keep accounts, prevent fraud | (b), (c) accounting law, (f) fraud prevention | As required by Bulgarian accounting and tax law |
| Access credentials you give us | Usernames and passwords for hosting, SFTP/SSH, admin panels | Perform the requested work | (b) | Up to 30 days after a one-time service; until the end of the contract for ongoing services |
| Backups of your website | Website content, which may include personal data (we act as processor) | Restore your site after a compromise or failure | (b), see our DPA | Per your plan; deleted after the contract ends |
| Marketing emails | Name, email | Send news, offers and security tips | (a) consent; for existing customers (f) | Until you withdraw consent or object |
We do not keep payment card numbers. Card payments are handled by Stripe, which receives your card data directly, and we only see the result of the transaction. Passwords for your Sitedote account are stored in encrypted form.
Where the data comes from. Mostly from you, through forms, sign-up, orders and messages, and automatically from your visit to the Site. If a web agency, freelancer or hosting provider orders Services for you and acts as your representative, we receive your data from them, and we may ask them to confirm their authority.
Special categories. We do not intentionally collect data about race or ethnic origin, political or religious beliefs, trade union membership, genetic or biometric data, health, or sex life. If such data is in a website we maintain, we process it only as a processor and only on the website owner's instructions. The website owner must tell us in advance.
4.1 Consent tool. We use Cookiebot (Usercentrics A/S, Denmark) to ask for and record your cookie choices. You can change or withdraw them at any time through the cookie settings link on the Site. The full list of cookies and similar technologies is in our Cookie Policy.
4.2 Analytics. With your consent we use Google Analytics 4 (Google Ireland Limited). It uses your IP address while collecting data and deletes it before the data is stored. It does not use the data for automated decisions about you.
4.3 Advertising. With your consent to marketing cookies, we use Meta Pixel (Meta Platforms Ireland Limited), Google Ads (Google Ireland Limited) and Microsoft Advertising UET (Microsoft) to measure conversions and to show relevant ads to people who have visited the Site (remarketing). Google Tag Manager loads these tools only after you consent. Without your consent no advertising tracker is loaded, and the Site works normally.
4.4 Joint controllership with Meta. For data collected through Meta Pixel, we and Meta Platforms Ireland Limited are joint controllers under Article 26 GDPR for the collection and transmission of the data to Meta. Meta is the sole controller for what it does afterwards. Under Meta's controller addendum, Meta handles requests under Articles 12 to 22 GDPR and we obtain your consent. You can exercise your rights against Meta or against us.
4.5 Opt out. Besides withdrawing consent in the cookie banner, you can turn off personalised ads in your Facebook, Google Ads and Microsoft settings.
We do not sell or rent your personal data. We share it only with providers that help us run the Site and the Services, and only what they need. Each is bound by data processing terms and confidentiality.
| Recipient | What for |
|---|---|
| Upmind | Client profiles, orders and billing |
| Stripe | Card payment processing |
| Bank (for bank transfers) | Processing bank transfers |
| tawk.to inc. | Chat and support tickets |
| Cookiebot (Usercentrics A/S) | Cookie consent management |
| Google Ireland Limited | Analytics (GA4), Tag Manager, Google Ads |
| Meta Platforms Ireland Limited | Conversion measurement and remarketing (Meta Pixel) |
| Microsoft Corporation / Microsoft Ireland Operations Limited | Conversion measurement and remarketing (Microsoft Advertising UET) |
| Hosting provider | Hosting the Site and storing data |
| Email service provider | Correspondence and notifications |
| Security, monitoring and maintenance tools | Technical work on customer websites |
| Accounting firm | Bookkeeping and tax reporting |
We disclose data to public authorities only when the law requires it, and we may report suspected illegal activity to the competent authorities.
We are based in the European Economic Area (EEA) and process most data there. Some of our providers are located outside the EEA or use infrastructure there, in particular tawk.to inc., Stripe, Google, Meta and Microsoft. Where your data goes to a country without an EU adequacy decision, we rely on the safeguards in Chapter V of the GDPR:
You can ask us about the safeguards at [email protected]. If a safeguard stops being valid, we will move the processing into the EEA or use another lawful mechanism, and update this policy.
We protect personal data with technical and organisational measures: encrypted transmission, secure storage of credentials, access limited to people who need it, regular updates and an incident response procedure. No system is completely secure. If a breach is likely to put you at high risk, we will tell you without undue delay.
Even if a retention period above has ended, we may keep data that we need to establish, exercise or defend legal claims (for example orders, case correspondence, work reports and consent records) until the dispute is finally resolved or the limitation period ends. After that we delete or anonymise it.
You have the right to:
How to use them. Email [email protected]. We answer within one month; for complex or numerous requests we may extend this by up to two more months and will tell you. It is free, but for manifestly unfounded or excessive requests we may charge a reasonable fee or refuse. We may ask for information to confirm who you are, and we ask for a copy of an ID document only as a last resort.
Right controller. You exercise your rights against the controller of the data. If your data sits in a website we only maintain technically, the website owner is the controller and your request should go to them.
If you live in California or another US state with a privacy law, you may have the right to know what personal information we collect, use and disclose; to access and delete it; to correct it; to opt out of the "sale" or "sharing" of personal information and of targeted advertising; and not to be treated unfairly for exercising these rights. Some of these laws apply only to businesses above certain size or data-volume thresholds. We apply the rights below to all US customers and visitors where the law does not require otherwise.
Automated decisions. We do not make decisions based solely on automated processing that have legal effects on you or similarly significantly affect you. If you consent to marketing cookies, advertising platforms build audiences and show relevant ads. This does not have legal effects on you, is limited to advertising, and stops when you withdraw consent or object. Our free site-check tool assesses the technical state of a website, not an individual.
Children. Our Services are for adults and businesses. We do not offer them to anyone under 18 and do not knowingly collect children's data. If we learn that we have, we delete it.
Mandatory and voluntary data. Giving us data is voluntary, but some data is necessary for a contract or a service (for example, we need your email to send a report and access to your website to clean it). Consent to functional, statistical or marketing cookies is never a condition for using the Site or buying the Services.
Please contact us first at [email protected] so we can try to solve the problem together. You also have the right to complain to a supervisory authority, in particular in the country where you live or work or where you think a violation took place. Our lead authority is:
Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria. Website: cpdp.bg.
In the UK, the authority is the Information Commissioner's Office (ico.org.uk). In Switzerland, it is the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
We may update this Privacy Policy when our services, providers or the law change. The current version is always on this page with its date, and we will notify registered users by email of material changes.
This Privacy Policy is read together with:
Contact: Edevos EOOD, 68 Saedinenie Str., Shumen, Bulgaria, UIC (EIK) 205573828, [email protected].