Privacy Policy

Effective Date: October 1, 2025

I. INTRODUCTION

Welcome to https://neuroinsiders.com/ (the “Website”), operated by GIVE A SMART Ltd., UIC 201056559, with its registered office at: BULGARIA, Sofia, Kremikovtsi District, Botevgradsko Shose Blvd. 296, contact phone: +359 886 628 078.

By using this Website, you agree to the terms regarding the collection, use, and disclosure of your personal data in accordance with this Privacy Policy.

Please read this Privacy Policy carefully before using the Website and/or the services offered. If you have questions regarding this Privacy Policy, contact us at [email protected]. If you do not agree with any of its terms, you should not use this Website.

DATA CONTROLLER

GIVE A SMART Ltd. (hereinafter referred to as the “Controller”) is a limited liability company with UIC 201056559, having its registered office at Botevgradsko Shose Blvd. 296, Kremikovtsi District, Sofia, Bulgaria. Website: https://neuroinsiders.com/

SUPERVISORY AUTHORITY

Commission for Personal Data Protection
Address: Sofia 1592, Prof. Tsvetan Lazarov Blvd. 2
Contact: +359 2 915 3518 / 3515 / 3519
Email: [email protected]
Website: www.cpdp.bg

II. PURPOSE AND SCOPE OF THIS POLICY

1.1 The Controller is committed to protecting the personal data of Website visitors by applying all necessary standards under Regulation (EU) 2016/679 (GDPR) and Bulgarian legislation.

1.2 This Privacy Policy provides information on: – the purposes and scope of this privacy policy; – personal data collected and processed; – the purposes and legal basis for processing; – retention periods; – recipients or categories of recipients; – data transfers outside the EU; – data subjects’ rights; – updates to the policy.

III. DEFINITIONS

As per GDPR and this Policy:

· Personal Data – any information related to an identified or identifiable natural person.

· Processing – any operation performed on personal data (collection, recording, storage, etc.).

· Controller – GIVE A SMART Ltd. which determines the purposes and means of processing.

· Processor – a party processing personal data on behalf of the controller.

· Legal Basis – the lawful ground for processing under Article 6 of the GDPR.

· Consent – freely given, specific, informed and unambiguous indication of the data subject’s wishes.

IV. PRINCIPLES OF DATA PROCESSING

The Controller ensures that personal data are: – processed lawfully, fairly, and transparently; – collected for specific, explicit, and legitimate purposes; – adequate, relevant, and limited to what is necessary; – accurate and kept up to date; – stored only for as long as necessary; – processed in a manner ensuring appropriate data security.

V. DATA TYPES, PURPOSES & LEGAL GROUNDS

A. Special Categories

4.1 The Controller does not collect or process special categories of personal data (e.g. racial origin, political opinions, religion).

B. Data Collected Directly

4.2 In general, you can use the Website without revealing your identity. However, some features require specific data.

4.3 We collect and process the following:

Data Subject	Data Collected	Purpose	Legal Basis
Website Visitor (automatic)	IP, device/browser type, traffic data, visited pages, location, logs	Site improvement, analytics, IT security	Legitimate interest (Art. 6(1)(f))
Contact Form User	Name, email, phone, and message content	Responding to inquiries and communication	Legitimate interest / Pre-contractual steps (Art. 6(1)(f)/(b))
Customer	Name, surname, address, email, billing data (e.g. UIC)	Service delivery, invoicing, legal compliance	Contract / Legal obligation (Art. 6(1)(b)/(c))
Newsletter Subscriber	Email, name	Sending news, insights, marketing content	Consent (Art. 6(1)(a))

C. Automatically Collected Data (Cookies)

7.1 We use cookies. For more, please read our Cookie Policy.

VI. COOKIES

8.1 For more on how cookies are used, please see our Cookie Policy.

VII. PURPOSES OF PROCESSING

9.1 The Controller processes personal data strictly for the purposes listed above, including: – service delivery (analysis, consulting, training); – communication; – contract execution; – legal compliance (e.g. accounting); – newsletter communication (upon consent); – improving website performance.

VIII. DATA RETENTION

10.1 Inquiries: retained for one year post-communication. 10.2 Clients: accounting data retained for 10 years. 10.3 Newsletter: retained until unsubscribed. 10.4 Other: retained only as long as necessary. 10.5 Exception: data may be retained longer in case of legal/regulatory needs or claims.

IX. DATA PROVISION: VOLUNTARY OR MANDATORY

11.1 Data provision is voluntary. However, lack of data may result in: – inability to provide services or issue invoices; – inability to receive inquiries via contact forms.

X. PROCESSING METHODS

12.1 Processing may be automated or manual. 12.2 Data may be processed by the Controller or a third party processor within Bulgaria.

XI. PROFILING

13.1 Profiling refers to automated analysis of personal traits or behavior. 13.2 The Controller may conduct profiling only with explicit consent.

XII. DATA SECURITY

14.1 We implement appropriate technical and organizational measures to protect data.

· Personal data is stored on secure servers.

· Identity verification is performed before data access.

14.2 For full details on our security measures, contact [email protected].

14.3 External links: Our site may link to other websites outside our control. Their privacy practices may differ.

XIII. DATA RECIPIENTS

15.1 Data may be disclosed to: – the data subject; – authorized bodies under applicable laws (e.g. tax authorities, courts); – data processors such as accountants, IT/hosting/email service providers under confidentiality obligations.

15.2 We do not sell personal data.

XIV. DATA TRANSFERS OUTSIDE THE EU

16.1 We generally process data within the EEA. 16.2 Some service providers (e.g. Google, Brevo) may operate outside the EEA. 16.3 In such cases, data transfers are subject to: – adequacy decisions by the EU Commission; or – Standard Contractual Clauses (SCCs). 16.4 Contact us to request a copy of applicable safeguards.

XV. DATA SUBJECT RIGHTS

Under the GDPR, individuals have the right to:

· Access their data

· Rectify inaccurate data

· Erasure (“right to be forgotten”)

· Restrict processing

· Data portability

· Object to processing

· Withdraw consent

· Object to profiling

· Be informed in case of data breach

· Lodge a complaint with the data protection authority

· Seek judicial remedy

XVI. EXERCISING YOUR RIGHTS

18.1 Rights can be exercised by sending a written request to: – GIVE A SMART Ltd., Botevgradsko Shose Blvd. 296, Kremikovtsi, Sofia, or – Email: [email protected]

Requests must include: – Name and identifying details – Description of the request – Signature and date – Email for correspondence

18.2 Identity verification is required. 18.3 Responses will be provided within one month (extendable by two). 18.4 If no action is taken, the individual will be informed of the reasons and their right to lodge a complaint.

XVII. RIGHT TO OBJECT

19.1 Objection to legitimate interest: Data subjects may object to processing based on legitimate interests. The Controller must demonstrate compelling grounds to continue.

19.2 Objection to direct marketing: Data subjects can object at any time. Processing will be stopped immediately.

XVIII. POLICY CHANGES

20.1 This Privacy Policy may be updated. When this happens, the new version will be published with an updated “Effective Date.” Please review periodically.

XIX. CONTACT

For questions about this Privacy Policy or to exercise your rights, contact us at [email protected] or call +359 886 628 078.