Privacy notice

Last updated: 21 October 2026

Who is responsible

The controller of your personal data is:

Company

SCA Consulting Ltd., trading as NEXWRKS

Address

Atanas Dalchev 10, 1000 Sofia, Bulgaria

VAT number

BG207126847

Contact

[email protected]

What we collect

• Enquiries. When you use the challenge or partner form, or email us: your name, company, email address, and anything else you choose to give, such as phone number, industry, location, website or a description of your requirement or capabilities.
• Security data. To protect the forms from spam and abuse, the form uses Cloudflare Turnstile, which checks signals from your browser and your IP address. We keep a one-way hashed version of the IP address, changed daily, to limit repeated submissions. We do not store the IP address itself.
• Hosting data. Our hosting provider processes technical data such as IP address and request details to deliver and protect the website.

Please do not send drawings, CAD files, confidential specifications or other sensitive information through the website. If they are needed, we arrange a secure exchange under a non-disclosure agreement.

Why we use it, and on what legal basis

• To reply to your enquiry and discuss a possible project or cooperation: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in responding to business enquiries (Article 6(1)(f) GDPR).
• To keep the website and forms secure and free of spam: our legitimate interest in protecting our systems (Article 6(1)(f) GDPR).

We do not sell your data, use it for advertising, or add you to a mailing list.

Cookies and analytics

This website does not use analytics, advertising or tracking cookies, and does not load third-party tracking scripts. The only third-party script is the Cloudflare Turnstile security check on the form pages.

Who receives it

We use service providers who process data on our behalf, under data processing terms:

• Cloudflare, Inc.: website hosting, security check (Turnstile) and storage of a backup copy of enquiries.
• Our email delivery provider: to send the enquiry to our inbox.
• Our email hosting provider: where our inbox and replies are kept.

Some of these providers may process data outside the European Economic Area. Where they do, the transfer is covered by an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework) or by standard contractual clauses.

How long we keep it

Enquiries and related correspondence are kept for up to 3 years after our last contact with you, then deleted, unless they become part of a contract, in which case statutory retention periods for business records apply. The hashed security data is deleted together with the enquiry it belongs to.

Your rights

You have the right to access, correct or delete your personal data, to restrict or object to its processing, and to receive it in a portable format. To use any of these rights, email [email protected].

You can also complain to the Bulgarian supervisory authority, the Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg, or to the authority in the EU country where you live or work.

Changes

If this notice changes, the new version is published on this page with a new date. Company details are in the imprint.