Privacy notice.Clear handling of website and enquiry data.

Scope and controller

This notice applies to visitors, enquirers and authorised users of the protected enquiry area, and to personal data processed through this website, its commercial enquiry form and related correspondence. Water Stone Ltd., a company registered in Bulgaria, is the controller. Privacy questions and rights requests may be sent to office@wsdefence.com. It is intended to provide the information required by Article 13 of the GDPR.

Information we collect

We collect the information you provide, including your name, organisation, work email, telephone number, country, destination market, enquiry type, capability area, programme stage, timeframe, quantity, specification, product interest and requirement description.

We also record the submission time, website source path, enquiry reference, acceptance and notification status, and limited technical or security data needed to operate the service and prevent abuse. The application stores a pseudonymous abuse-prevention key derived from network and email data rather than the raw network address in the enquiry record. Hosting, authentication and security providers may process request metadata and service logs. The form is not intended for classified, export-controlled, operationally sensitive or special-category personal data.

How we obtain it and what is required

Most information is obtained directly from you when you submit an enquiry or contact us. Where a compliance review requires it, limited information may also be obtained from your organisation or counterparties, public registers, sanctions lists, competent authorities or screening providers. Where Article 14 of the GDPR applies to information not obtained directly from you, Water Stone will provide the required information within the applicable period or through an appropriate supplementary notice. There is no statutory obligation to use the form. Fields marked as required are necessary to submit, route and assess an enquiry; without them, the form cannot be processed. Optional fields are voluntary. A proposed transaction may later require additional information or documents under applicable law, licence conditions or compliance review. Standard service and security logs may be generated automatically when the website is used.

Purposes and legal bases

Depending on the circumstances, we process personal data for the following purposes and bases:

• handling legitimate business enquiries, routing them and maintaining proportionate records under Article 6(1)(f);
• taking requested pre-contractual steps under Article 6(1)(b) only where the individual is a prospective contracting party;
• performing a concrete licensing, sanctions, export-control or record duty under Article 6(1)(c), where that duty applies;
• conducting proportionate compliance assessment where no specific legal duty applies under Article 6(1)(f);
• protecting the website, preventing abuse and maintaining service security under Article 6(1)(f); and
• establishing, exercising or defending legal claims under Article 6(1)(f).

Our legitimate interests are responding to genuine B2B requirements, directing them to the appropriate team, protecting the service and organisation, maintaining accountable records and managing legal or compliance risk. Those interests are assessed against the rights and reasonable expectations of the affected individual.

Recipients and service providers

Access is limited to authorised Water Stone personnel and, where necessary, carefully selected hosting, database, security and email-delivery providers; professional advisers, auditors and insurers; relevant manufacturers or programme partners; and competent public authorities. Information is shared only to the extent required for the stated purpose, applicable law or a properly documented requirement. We do not sell website enquiry data.

International transfers

Some infrastructure or service providers may process information outside Bulgaria or the European Economic Area. Where data protection law requires it, Water Stone uses an applicable adequacy decision, standard contractual clauses or another recognised transfer mechanism together with proportionate supplementary safeguards. Contact office@wsdefence.com for information about the applicable safeguard or a copy, subject to permitted redactions.

Retention and security

Enquiry information is retained for the period needed to assess and close the request, manage any resulting relationship, establish or defend claims and meet applicable legal duties. If an enquiry becomes part of a regulated transaction or compliance file, the relevant records may be retained for at least ten years where Bulgarian defence-product record-keeping requirements apply. Security logs, authentication records and backups are kept according to proportionate operational and provider retention cycles.

Retention is reviewed against those purposes and criteria, and information is deleted or anonymised when no longer required. We apply access controls and proportionate organisational and technical safeguards, but no internet service can guarantee absolute security.

Your data-protection rights

Subject to the conditions in applicable law, you may request access, rectification, erasure, restriction, data portability or object to processing based on legitimate interests. You may also withdraw consent where consent is the legal basis. Contact office@wsdefence.com and include the enquiry reference where available. We may request information needed to verify identity before acting on a request.

Complaints

You may lodge a complaint with the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria; kzld@cpdp.bg; complaint guidance, or with another competent supervisory authority where applicable. You may contact Water Stone first, but doing so is not a condition of contacting a supervisory authority.

Automated validation and decisions

Automated validation and abuse controls may reject or delay a submission; an email route remains available. Commercial and compliance decisions receive human review, and website enquiries are not subject to solely automated decisions producing legal or similarly significant effects. Website enquiry information is not used for unrelated marketing. The protected administration area may use technologies strictly necessary for authentication, security and service operation.

Website analytics and consent

Water Stone Ltd. is the controller for website analytics. With your consent under Article 6(1)(a) GDPR and the applicable rules on storing or accessing information on your device, we use Google Analytics 4 (GA4), provided by Google Ireland Limited, to understand how visitors use the website and to measure successful enquiry submissions. Analytics is not loaded and no analytics data is sent to Google unless you consent. Refusing analytics does not affect access to the public website or enquiry form. We do not use GA4 for advertising, remarketing, Google Signals or advertising personalisation.

When enabled, GA4 may process a pseudonymous client identifier, page path and title, referral source, page views and interaction events, approximate location derived from the IP address, and browser, device, operating-system, language and screen information. Google states that, for users in the European Union, the IP address is used at collection to derive approximate location and is discarded before Analytics logs the data. We do not intentionally send names, email addresses, telephone numbers, enquiry text, uploaded content or enquiry reference numbers to GA4.

GA4 uses first-party cookies such as _ga and _ga_<container-id> to distinguish visitors and maintain session state; Google gives these cookies a default expiry of up to two years. We use local storage to remember your analytics choice. User-level and event-level Analytics data are configured for a two-month retention period; aggregated reports may remain available for longer. Strictly necessary technologies may be used without analytics consent for authentication, security, abuse prevention and service operation.

Google Ireland Limited is an analytics service provider and recipient. Google may process data through affiliates and subprocessors outside the European Economic Area, including in the United States. Where required, transfers are protected by an applicable adequacy decision, standard contractual clauses or another recognised mechanism under Google's data-processing terms.

Your local consent choice remains until you change it, clear browser storage or a new consent version requires a fresh choice. You may refuse or withdraw consent at any time through Cookie settings in the site footer. Withdrawal stops future Analytics collection and does not affect processing already carried out on the basis of consent. Information already received by Google remains subject to the applicable retention period or an earlier deletion request.

Further information is available in the Google Privacy Policy and Google Analytics cookie information.

Updates to this notice

This notice may be updated when processing, providers or legal requirements change. The effective date and version shown above identify the notice applying at the time of an enquiry. Where required, information about a materially different further purpose will be provided before that further processing begins.