Privacy notice.Clear handling of website and enquiry data.

Scope and controller

This notice applies to visitors, enquirers and authorised users of the protected enquiry area, and to personal data processed through this website, its commercial enquiry form and related correspondence. Water Stone Ltd., a company registered in Bulgaria, is the controller. Privacy questions and rights requests may be sent to office@wsdefence.com. It is intended to provide the information required by Article 13 of the GDPR.

Information we collect

We collect the information you provide, including your name, organisation, work email, telephone number, country, destination market, enquiry type, capability area, programme stage, timeframe, quantity, specification, product interest and requirement description.

We also record the submission time, website source path, enquiry reference, acceptance and notification status, and limited technical or security data needed to operate the service and prevent abuse. The application stores a pseudonymous abuse-prevention key derived from network and email data rather than the raw network address in the enquiry record. Hosting, authentication and security providers may process request metadata and service logs. The form is not intended for classified, export-controlled, operationally sensitive or special-category personal data.

How we obtain it and what is required

Most information is obtained directly from you when you submit an enquiry or contact us. Where a compliance review requires it, limited information may also be obtained from your organisation or counterparties, public registers, sanctions lists, competent authorities or screening providers. Where Article 14 of the GDPR applies to information not obtained directly from you, Water Stone will provide the required information within the applicable period or through an appropriate supplementary notice. There is no statutory obligation to use the form. Fields marked as required are necessary to submit, route and assess an enquiry; without them, the form cannot be processed. Optional fields are voluntary. A proposed transaction may later require additional information or documents under applicable law, licence conditions or compliance review. Standard service and security logs may be generated automatically when the website is used.

Purposes and legal bases

Depending on the circumstances, we process personal data for the following purposes and bases:

• handling legitimate business enquiries, routing them and maintaining proportionate records under Article 6(1)(f);
• taking requested pre-contractual steps under Article 6(1)(b) only where the individual is a prospective contracting party;
• performing a concrete licensing, sanctions, export-control or record duty under Article 6(1)(c), where that duty applies;
• conducting proportionate compliance assessment where no specific legal duty applies under Article 6(1)(f);
• protecting the website, preventing abuse and maintaining service security under Article 6(1)(f); and
• establishing, exercising or defending legal claims under Article 6(1)(f).

Our legitimate interests are responding to genuine B2B requirements, directing them to the appropriate team, protecting the service and organisation, maintaining accountable records and managing legal or compliance risk. Those interests are assessed against the rights and reasonable expectations of the affected individual.

Recipients and service providers

Access is limited to authorised Water Stone personnel and, where necessary, carefully selected hosting, database, security and email-delivery providers; professional advisers, auditors and insurers; relevant manufacturers or programme partners; and competent public authorities. Information is shared only to the extent required for the stated purpose, applicable law or a properly documented requirement. We do not sell website enquiry data.

International transfers

Some infrastructure or service providers may process information outside Bulgaria or the European Economic Area. Where data protection law requires it, Water Stone uses an applicable adequacy decision, standard contractual clauses or another recognised transfer mechanism together with proportionate supplementary safeguards. Contact office@wsdefence.com for information about the applicable safeguard or a copy, subject to permitted redactions.

Retention and security

Enquiry information is retained for the period needed to assess and close the request, manage any resulting relationship, establish or defend claims and meet applicable legal duties. If an enquiry becomes part of a regulated transaction or compliance file, the relevant records may be retained for at least ten years where Bulgarian defence-product record-keeping requirements apply. Security logs, authentication records and backups are kept according to proportionate operational and provider retention cycles.

Retention is reviewed against those purposes and criteria, and information is deleted or anonymised when no longer required. We apply access controls and proportionate organisational and technical safeguards, but no internet service can guarantee absolute security.

Your data-protection rights

Subject to the conditions in applicable law, you may request access, rectification, erasure, restriction, data portability or object to processing based on legitimate interests. You may also withdraw consent where consent is the legal basis. Contact office@wsdefence.com and include the enquiry reference where available. We may request information needed to verify identity before acting on a request.

Complaints

You may lodge a complaint with the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria; kzld@cpdp.bg; complaint guidance, or with another competent supervisory authority where applicable. You may contact Water Stone first, but doing so is not a condition of contacting a supervisory authority.

Automated decisions, cookies and updates

Automated validation and abuse controls may reject or delay a submission; an email route remains available. Commercial and compliance decisions receive human review, and website enquiries are not subject to solely automated decisions producing legal or similarly significant effects. Website enquiry information is not used for unrelated marketing. The public website does not currently use advertising or marketing-analytics cookies. The protected administration area may use technologies strictly necessary for authentication, security and service operation.

This notice may be updated when processing, providers or legal requirements change. The effective date and version shown above identify the notice applying at the time of an enquiry. Where required, information about a materially different further purpose will be provided before that further processing begins.