Privacy policy

Who is responsible

The controller for the personal data described in this policy is:

What this policy covers

This policy covers three things: this website, igs-consult.com; correspondence with us by email or telephone; and Novompo, the service through which the administration tools of the online shops IGS Consult operates connect to Facebook, Instagram, X, LinkedIn and TikTok accounts and publish posts to them, including its connection address connect.igs-consult.com.

Each online shop IGS Consult operates publishes its own privacy policy for its customers on its own website. This policy does not cover shop customers.

What this website collects

The website has no accounts, no sign-up and no contact form, so it collects nothing that you type.

If you accept analytics, our analytics provider records a randomly generated identifier, a shortened form of your IP address, the pages you view, and general information about your browser and device. We do not use this to identify you personally and we do not combine it with anything else.

Why, and on what legal basis

We use analytics to understand which parts of the site are read and how people arrive. The legal basis is your consent, under Article 6(1)(a) GDPR.

Analytics does not load until you accept. Declining has no effect on the site, and you can change your mind at any time from the cookie policy page.

Who else processes website data

Google Ireland Limited provides the analytics service and processes the data described above on our behalf.

Our hosting provider processes the server logs necessary to deliver the pages to you, which include your IP address and the time of the request. This is a technical necessity of serving a website rather than an analytics activity.

When you write to us or call

If you email us or call, we process what you give us — your name, your contact details and the content of your message — in order to answer you and, where the conversation leads to one, to prepare or perform a contract.

The legal basis is Article 6(1)(b) GDPR where your enquiry concerns a contract, and otherwise our legitimate interest in answering the enquiries we receive, under Article 6(1)(f). Our email provider processes messages on our behalf.

We keep correspondence for as long as the enquiry needs, and where it becomes part of a business relationship, for the periods commercial and tax law require.

Connected social-media accounts (Novompo)

The people who operate IGS Consult's online shops can connect the shops' social-media accounts to Novompo. The connection always goes through the platform's own login screen: we never see or store your password on that platform.

From the platform we receive: your account identifier there, your name as it is shown there, the permissions you granted, an access token and when it expires, and the list of Pages or business accounts you manage, with their identifiers, names, usernames and profile pictures. For the Pages and accounts chosen for publishing we also store a posting token.

For each post published through Novompo we keep a record of its text, its image, when it was published and its address on the platform. Where statistics are enabled, we also store the aggregate figures the platform reports for our own posts, such as reach, reactions and comment counts — never data about the individual people who saw or reacted to a post.

Why we use connection data, and on what legal basis

We use this data only to prepare, schedule and publish the shops' posts on the accounts they were connected for, to show the people who operate a shop which accounts are connected and whether they still work, and to measure how our own posts perform.

We do not use it for advertising, we do not build profiles, and we do not sell it or pass it on.

The legal basis is our legitimate interest in running the social-media presence of our own shops, under Article 6(1)(f) GDPR, and, where you connect an account as part of your work for us, the performance of that arrangement, under Article 6(1)(b).

How connection data is protected, and where it is stored

Access and posting tokens are encrypted before they are stored, with keys held in Google Cloud Key Management Service. They are never shown in the administration tools and are sent to no one except the platform that issued them.

The data is stored in the database of the shop concerned, on Google Cloud in the European Union (Frankfurt, Germany). The connection address connect.igs-consult.com runs on Google Cloud in Belgium; it passes the result of the login to the shop's administration tool and stores nothing itself.

Who else processes connection data

Google Cloud EMEA Limited hosts the service and its databases on our behalf.

The platforms — Facebook and Instagram (Meta), X, LinkedIn and TikTok — are independent controllers of the data on their own services. What they do with it is governed by their own privacy policies.

The text and images of posts are prepared with the help of artificial-intelligence services (OpenAI and Google) from our own product information and brand guidelines. The personal data described in the section on connected accounts is not sent to them.

How long connection data is kept

An access token is deleted as soon as the account is disconnected in the administration tool, the app is removed in the platform's settings, or the platform reports the token as expired or revoked.

The record of the connection itself — your identifier on the platform, your name and the permissions you granted — is then kept without any token, so that the people operating the shop can see its history and reconnect it. It is deleted on request, and at once when you ask the platform to delete your data.

Records of posts published for a shop are kept for as long as the shop operates, as part of its business records. Images that were prepared but never published are deleted automatically after the retention period set in the administration tool (90 days unless changed).

Deleting connection data

You can end a connection at any time, in the shop's administration tool or in the platform's own settings, and you can ask for the data to be deleted — through the platform or by writing to us. The data deletion page describes each route, what is deleted and what is not.

Transfers outside the EEA

Analytics data may be processed outside the European Economic Area. Where that happens, the transfer relies on the European Commission's standard contractual clauses together with the provider's supplementary measures.

We store connection data inside the European Union. The platforms may process the data they hold outside the EEA under their own terms and safeguards.

How long website data is kept

Analytics data is deleted automatically once the retention period configured in the analytics property expires. Server logs are kept for the period set by our hosting provider.

Your rights

Under the GDPR you have the right to:

• ask what personal data we hold about you, and receive a copy
• have inaccurate data corrected
• have your data erased
• restrict or object to how we process it
• receive your data in a portable form
• withdraw your consent at any time, without affecting processing carried out before you withdrew it

How to exercise them

Write to support@igs-consult.com or to our registered address, or call the telephone number above. We answer within one month; if a request is complex, we tell you within that month why we need longer.

Changes to this policy

If we change how we handle personal data, we will update this page and the date shown above.

Complaints

If you believe we have handled your personal data unlawfully, you can complain to the Bulgarian supervisory authority:

Комисия за защита на личните данни (Commission for Personal Data Protection)