01 Introduction
Latona Development JSC (“We”, “Our”, “Us”) is a joint-stock company registered in Bulgaria with business address at 10, Poduevo str., entr. B, office 14, Sofia 1680, Bulgaria. We are committed to protecting the personal data of all individuals who interact with Us, including clients, suppliers, website visitors, prospective customers, and applicants.
This Privacy Policy (“Policy”) explains how We collect, use, store, and protect your personal data when you visit Our website at latona.ai or interact with Our services. We process all personal data in accordance with Regulation (EU) 2016/679 (the “General Data Protection Regulation” or “GDPR”). Definitions used in this Policy carry the same meaning as in the GDPR.
By visiting Our website and providing personal data through any of Our forms, subscription tools, or communication channels, you acknowledge this Policy. We may update this Policy from time to time; We recommend reviewing it periodically.
02 Data Controller
The data controller responsible for the processing of your personal data is:
Latona Development JSC
10, Poduevo str., entr. B, office 14, Sofia 1680, Bulgaria
privacy@latona.ai
03 What Personal Data We Collect
We collect personal data that you voluntarily provide to Us, as well as data collected automatically when you visit Our website. The categories of data We collect include:
3.1 Data you provide directly
When you submit a form, subscribe to a newsletter, request a demo, or contact Us, We may collect:
- Full name (first name and surname)
- Email address
- Telephone number
- Company name and job title
- Message content or enquiry details
- Any other information you choose to provide
3.2 Data collected automatically
When you visit Our website, We automatically collect certain technical data through cookies and similar technologies:
- Internet Protocol (IP) address
- Browser type and version
- Operating system
- Pages visited, time spent, and navigation patterns
- Referring website or source
- Device identifiers
This data is collected through the analytics and advertising tools described in Section 7 (Cookies and Tracking Technologies).
3.3 Data from job applicants
If you apply for a vacant position with Us, We may collect:
- Full name and contact details
- Curriculum Vitae (CV)
- Qualifications, skills, and employment history
- References from former employers
Following a successful recruitment process, We may request additional information such as background checks or biometric data for access control, as explained to you at that time.
04 How and Why We Use Your Personal Data
We process your personal data for the following purposes, each supported by a lawful basis under the GDPR:
4.1 To respond to your enquiries and requests
When you contact Us through Our website, request a demo, or submit a form, We process your data to fulfil your request. Lawful basis: performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR).
4.2 To send marketing communications
If you subscribe to Our newsletter or marketing materials, We process your data to send you relevant publications, news, event invitations, and updates about Our services. Lawful basis: consent (Art. 6(1)(a) GDPR). You may withdraw your consent and unsubscribe at any time.
4.3 To analyse and improve Our website
We use analytics tools to understand how visitors use Our website, measure performance, and improve user experience. This data is processed in aggregated or anonymised form where possible. Lawful basis: legitimate interest (Art. 6(1)(f) GDPR).
4.4 To deliver targeted advertising
We use advertising pixels and tracking technologies to show you relevant advertisements on third-party platforms and to measure the effectiveness of Our marketing campaigns. Lawful basis: consent (Art. 6(1)(a) GDPR), managed through Our cookie consent mechanism and withdrawable at any time. Please note that the use of these technologies involves the transfer of data to third-party providers, some of which may be located outside the EEA — see the International Data Transfers section (Section 8) for details on the vendors involved and the safeguards applied.
4.5 To comply with legal obligations
We may process your data where required to comply with applicable laws, regulations, or legal proceedings. Lawful basis: legal obligation (Art. 6(1)(c) GDPR).
4.6 To process job applications
We process applicant data to evaluate candidacies and manage Our recruitment process. Lawful basis: pre-contractual steps (Art. 6(1)(b) GDPR) and legitimate interest (Art. 6(1)(f) GDPR).
05 Email Marketing and Third-Party Processors
We use the following third-party platforms to manage Our email marketing and customer communications:
- Marketo Engage — for marketing automation, email campaigns, and subscription management. When you subscribe to Our newsletter, your data is transferred to Marketo for processing in accordance with its Privacy Policy and its contractual obligations with Us.
- Brevo (formerly Sendinblue) — for email marketing, transactional emails, and customer relationship management. Your data is processed by Brevo in accordance with its Privacy Policy and its contractual obligations with Us.
Both processors operate under data processing agreements with Us and process your data only on Our instructions and for the purposes described in this Policy.
You may unsubscribe from marketing communications at any time by clicking the unsubscribe link included in every email or by contacting Us at the address in Section 12.
08 International Data Transfers and Third-Party Advertising Vendors
Our primary data storage is within Bulgaria and the European Union. However, some of the third-party service providers We use are based outside the European Economic Area (EEA), primarily in the United States. For advertising, remarketing, and website-optimisation purposes, these tools may transfer, store, and process your technical and website-usage data outside the EEA.
The specific advertising vendors We use, their European operating entities, and the respective data-transfer frameworks applied to them are as follows:
- Meta Pixel (Facebook/Instagram) — for users within the EEA, this service is operated by Meta Platforms Ireland Limited. Data may be transferred to Meta Platforms, Inc. in the United States, secured under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (SCCs).
- LinkedIn Insight Tag — for users within the EEA, this service is operated by LinkedIn Ireland Unlimited Company. Data may be transferred to LinkedIn Corporation (Microsoft) in the United States, secured under the EU-U.S. Data Privacy Framework.
- TikTok Pixel — for users within the EEA, this service is operated by TikTok Technology Limited (Ireland). While primary data processing occurs within European data-centre infrastructure, any auxiliary technical or operational data transfers outside the EEA are secured strictly via Standard Contractual Clauses (SCCs) and enhanced technical security controls.
To ensure your personal data receives a level of protection equivalent to that guaranteed within the EEA, We rely on recognised legal transfer mechanisms under Chapter V of the GDPR. These include:
- Adequacy Decisions / EU-U.S. Data Privacy Framework (DPF) — for transfers to self-certified organisations in the United States that provide an adequate level of data protection.
- Standard Contractual Clauses (SCCs) — for transfers to organisations or countries lacking an adequacy decision, utilising the standard contractual clauses approved by the European Commission alongside mandatory supplementary technical and organisational security measures.
The third-party service providers based outside the EEA include:
- Google LLC (GA4, GTM) — United States
- Meta Platforms, Inc. (Meta Pixel) — United States
- LinkedIn Corporation / Microsoft (LinkedIn Insight Tag) — United States
- ByteDance Ltd. (TikTok Pixel) — United States / Singapore
For further information on the specific safeguards in place for these transfers, or to request a copy of the contractual clauses, please contact Us at the address provided in Section 12.
09 How Long We Keep Your Data
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Specifically:
- Contact form enquiries and demo requests: retained for the duration of the business relationship or enquiry, then deleted within 12 months of last contact.
- Newsletter subscribers: retained until you unsubscribe, then deleted within 30 days.
- Analytics data: retained in accordance with the default retention settings of each analytics platform (e.g., GA4 default is 14 months).
- Job applicants (unsuccessful): retained for 6 months from the date of application. With your consent, CVs may be retained for up to 12 months for consideration in future opportunities.
- Cookies: retention periods vary by cookie type and are detailed in the cookie consent tool on Our website.
10 Your Rights Under the GDPR
As a data subject, you have the following rights regarding your personal data:
- Right to be informed — clear information about how your data is processed, provided through this Policy.
- Right of access — you may request a copy of all personal data We hold about you.
- Right to rectification — you may request that inaccurate or incomplete data be corrected.
- Right to erasure (“right to be forgotten”) — you may request deletion of your data, subject to legal retention obligations.
- Right to restrict processing — you may request that We limit how We use your data in certain circumstances.
- Right to data portability — you may request your data in a structured, machine-readable format.
- Right to object — you may object to processing based on legitimate interest, including opting out of marketing communications at any time.
- Right regarding automated decision-making — you have the right not to be subject to decisions based solely on automated processing that produce legal effects.
To exercise any of these rights, please contact Us at the address in Section 12. We will respond within one (1) month. For complex requests, this may be extended by a further one (1) month, and We will inform you accordingly.
If you are unsatisfied with Our response, you have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP):
- Website: https://cpdp.bg/en/
- Complaint form: https://cpdp.bg/en/lodging-complaints-and-alerts/
11 Data Security
We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing your personal data. Our safeguards are designed to protect your data against accidental or unlawful destruction, loss, alteration, or unauthorised access, disclosure, or use. These measures include:
- Encryption — We use industry-standard Transport Layer Security (TLS/HTTPS) encryption to secure data in transit across the internet.
- Access Control — internal access to raw analytical data and server logs is strictly restricted to authorised technical staff who require it to maintain Our services, governed by the principle of least privilege.
- Pseudonymisation — online identifiers (such as IP addresses) are pseudonymised or truncated where possible at the earliest stage of collection to minimise privacy risks.
- Resilience & Testing — We conduct regular security reviews, vulnerability assessments, and system monitoring to maintain the ongoing confidentiality, integrity, and availability of Our digital environment.
While no data transmission over the Internet can be guaranteed as fully secure, We implement industry-standard safeguards to protect your personal data against unauthorised access, alteration, disclosure, or destruction.
12 Contact Us
For questions about this Policy, to exercise your data subject rights, or to raise a privacy concern, please contact Us through any of the following means:
Email: privacy@latona.ai
Website: latona.ai/contact
Registered office: Latona Development JSC, 10, Poduevo str., entr. B, office 14, Sofia 1680, Bulgaria
13 Links to Other Websites
Our website contains links to external websites, including those of Latona group member firms and corporate partners. This Privacy Policy applies solely to personal data collected directly through latona.ai. Each external website operates under its own independent privacy practices and legal policies.
We do not control, and accept no responsibility or liability for, the content, security, or privacy practices of these third-party sites. When you follow a link to leave Our website, we strongly encourage you to review the Privacy Policy of that destination site to understand how they handle your data.
For information on how third-party advertising cookies track your activity across external platforms after visiting Our site, please see the International Data Transfers section (Section 8) above.