Last updated: 29 August 2026 · Version 2026-08-29
Privacy Policy
This policy explains how NOMAD INDUSTRY LTD processes personal data through nomadindustry.net, its contact and recruitment forms, and the protected employee panel.
1. Controller and contact
The controller is NOMAD INDUSTRY LTD, UIC 206833378, VAT BG206833378, registered office: 19 Prof. Hristo Danov St., Shop 8, Studentski grad, 1700 Sofia, Bulgaria.
For questions, data-subject requests or withdrawal of consent, email info@nomadindustry.net or use the telephone contacts shown on the site.
2. Data we process
- Inquiries: company, contact person, business email, phone, project location, service, quantity or workload, required start date and description.
- Applications: name, email, phone, role, message, PDF CV and submission metadata. Do not send national identification numbers, health data, identity-document copies or unnecessary sensitive data.
- Site use: IP address, timestamp, requested URL, referrer, browser or device type and technical logs where generated by hosting and security systems.
- Privacy choices: a browser-local record of allowed or rejected analytics and external content, its version and expiry.
- Google Analytics after consent: online identifiers, approximate technical and geographic data, URL, referrer, browser, device and page-view events. We do not send names, emails, phone numbers, CVs or form content to Analytics.
- Employee panel: verified work email, Google subject identifier, protected session token, sign-in times and the vacancy author's email for accountability.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Inquiry response, quote and pre-contractual steps | Article 6(1)(b) GDPR; for B2B communications, our Article 6(1)(f) legitimate interest in managing business relationships |
| Application for a specific vacancy | Article 6(1)(b) GDPR — steps before a possible employment contract at the candidate's request |
| General application for future roles for up to six months | explicit, withdrawable consent under Article 6(1)(a) |
| Google Analytics | consent under Article 6(1)(a) and applicable terminal-equipment access rules |
| Google Maps | consent through settings or the map's allow-and-load button |
| Security, abuse prevention, logs and access control | our Article 6(1)(f) legitimate interest in protecting the site, mailbox and employee panel |
| Employee authentication and vacancy management | our Article 6(1)(f) legitimate interest in secure internal administration |
4. Required fields and automated decisions
Asterisked fields, including phone, are needed to review the inquiry or application and coordinate follow-up contact. There is no statutory duty to provide data, but without required fields we cannot process the submission.
We do not make decisions based solely on automated processing and do not profile candidates or visitors with legal or similarly significant effects.
5. Recipients and providers
- Authorized Nomad Industry employees handling inquiries, recruitment or vacancy administration.
- The Sites platform, Cloudflare and infrastructure providers for public pages, CDN and bot protection, the Worker API, vacancy data and protected employee sessions.
- SuperHosting.BG and business-email providers for forms.nomadindustry.net and delivery to info@nomadindustry.net.
- Google Ireland Limited and Google group companies only when Analytics, Maps or employee Google sign-in is requested or permitted.
- Professional advisers and competent authorities where required by law or necessary to protect legal rights.
6. Transfers outside the EEA
Some infrastructure providers and Google services may process data outside the EEA. Depending on the service, the provider may rely on an adequacy decision, the EU–US Data Privacy Framework or Standard Contractual Clauses and supplementary safeguards under its current terms.
Request information or an available copy of applicable safeguards at info@nomadindustry.net.
7. Retention
- Inquiries are kept until communication and pre-contractual relations end. If a contract follows, necessary data may enter contractual, accounting or legal records and be kept under statutory and claims periods.
- Specific-role applications are kept for selection and normally no longer than six months after it closes unless law or a specific claim requires otherwise. General applications are kept for up to six months or until earlier withdrawal.
- The site keeps no application database or CV archive. The temporary PHP upload is deleted before email delivery; the message and PDF then reside in the business mailbox and provider backups and must be deleted under the periods above.
- The local privacy record and first-party _ga cookies last up to 180 days without automatic lifetime renewal. GA4 user and event data is kept for the shortest configured property period, no longer than 14 months; aggregate reports without a direct online identifier may remain longer.
- The employee nonce lasts up to 10 minutes and the session up to eight hours. Expired D1 sessions are purged on subsequent Careers API use. A vacancy author's work email remains until the vacancy is deleted.
- Anti-abuse counters are HMAC-pseudonymized, do not store plain IP or email, and have a longest active window of 30 days. Expired files are removed during subsequent housekeeping. Server logs follow security needs and provider configuration.
8. Security
Controls include HTTPS, server-side validation, request limits, HttpOnly/Secure/SameSite employee cookies, Google token verification and allowlisting, data minimization and restricted access. CVs are limited to PDF files up to 5 MB with MIME and signature checks.
No internet service can guarantee absolute security. Do not include information in free text or a CV that is unnecessary for the purpose.
9. Your rights
Email requests to info@nomadindustry.net. We may request reasonable identity verification and normally respond within one month, subject to GDPR extension rules.
- access and a copy, rectification, erasure, restriction and, where applicable, portability;
- object to processing based on legitimate interests;
- withdraw consent at any time without affecting lawful processing before withdrawal;
- lodge a complaint with Bulgaria's Commission for Personal Data Protection (CPDP).
10. Changes
We update the date and version after material changes to purposes, providers or optional technologies. Where consent is affected, the site requests a new choice.