Privacy policy.

Plain-language summary of what data this site collects, why, who can see it, how long it is kept, and what you can ask me to do about it. Drafted to comply with Articles 12 to 22 of the EU General Data Protection Regulation.

Last updated: 2026-04-26

Data controller

The Procurementor
Petko Slaveykov No. 14, 2700 Blagoevgrad, Bulgaria
VAT: BG206841396
Contact for any privacy request: alex@theprocurementor.com

What data is collected

I keep collection minimal. The data below is collected only when you actively give it (a form, an email, a booking).

Identity: name, role, company, professional email — collected when you submit a contact form or book a meeting.
Meeting context: topic, maturity self-assessment, free-text questions you choose to share before a call. Stored to prepare and follow up on the meeting.
Email correspondence: the content of any email you send and the threads that follow.
Technical data: IP address, browser type, OS — collected by the hosting layer (Vercel) for security and aggregate usage. No analytics tool is loaded today.
Consent record: the choice you made on the cookie banner, stored locally in your browser for 6 months.

Legal basis

Each processing has an explicit legal basis under Article 6 GDPR.

Contact and booking forms: performance of a pre-contractual measure at your request (Art. 6(1)(b)).
Email correspondence: legitimate interest in responding to your inquiry (Art. 6(1)(f)).
Active engagement (paid services): performance of the contract (Art. 6(1)(b)).
Cookie consent storage: legitimate interest in respecting your privacy choice (Art. 6(1)(f)).
Any future analytics: explicit consent collected via the banner (Art. 6(1)(a)).

How long data is kept

Form submissions and unanswered inquiries: 12 months from your last contact.
Active client correspondence: 36 months after the end of the engagement (commercial-law obligations).
Booking metadata kept by Cal.com: per Cal.com retention policy, see cal.com/privacy.
Server logs (Vercel): 30 days.
Cookie consent record: 6 months in your browser only.

Who sees the data

I run lean. Personal data is only shared with subprocessors that are strictly necessary to operate the site and the services.

Vercel Inc.: site hosting and edge logs. USA, EU-US Data Privacy Framework certified.
Cal.com Inc.: meeting bookings. USA, EU-US DPF certified.
Resend (transactional email): sends and receives the form notifications. USA, GDPR-aligned subprocessor.
No advertising network: no marketing data buyers, no retargeting pixels.

International transfers

Some subprocessors are based in the United States. Transfers rely on the EU-US Data Privacy Framework certifications (Vercel, Cal.com) and on Standard Contractual Clauses where applicable. You can request the underlying transfer documentation by writing to the privacy contact.

Your rights

Right of access: ask what data I hold on you and receive a copy.
Right to rectification: ask me to correct inaccurate or incomplete data.
Right to erasure ("to be forgotten"): ask me to delete your data, subject to legal retention obligations.
Right to restriction: ask me to pause processing while a complaint is reviewed.
Right to portability: receive your data in a structured, machine-readable format.
Right to object: object to processing based on legitimate interest.
Right to withdraw consent: at any time, with no consequence to past lawful processing.

To exercise any of these rights, write to alex@theprocurementor.com. I commit to a substantive reply within 30 days, extendable by 60 days for complex requests with prior notification.

Right to complain

You can lodge a complaint with the Bulgarian data protection authority (CPDP — Commission for Personal Data Protection, www.cpdp.bg) as the lead supervisory authority. EU residents may also lodge a complaint with their local supervisory authority — for example the CNIL in France (www.cnil.fr).

Cookies

A short list of strictly necessary and consent-gated cookies is documented separately. See the cookie policy →