Privacy policy

This policy says what personal data tnb-tech.com collects, why, and how long it keeps it. The numbers in it are read from the settings the site runs on rather than typed out, so when a setting changes the text changes with it.

1. Who processes your data

The controller is T&B Technology LTD, UIC 206608506, VAT No. BG206608506, with its registered office at 4 G. S. Rakovski St., 7000 Ruse, Bulgaria, represented by its manager, Teodor Dechev. Write to [email protected] or call +359 877 630 000. There is no appointed data protection officer; enquiries reach the team directly.

2. What we collect

Without your consent the site writes nothing about you. No analytics, no recording, no profile. Everything in the second list below happens only after you switch it on in the cookie bar.

What you hand us yourself:

• The contact form: name, e-mail, phone if you write one, company, website, the layers you picked, a budget range, the message and an attachment when you add one. Your IP address and your browser string are not stored with the enquiry.
• The domain checker: the domain you check. The result is shown to you and kept nowhere.
• Your choice in the cookie bar: what you allowed and when, as the record that consent was given.
• Against spam: the form counts submissions over one hour against a truncated keyed hash of the IP address. The address itself is never written down and the hash expires with the hour.

What the analytics tier collects once you allow it:

• Two first-party ids: _rv, an anonymous number for the browser (12 months), and _rs, one for the visit (30 minutes). Neither is tied to a name or an account.
• The visit: the pages you open, time on the page, how far you scroll, the page you arrived from, device class and browser, language, and the country plus a coarse network class.
• The country and the network class are worked out from your IP address at the moment of the request and the address is then discarded. No table on this site stores an IP address.
• Where a page is clicked and how far it is read, added into a heat map for that page. The map is a grid of counts; it holds nothing that points back at you.
• Which variant of an A/B test you were shown, so a second visit does not show you a different one.
• An enquiry you send while analytics is on is stored together with the browser id, the visit id, the pages you read before the form, where the visit came from, and an interest score the site works out from those pages. The score is used for one thing — deciding which enquiries we answer first — and never for a decision with a legal effect on you. With the analytics tier off, the enquiry is stored with none of this.
• Microsoft Clarity — only after this consent and never on the free tools’ pages: heatmaps and recordings of the visit (clicks, scrolling, pointer movement and how the page renders), with input fields always masked. Microsoft records them and also receives your IP address, which it uses to work out your approximate location; the recordings are available to us in Clarity for up to 30 days. Clarity’s cookies are listed in the Cookie policy. When you withdraw consent, Clarity stops and its cookies are deleted.

We buy no data, we build no advertising profiles, and we follow nobody across other people's sites. The full list of cookies is in the Cookie policy.

3. Session recording

The recorder is switched off at the moment: no visit is being recorded and the cookie bar does not offer the choice. When it is switched on, we record — only with your separate consent — an anonymous playback of your visit: the position of the pointer, scrolling, clicks and the page as it was drawn. It stays off unless you switch it on, and switching it off again stops the recording on the spot and deletes what we already hold for you.

What is never recorded: input fields, text areas, drop-downs, anything you type, the contact form, the domain checker, and any element the site marks as private. Values are masked in your browser before anything is sent, and masked a second time on our server. E-mail addresses, phone numbers, IBANs and personal identity numbers are removed from visible text as well.

How much, when recording is on: about 20% of consenting visits, each for at most three minutes. Recordings are stored on our own server in Europe, are visible only to the owner of the agency, are never sold or shared, and are deleted automatically after 30 days.

Why: to see where the site is confusing or slow — a button that gets clicked three times because nothing happens, a section everybody scrolls past. Nothing here is used to identify you or to build a profile.

4. Why, and on what ground

• To answer an enquiry — steps taken at your request before entering into a contract.
• To keep the site safe and running (server logs, rate limits, spam protection on the forms) — legitimate interest.
• To learn which pages get read — your consent, given in the cookie bar and withdrawable at any time.
• To see where a page confuses — your separate consent to session recording (when recording is switched on), which “Accept all” never grants on its own.
• To answer the urgent enquiries first — legitimate interest (Art. 6(1)(f) GDPR): tying an enquiry to the pages read before it and to the interest score. You may object at any time — see section 7.
• To perform a contract if you become a client — contract performance and statutory accounting duties.

We do not add people to a newsletter because they asked a question.

5. Who else sees it

Only the providers the site cannot run without: the hosting provider that stores the site and its database, and the mail provider our reply travels through. Our own analytics run on the same server and send nothing to a third party. When an outside measurement service is switched on — Google Analytics, Microsoft Clarity or an advertising pixel — it loads only after your consent in the cookie bar and never on the free tools' pages, and who is behind it and on what basis data leaves the EU is stated under “Transfers outside the EU” at the end of this page for as long as it is on. Data goes to a public authority only where the law requires it. We neither sell nor rent data.

6. How long we keep it

• An enquiry that did not lead to work together — 12 months after it was last updated in our system, then deleted automatically.
• An enquiry from someone who became our client — 5 years after it was last updated, then deleted automatically.
• Write to us and we delete your enquiry sooner, unless the law requires us to keep it.
• Files attached to an enquiry — deleted together with the enquiry.
• The browser id and its visit summary — 13 months.
• Visits — 13 months. Page views — 90 days. Events — 90 days.
• Individual click points — 60 days; the heat map they are folded into — 13 months.
• A/B test assignment — 13 months.
• A session recording (when recording is switched on) — 30 days, and immediately if you withdraw consent.
• The record of your consent — 24 months, because it is the evidence that you gave it.
• Accounting records — for the period the law prescribes.

After those periods only aggregate figures remain: totals per day and per page, carrying no identifier and reducible to no person.

7. Your rights

You may ask for access to your data, for its correction or deletion, for processing to be restricted, for portability, and you may object to processing based on legitimate interest. Three of those you can exercise yourself, without asking anyone: the “Cookie settings” button at the bottom of this page reopens the cookie bar, where you can withdraw any consent you gave; the panel it opens lets you download everything stored against your browser id; and “Erase it” beside that link deletes it.

An enquiry is a different matter — it carries a name and an e-mail, and deleting it is a request made to a person. Write to [email protected] and we answer within one month. The same address takes an objection to your enquiry being tied to the pages you read before it and to the interest score: we break the link and keep the enquiry itself. If you think we got it wrong, you can complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg).

8. Security

The site runs over HTTPS. The admin panel is password-protected and access to the data is limited to the people in the team who work on enquiries. Session recordings are visible to the owner alone.

9. Changes to this policy

When the policy changes we update the date at the top. Material changes are described in the document itself, not made quietly.

10. Contact

T&B Technology LTD, UIC 206608506, VAT No. BG206608506, with its registered office at 4 G. S. Rakovski St., 7000 Ruse, Bulgaria · [email protected] · +359 877 630 000

The speed test

When you test the speed of a page, our server sends its address to Google PageSpeed Insights (Google LLC), which loads the page and returns the measurements. We send nothing about you — no IP address, no cookies. The address and the result are kept on our server for 24 hours so a repeat test opens instantly, and are then deleted. We do not record who asked.

The free website checks

When you check a site or a domain with one of our free tools, our server sends the name you typed to the site itself, as an ordinary visit does, and to the public DNS resolvers of Cloudflare and Google to read the domain's public records. The tracking check adds the label utm_source=tnb-tech-check to the address and, when the page names a Google Tag Manager container, reads Google's public copy of it from www.googletagmanager.com. The domain check also asks the public domain registries (RDAP) and RIPE NCC's public network data (RIPEstat); from a registry we show only the registrar and the dates, never the holder's name or details. The link preview check also downloads the image and icons the page names; you see only a small copy made on our server. It stays with the result for 10 minutes and is deleted at the next check with this tool. We send nothing about you and we do not record who checked what. The result of these checks stays in the cache for at most 10 minutes, under a key that does not reveal the address, and is then deleted. Data about the site and the network itself — the site's robots.txt rules (up to 1 hour) and RIPEstat's public network data (up to 24 hours) — is kept longer in the same way, so that we do not ask again on every check; none of it is about you. The calculators, briefs and file checks run in your browser and send nothing until you send an enquiry yourself. The exception is a browser without JavaScript: then the numbers and answers you enter reach our server once so we can show the result, and we do not keep them. No file is uploaded in that case either.

Transfers outside the EU

With your consent in the cookie bar the site loads the following services, and data about your visit reaches their providers: Google Analytics / Google Tag Manager — Google Ireland Ltd (Dublin) as the provider, with Google LLC (USA) as its processor; Meta Pixel — Meta Platforms Ireland Ltd (Dublin), with Meta Platforms, Inc. (USA) as its processor; Microsoft Clarity — Microsoft Ireland Operations Ltd (Dublin) as the provider, which transfers the data to Microsoft Corporation (USA). Where data leaves the European Economic Area, the transfer rests on the EU–US Data Privacy Framework (certified under it: Google LLC, Meta Platforms, Inc., Microsoft Corporation) and on the European Commission’s standard contractual clauses in the providers’ terms.