HSM LIMITED LTD
Privacy notice
Updated: 7 October 2026
1. Controller and contact
The controller for this website is ХСМ ЛИМИТЕД ЕООД, registered in a foreign language as HSM LIMITED Ltd, EIK 208501442, ul. Kyustendzha No. 2, floor 3, 7700 Targovishte, Bulgaria. For privacy requests contact info@hsm-limited.com or +359 892 646 564.
2. Visiting this website
Hosting and security systems may process your IP address, date and time, requested URL, browser and device information, referrer and technical errors. This enables delivery of the website, troubleshooting and protection against attacks. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a reliable, secure business website. There is no advertising tracking or visitor profiling in the current configuration.
3. Enquiries and business contact
The form processes your name, email address, selected service, message and optional company name. Email and telephone contact may contain additional details you provide. We use this information to respond and discuss cooperation. Article 6(1)(b) GDPR applies to requests for a contract with you personally; Article 6(1)(f) applies to other enquiries and contact with company representatives. Our legitimate interest is responding to business communications. Applicable legal obligations are based on Article 6(1)(c). Required form details are needed to respond; you are not legally obliged to provide them and may contact us by telephone instead. Please do not send sensitive personal data or identity documents through this form.
4. Form security and storage
The form uses request validation, a hidden spam field and submission limits. For rate limiting, a keyed hash derived from the connecting IP address and a counter are used for 30 minutes; the form does not store the raw IP address in that counter. There is no separate enquiry database in the HSM form module: submissions are sent to our company mailbox. Mail logs in the installed mail plugin are disabled. The website and mailbox can be included in provider or website backups.
5. Service providers and international processing
Spaceship, Inc. provides hosting, and its Spacemail service provides our company email. The hosting region was selected as EU; this is not a promise that email, support, backups or all processing remains in the EU. Authorised personnel and technical providers can receive data as needed to run these services. Spacemail uses automated security checks against spam, malware and unlawful content. Spaceship’s data processing addendum covers processing on our behalf and provides standard contractual clauses for relevant third-country transfers, including possible processing in the United States. Information about safeguards and copies of applicable safeguards can be requested from us. See the provider information linked below. No enquiry is automatically forwarded to a transport partner by the form; any necessary sharing for a specific business request is limited to that purpose.
6. Retention
Enquiry correspondence is kept for as long as required to handle the request, follow-up and any resulting business relationship. When these purposes end, data is deleted unless legal retention duties or the establishment, exercise or defence of claims require further storage. Contract and accounting records follow the applicable statutory retention periods. Technical logs are retained according to the provider’s operational and security requirements; incidents may require longer preservation. Backup copies expire according to the relevant backup rotation. The rate-limiting entry expires after 30 minutes. Contact us for information about the retention applicable to your specific data.
7. Your rights
Subject to the legal conditions, you may request access, correction, erasure, restriction and data portability. You may object to processing based on legitimate interests on grounds relating to your situation. If we separately request consent in future, you may withdraw it at any time without affecting earlier lawful processing. We do not use these website enquiries for solely automated decisions with legal or similarly significant effects. You may complain to the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, kzld@cpdp.bg, or the competent supervisory authority in your country of habitual residence, work or the alleged infringement.
Further information
CPDP ↗ · Spaceship Data Processing Addendum ↗ · Spaceship Privacy Policy ↗