This notice explains what happens to personal data here: on this website, in correspondence, and in the outbound work carried out for clients. That last one is the service itself, so it is described in the most detail and not buried.
Click the unsubscribe link in the message, or reply and say so, or write to alex.kuguk@evadava.com. It is actioned the same business day, permanently, across every campaign and every client. No reason is needed and none will be asked for. The detail is in section 10.
EVA DAVA EOOD · UIC 207945177 · VAT BG207945177
9 Gen. Gurko Str., floor 1, 8000, Burgas, Bulgaria
Alex Kuguk, sole owner and the person who does the work · alex.kuguk@evadava.com
The company is a one‑person business and is not required to appoint a Data Protection Officer under Article 37 of the GDPR. Alex Kuguk answers data protection questions personally at the address above.
This site sets no cookies, writes nothing to your browser storage, runs no analytics and carries no advertising or tracking pixels. There is no banner because there is nothing to consent to.
Two things still happen at the network level, because they happen for any website, and they are listed here rather than left out:
Legal basis for both: legitimate interest under Article 6(1)(f) — running a working, available website. Retention: as set out in section 9.
There are none. Nothing is stored in your browser by this site, so there is nothing to accept, refuse or delete, and no consent under Article 5(3) of the ePrivacy Directive is required.
If that ever changes — if a booking tool or a measurement tool is added — this notice is updated before the change takes effect, the cookie is named here with its purpose and lifetime, and anything that is not strictly necessary is set only after you say so.
Email sent to alex.kuguk@evadava.com is stored in Google Workspace. Purpose: answering it and keeping a record of what was agreed. Legal basis: legitimate interest in handling business correspondence, or performance of a contract where one exists.
Booking a fit call means giving a name, a work email, a company, and whatever you choose to say about what you sell. That creates a calendar entry, an invitation to you, and a meeting link. Purpose: arranging and holding the call you asked for. Legal basis: taking steps at your request before entering into a contract, Article 6(1)(b), and legitimate interest in keeping business records.
This is the service. Stated plainly: people at companies matching a buyer profile agreed with a client are identified, and contacted by email from a mailbox on that client's own domain, in the name of Alex Kuguk, with a signature reading Outbound for that client.
The data involved is business contact data:
No special categories of data under Article 9 are collected or used. No data about children. No personal email addresses. No profiling that produces legal effects, and no automated decision‑making within the meaning of Article 22.
Volume is capped by design, and the caps are part of the answer to whether this is proportionate: no more than four messages to any one person in a sequence, no more than thirty emails a day from any one mailbox, and a fifth message on a dead thread is never sent.
This is the part that decides who answers for what, so it is set out first and without hedging.
For the campaign data — the prospects, the messages, the replies and the meeting records — the client is the controller and EVA DAVA EOOD is the processor. The client decides who is contacted and why, by signing off the buyer profile, the criteria, the messaging and the exclusion list in writing before anything is sent. EVA DAVA carries that decision out on the client's documented instruction, sends from the client's own domain, and writes the records into the client's own CRM. That processing is governed by the Data Processing Agreement.
Sourcing a prospect is part of the same instruction and not a separate purpose: the profile that defines who is looked for is the client's, it is written down before the search begins, and the records land in the client's system. The client is the controller from the first record to the last.
EVA DAVA is an independent controller of one thing only: the permanent suppression list — the record of addresses that asked never to be contacted again.
It has to be that way. A suppression list that belonged to one client would be deleted when that engagement ended, and the same person would be contacted again for the next client. Keeping it separately, across all clients and beyond the end of any engagement, is the only way an objection can actually be permanent. Its purpose is honouring objections, and it is used for nothing else. It holds the address, the date and the fact of the request, and no more.
The legal basis for the outreach is legitimate interest, Article 6(1)(f) — the client's legitimate interest in offering a relevant business service to a business contact whose role makes the offer relevant, with EVA DAVA acting on the client's instruction. Recital 47 records that direct marketing may be a legitimate interest.
Article 6(1)(f) is not a label to be claimed; it requires an assessment, and the assessment has to exist in writing before the processing starts. Here it is. It is repeated for each client against that client's own profile, kept on file, and made available to a supervisory authority on request.
The interest is reaching a named decision‑maker with a business proposition inside their professional remit. It is lawful, it is real rather than speculative, and it is the client's own commercial interest in selling to businesses. The recipient is contacted in their professional capacity, at their employer, about something that falls within what they are paid to decide.
To reach a specific decision‑maker at a specific company about a specific offer, there is no less intrusive means that achieves it. Advertising does not reach a named individual; consent cannot be obtained from someone you have no contact with, which would make the requirement circular. The processing is limited to what the purpose needs: business contact data only, no enrichment beyond role and employer, no personal addresses, no special categories, four messages and then silence.
| What weighs against the processing | What limits it |
|---|---|
| The email is unsolicited and was not asked for | Four messages at most, then the thread stops. No fifth message on a dead thread, ever |
| The recipient did not give their address | The source of the address is named in the message itself, at the first contact, as Article 14(3)(b) requires |
| Data was collected without the recipient's knowledge | Only business contact data, from sources the recipient's employer publishes or that publish business roles. Nothing private, nothing inferred about the person outside work |
| A recipient may reasonably not expect it | A person in a named commercial role at a B2B company can reasonably expect business approaches at their work address. That expectation does not extend to a personal address, which is why none is used |
| Repetition is what makes cold outreach intrusive | Thirty emails a day per mailbox, and one contact appears in one sequence. Nobody is entered into a second campaign for the same client |
| An objection could be ignored or slow‑walked | One‑click opt‑out in every message and in the mail client's own header. Actioned the same business day, permanently, across every client. US law allows ten business days and they are not used |
| Harm from a mistake, such as a wrong or personal address | Exclusion lists applied before the first send, addresses verified before use, and bounce and complaint thresholds that stop the sending outright at 2% and 0.1% |
Each sub‑processor is named in writing to the Client before the engagement starts, and the current list is provided on request at any time. No sub‑processor is added or replaced without written notice to the Client and a period in which the Client may object; if the objection cannot be resolved, the Client may terminate without penalty and without paying for meetings not yet held. The list is not published here because it is part of how the work is done, not part of what is being sold.
Outcome. The interests and fundamental rights of the recipient are not overridden. The processing is narrow, it is business‑context only, its effect on the individual is a small number of emails they can end with one click, and the safeguard that makes the balance hold is that an objection ends it immediately and without argument. Where an objection is received, the balance no longer needs to be assessed: the processing stops.
Where a recipient's national law requires consent rather than legitimate interest for a particular category — individual subscribers, sole traders and unincorporated partnerships in the United Kingdom, for example — that category is excluded from sending rather than justified under this assessment.
Because the data is not collected from you, Article 14 applies: you are entitled to know the source, and to be told at the first contact. Every message names its source in a line of its own. The sources are:
No address is bought from a source that cannot say where it came from, and no address is taken from a data breach, a scraped personal account, or a private mailbox.
These are the parties that process personal data on behalf of EVA DAVA EOOD, or alongside it. Each is under a written data processing agreement.
| Party | What for | Where |
|---|---|---|
| Google Ireland Limited | Google Workspace: the mailboxes on client domains, calendar, meetings, documents and correspondence | EU, with transfers to the US |
| Microsoft Ireland Operations Limited | Microsoft 365 and Exchange Online: the second half of every mailbox pack, so that no single vendor holds all of it | EU, with transfers to the US |
| Domain registrar and DNS | Domain registration in the client's name, DNS, and the network in front of this website | United States, with EU edge |
| Website host | Hosting of this website and its server logs | United States |
| Prospect data provider | Business contact data and outbound sequencing | United States |
| Email verification provider | Checking that a business address is deliverable before anything is sent to it | Bangladesh |
Transfers outside the European Economic Area rely on the European Commission's Standard Contractual Clauses (Decision 2021/914), and on the EU–US Data Privacy Framework where the recipient is certified under it. A transfer impact assessment is available on request.
No personal data is sold, and none is shared for advertising. The list above is the whole list; there is no undisclosed layer beneath it.
Clients are given thirty days written notice before a sub‑processor is added or replaced, and may object, under clause 8 of the Data Processing Agreement.
| What | How long |
|---|---|
| Server and network logs for this website | Up to 30 days, then overwritten |
| Fit call booking records | 24 months from the call, unless a contract follows |
| Correspondence | For as long as the business relationship requires, then the retention period Bulgarian accounting law requires for anything with a financial record attached |
| Prospect records held for a client | As the client instructs. Where the client gives no instruction, 12 months from the last contact, unless a conversation is still running. Recorded in the agreement either way |
| Everything held for a client at the end of an engagement | Returned or deleted within 30 days, at the client's choice, under clause 14 of the Data Processing Agreement |
| The permanent suppression list | Kept indefinitely, and deliberately. Deleting it would mean contacting the person again |
Three ways, all of them equal: click the unsubscribe link in the message, reply and say so in any words, or write to alex.kuguk@evadava.com.
The unsubscribe link is one click. There is no login, no form, no preference centre and no question about why. It is also carried as a List‑Unsubscribe header, so the unsubscribe control built into your own mail client works.
What then happens:
Complaining to a mailbox provider by pressing its spam button also works: it registers, and it counts towards the 0.1% complaint threshold that stops a campaign outright.
Under the GDPR you may ask for:
Write to alex.kuguk@evadava.com. A reply follows within 30 days, and usually a great deal sooner. There is no charge.
Where the data is held for a client and EVA DAVA is the processor, a request received directly is passed to that client within two business days and you are told who they are, because they are the controller and it is their decision to make. An objection to marketing is actioned immediately in either case, without waiting for anyone.
You may complain to the Bulgarian Commission for Personal Data Protection, cpdp.bg, or to the supervisory authority in the country where you live or work.
This notice carries a version number and a date. A material change is published here before it takes effect. Previous versions are supplied on request.
EVA DAVA EOOD · UIC 207945177 · 9 Gen. Gurko Str., floor 1, 8000, Burgas, Bulgaria
Alex Kuguk · alex.kuguk@evadava.com