This notice explains what happens to personal data here: on this website, in correspondence, and in the outbound work carried out for clients. That last one is the service itself, so it is described in the most detail and not buried.
Click the unsubscribe link in the message, or reply and say so, or write to alex.kuguk@evadava.com. It is actioned the same business day, permanently, across every campaign and every client. No reason is needed and none will be asked for. The detail is in section 10.
EVA DAVA EOOD · UIC 207945177 · VAT BG207945177
9 Gen. Gurko Str., floor 1, 8000, Burgas, Bulgaria
Alexander Kuguk, sole owner, who assembles and directs the crew that does the work · alex.kuguk@evadava.com
The company does not carry out large-scale monitoring or process special categories as a core activity, and is not required to appoint a Data Protection Officer under Article 37 of the GDPR. Alexander Kuguk answers data protection questions personally at the address above.
1This website
This site carries no advertising and no tracking pixels. It runs one analytics tool, Google Analytics, and it does not start until you press Accept on the banner. Decline and nothing loads: no cookies are set, no request goes to Google, and the banner does not come back. Your choice is remembered in your own browser and can be changed at any time in section 2.
Two things still happen at the network level, because they happen for any website, and they are listed here rather than left out:
- Server and network logs. The hosting provider and the network provider described in section 8 record the requests that serve you the page, including IP address, timestamp, the page requested, the referring page and the browser's user-agent string. These logs exist to deliver the site, to keep it available and to stop abuse. They are not read to build a profile of you, are not combined with anything else, and are not used for marketing;
- Fonts. The two typefaces used on this site are served from this domain. No request goes to Google Fonts or to any other third party, and loading them discloses your IP address to nobody.
2Cookies and browser storage
Nothing is written to your browser until you act. Two entries are possible, and both come from a button you press yourself:
| Name | What it holds | Set when | How long |
|---|---|---|---|
analytics-consent | The word granted or denied. Your answer to the banner, nothing else | Only when you answer the banner | Until you clear your browser storage |
theme | The word light or dark. Nothing else. No identifier, no visit count, no reference to you | Only when you press the switch | Until you clear your browser data |
Google Analytics, and only after you agree
If you press Accept, this site loads Google Analytics 4 (property
G-XMRWS4BWHZ). It sets its own cookies, _ga and
_ga_XMRWS4BWHZ, which live up to two years and hold a random
identifier used to tell one browser from another. IP addresses are truncated
before storage. What it records is ordinary web analytics: pages viewed, how
you arrived, approximate region, browser and device. It does not read anything
you type, and this site sends it no email address, name or form content.
Google Ireland Limited acts as our processor and Google LLC may process the data in the United States under the EU-U.S. Data Privacy Framework. The legal basis is your consent, Article 6(1)(a) GDPR, and consent is the only reason any of it runs.
Changing your mind. Press the button below to forget your answer. The banner will appear again on the next page load, and declining stops Google Analytics from loading at all.
It never leaves your device. It is not sent to the server, not shared, and cannot be read by any other site. Because it stores a preference you asked for by pressing the control that sets it, it falls inside the exemption in Article 5(3) of the ePrivacy Directive and no consent is required. Clear it by clearing site data for this domain, or press the switch back.
Beyond that entry, nothing is stored in your browser by this site.
If that ever changes, if a measurement tool or an advertising tag is added, this notice is updated before the change takes effect, the entry is named here with its purpose and lifetime, and anything that is not strictly necessary is set only after you say so.
3Correspondence and onboarding calls
Email sent to alex.kuguk@evadava.com is stored in Google Workspace. Purpose: answering it and keeping a record of what was agreed. Legal basis: legitimate interest in handling business correspondence, or performance of a contract where one exists.
Booking a onboarding call means giving a name, a work email, a company, and whatever you choose to say about what you sell. That creates a calendar entry, an invitation to you, and a meeting link. Purpose: arranging and holding the call you asked for. Legal basis: taking steps at your request before entering into a contract, Article 6(1)(b), and legitimate interest in keeping business records.
4The outbound work
This is the service. Stated plainly: people at companies matching a buyer profile agreed with a client are identified, and contacted by email from a mailbox on that client's own domain, in the name of Alexander Kuguk, with a signature reading Outbound for that client.
The data involved is business contact data:
- name and job title;
- employer, and public information about that employer;
- business email address at that employer;
- the content of a reply, if you send one;
- a meeting record: the fact of the meeting, its time, and notes about fit.
No special categories of data under Article 9 are collected or used. No data about children. No personal email addresses. No profiling that produces legal effects, and no automated decision-making within the meaning of Article 22.
Volume is capped by design, and the caps are part of the answer to whether this is proportionate: no more than seven messages to any one person in a sequence, and three by default, no more than fifty emails a day from any one sender, and a further message on a dead thread is never sent.
5Controller or processor
This is the part that decides who answers for what, so it is set out first and without hedging.
For the campaign data: the prospects, the messages, the replies and the meeting records, the client is the controller and EVA DAVA EOOD is the processor. The client decides who is contacted and why, by signing off the buyer profile, the criteria, the messaging and the exclusion list in writing before anything is sent. EVA DAVA carries that decision out on the client's documented instruction, sends from the client's own domain, and writes the records into the client's own CRM. That processing is governed by the Data Processing Agreement.
Sourcing a prospect is part of the same instruction and not a separate purpose: the profile that defines who is looked for is the client's, it is written down before the search begins, and the records land in the client's system. The client is the controller from the first record to the last.
The one exception, and why it exists
EVA DAVA is an independent controller of one thing only: the permanent suppression list: the record of addresses that asked never to be contacted again.
It has to be that way. A suppression list that belonged to one client would be deleted when that engagement ended, and the same person would be contacted again for the next client. Keeping it separately, across all clients and beyond the end of any engagement, is the only way an objection can actually be permanent. Its purpose is honouring objections, and it is used for nothing else. It holds the address, the date and the fact of the request, and no more.
6Legal basis and the balancing test
The legal basis for the outreach is legitimate interest, Article 6(1)(f): the client's legitimate interest in offering a relevant business service to a business contact whose role makes the offer relevant, with EVA DAVA acting on the client's instruction. Recital 47 records that direct marketing may be a legitimate interest.
Article 6(1)(f) is not a label to be claimed; it requires an assessment, and the assessment has to exist in writing before the processing starts. Here it is. It is repeated for each client against that client's own profile, kept on file, and made available to a supervisory authority on request.
Purpose test: is the interest legitimate
The interest is reaching a named decision-maker with a business proposition inside their professional remit. It is lawful, it is real rather than speculative, and it is the client's own commercial interest in selling to businesses. The recipient is contacted in their professional capacity, at their employer, about something that falls within what they are paid to decide.
Necessity test: is it needed
To reach a specific decision-maker at a specific company about a specific offer, there is no less intrusive means that achieves it. Advertising does not reach a named individual; consent cannot be obtained from someone you have no contact with, which would make the requirement circular. The processing is limited to what the purpose needs: business contact data only, no enrichment beyond role and employer, no personal addresses, no special categories, a fixed number of messages agreed before the first send, three by default and seven at the most, and then silence.
Balancing test: the effect on the individual
| What weighs against the processing | What limits it |
|---|---|
| The email is unsolicited and was not asked for | Three messages by default and never more than seven. The thread stops at the agreed length, and a further message on a dead thread is never sent |
| The recipient did not give their address | The source of the address is named in the message itself, at the first contact, as Article 14(3)(b) requires |
| Data was collected without the recipient's knowledge | Only business contact data, from sources the recipient's employer publishes or that publish business roles. Nothing private, nothing inferred about the person outside work |
| A recipient may reasonably not expect it | A person in a named commercial role at a B2B company can reasonably expect business approaches at their work address. That expectation does not extend to a personal address, which is why none is used |
| Repetition is what makes cold outreach intrusive | Fifty emails a day per sender, and one contact appears in one sequence. Nobody is entered into a second campaign for the same client |
| An objection could be ignored or slow-walked | One-click opt-out in every message and in the mail client's own header. Actioned the same business day, permanently, across every client. US law allows ten business days and they are not used |
| Harm from a mistake, such as a wrong or personal address | Exclusion lists applied before the first send, addresses verified before use, and bounce and complaint thresholds that stop the sending outright at 2% and 0.1% |
Outcome. The interests and fundamental rights of the recipient are not overridden. The processing is narrow, it is business-context only, its effect on the individual is a small number of emails they can end with one click, and the safeguard that makes the balance hold is that an objection ends it immediately and without argument. Where an objection is received, the balance no longer needs to be assessed: the processing stops.
Where a recipient's national law requires consent rather than legitimate interest for a particular category, such as individual subscribers, sole traders and unincorporated partnerships in the United Kingdom, that category is excluded from sending rather than justified under this assessment.
7Where the address came from
Because the data is not collected from you, Article 14 applies: you are entitled to know the source, and to be told at the first contact. Every message names its source in a line of its own. The sources are:
- your employer's own website, including team, leadership and contact pages;
- public professional profiles, where a role and an employer are published by you or by your employer;
- public company registers and official filings;
- published job postings and public company announcements, which is often what identifies a company as relevant in the first place;
- licensed business-contact databases, which supply a business address at a named employer;
- the format of business addresses at your employer, where an address is derived from a published pattern and then verified as deliverable before use.
No address is bought from a source that cannot say where it came from, and no address is taken from a data breach, a scraped personal account, or a private mailbox.
8Sub-processors
These are the parties that process personal data on behalf of EVA DAVA EOOD, or alongside it. Each is under a written data processing agreement.
| Party | What for | Where |
|---|---|---|
| Google Ireland Limited | Google Workspace: the mailboxes on client domains, calendar, meetings, documents and correspondence | EU, with transfers to the US |
| Microsoft Ireland Operations Limited | Microsoft 365 and Exchange Online: the second half of every mailbox pack, so that no single vendor holds all of it | EU, with transfers to the US |
| Domain registrar and DNS | Domain registration in the client's name, DNS, and the network in front of this website | United States, with EU edge |
| Website host | Hosting of this website and its server logs | United States |
| Prospect data provider (named in writing before the engagement starts) | Business contact data and outbound sequencing | United States |
| Email verification provider (named in writing before the engagement starts) | Checking that a business address is deliverable before anything is sent to it | Outside the EEA, under SCCs |
Transfers outside the European Economic Area rely on the European Commission's Standard Contractual Clauses (Decision 2021/914), and on the EU-US Data Privacy Framework where the recipient is certified under it. A transfer impact assessment is available on request.
No personal data is sold, and none is shared for advertising. The list above is the whole list. Four of the six are described by function rather than by name, and the two that touch prospect data are named in writing before the engagement starts; there is no undisclosed layer beneath it.
Clients are given thirty days written notice before a sub-processor is added or replaced, and may object, under clause 8 of the Data Processing Agreement.
9How long anything is kept
| What | How long |
|---|---|
| Server and network logs for this website | Up to 30 days, then overwritten |
| Onboarding call booking records | 24 months from the call, unless a contract follows |
| Correspondence | For as long as the business relationship requires, then the retention period Bulgarian accounting law requires for anything with a financial record attached |
| Prospect records held for a client | As the client instructs. Where the client gives no instruction, 12 months from the last contact, unless a conversation is still running. Recorded in the agreement either way |
| Everything held for a client at the end of an engagement | Returned or deleted within 30 days, at the client's choice, under clause 14 of the Data Processing Agreement |
| Campaign metrics after an engagement | Kept only in anonymised, aggregated form: rates and counts, nothing that identifies the client or any prospect |
| The permanent suppression list | Kept indefinitely, and deliberately. Deleting it would mean contacting the person again |
10Objecting and opting out
Three ways, all of them equal: click the unsubscribe link in the message, reply and say so in any words, or write to alex.kuguk@evadava.com.
The unsubscribe link is one click. There is no login, no form, no preference centre and no question about why. It is also carried as a List-Unsubscribe header, so the unsubscribe control built into your own mail client works.
What then happens:
- the address is suppressed the same business day. Article 21(3) requires the processing to stop; US CAN-SPAM allows ten business days for it, and they are not used;
- the suppression is permanent and applies across every campaign for every client, not only the one that produced the request;
- it is written into the client's own CRM against your record, so the suppression stays with them and survives the end of the engagement;
- you are not asked to justify it, and there is no argument. Under Article 21(2) an objection to direct marketing is absolute;
- the one thing not deleted is the suppression record itself, cut down to the address, the date, and the fact of the request. That record is what makes the promise keepable.
Complaining to a mailbox provider by pressing its spam button also works: it registers, and it counts towards the 0.1% complaint threshold that stops a campaign outright.
11Your rights
Under the GDPR you may ask for:
- access to the personal data held about you, and a copy of it (Article 15);
- rectification of anything wrong: a wrong employer, a wrong role (Article 16);
- erasure (Article 17). Where processing rests on legitimate interest and you object to direct marketing, erasure follows, subject only to the suppression record described above;
- restriction of processing (Article 18);
- portability, where it applies (Article 20);
- objection at any time to processing based on legitimate interest (Article 21). For direct marketing this right is absolute and no balancing applies.
Write to alex.kuguk@evadava.com. A reply follows within 30 days, and usually a great deal sooner. There is no charge.
Where the data is held for a client and EVA DAVA is the processor, a request received directly is passed to that client within two business days and you are told who they are, because they are the controller and it is their decision to make. An objection to marketing is actioned immediately in either case, without waiting for anyone.
You may complain to the Bulgarian Commission for Personal Data Protection, cpdp.bg, or to the supervisory authority in the country where you live or work.
12Changes to this notice
This notice carries a version number and a date. A material change is published here before it takes effect. Previous versions are supplied on request.
EVA DAVA EOOD · UIC 207945177 · 9 Gen. Gurko Str., floor 1, 8000, Burgas, Bulgaria
Alexander Kuguk · alex.kuguk@evadava.com