Privacy notice
1. Controller
TOKKA EOOD, EIK 202830250, Acad. Jordan Trifonov Str. 7B, 1700 Sofia, Bulgaria – email contact@unvexa.com.
2. Cookies and analytics
Analytics runs on our public pages, but not on the reservation form: the home page /,
/en/, /bg/, /ro/, /eic/, /bg/isun/,
/agencies/, /rfp/, /rfp/details/, /en/review/, /en/review/thanks/,
/partners/, this notice (/privacy/), the provider list
(/privacy/providers/), the security page (/security/) and the terms
(/terms/). On your first visit to one of them a banner asks whether you accept
Google Analytics cookies. The three buttons, "Accept statistics", "Necessary only" and "Choose", are
equally easy and equally visible; "Choose" opens two switches, one for statistics and one for advertising
measurement, each off until you turn it on.
Until you choose, nothing is requested from Google and no cookie is set. Choosing only what is
necessary changes nothing in how the site works.
If you accept, Google Analytics 4 (GA4) sets two first-party measurement cookies,
_ga and _ga_ZKD23B08SE, kept for 180 days from your last visit. We use
them to tell visits apart and to see which pages are read, how visitors move between them, where
they come from, how far pages are scrolled, and which outbound links and downloads are used. For
this, your browser sends Google your IP address, from which Google estimates your approximate
location, and your device and browser type. If you decline, no analytics cookie is set and no
request is sent to Google.
Your statistics choice is remembered in one cookie of ours, site_consent, which holds only the
word "granted" or "denied" and is kept for 180 days from the day you chose. Your advertising measurement choice
is remembered in a second cookie of ours, site_ad_consent, with the same two possible words and the
same lifetime. Each is set when you make that choice: the statistics cookie when you press "Accept statistics", "Necessary only"
or Save; the advertising cookie only when you press "Necessary only" or Save ("Accept statistics" leaves it unset,
which counts as not having agreed to advertising measurement). We keep them only so that your choice is respected and we do not ask
again; they are not used to follow you. The legal basis for these two cookies is our legitimate interest in
respecting your choice (GDPR art. 6(1)(f)).
You can change your choice at any time with the "Change your cookie choice" link in the footer of the pages listed above. If you later choose "Necessary only", or save with statistics off, the Google cookies are removed. You can also delete cookies in your browser at any time.
The reservation form (/rfp/start/) loads no analytics, sets no cookie and shows no
banner; if you accepted on a page before it, Google's cookies stay in your browser as described above, but
nothing is sent to Google from the form. Visits to our public pages are in addition counted from our server logs, and on our ad landing pages the
organisation behind the network a visit comes from is looked up, whether or not you accept, as described below. The
/owner/ area is a private sign-in area for the site's operator, not for
visitors; only when someone signs in there does it set two cookies needed for the sign-in itself
(__Secure-owner_flow, ten minutes, and __Secure-owner_session, for the
signed-in session).
Advertising measurement is a separate choice under "Choose", off unless you switch it on; "Accept statistics" does not switch it on. Its purpose is to let us later measure whether one of our advertisements led to a reservation, and its legal basis is your consent. If you switch it on and you reached our site from one of our advertisements, we keep the advertisement's click code (for example the "gclid" that Google adds to the address) in your browser, in this browser tab only, until you close the tab. If you make a reservation from this tab, the click code is passed to the reservation form. You may then tick a separate box on the confirmation page; without that tick nothing about your reservation is used for advertising measurement. At present nothing is sent to any advertising platform, because no advertising provider is on our provider list yet. Before that ever changes, the platform will be named on the provider list and this notice will be updated. If you do not switch advertising measurement on, the click code is removed from the address in your browser and we do not keep it there. (Our hosting provider's server log, described below, still records the address your browser first asked for, which contains the click code.)
Legal basis: your consent (GDPR art. 6(1)(a) and the rules on storing information on your device), which you can withdraw at any time without affecting the lawfulness of processing before withdrawal. Google acts as our processor for Google Analytics and processes this data in the United States. The transfer relies on the EU Standard Contractual Clauses in Google's data processing terms. Google keeps the analytics event data for 2 months.
Separately, Google Search Console tells us which search terms led to this site and which pages were shown; it reads no cookie and sets none.
The reservation form records first-party usage events on our own server: which steps you reach, which kind of request the form recognised in your step-1 text, the campaign tags and page version of the link you came from, and a keyed hash and a length class of that text – never the text itself, unless you submit it. It sets no cookie and uses no third party. Raw events are kept for 90 days; after that only counts are kept.
Server logs. Like every website, ours is served by our hosting provider, which records each request in a server log: your IP address, the time, the page and link you asked for, the page you came from, and your browser type. Our hosting provider keeps these logs for a period it sets; its control panel shows us up to the last 7 days. We read a copy of these logs on our own systems to count visits, and delete our copy after each count (at the latest 7 days later if a count fails). For this we set no cookie and run no script; the analytics described above is separate and runs only if you accept.
Visit totals. We count visits to our public pages per day: by page, by referring
website, and by the campaign and ad details in the link of an ad you clicked (campaign, ad group,
keyword, match type, device type, ad network), each as a separate total; for the
/rfp/ and /rfp/details/ pages also by country. This lets us see whether
our ads bring visitors. We keep only the daily totals, and show totals under 5 as "<5".
Which organisation a visit comes from. When you open one of our ad landing pages
(at present /eic/), our server looks up your IP address in a table we built from
IPinfo Lite, a public database of internet networks, and keep on our own server; your IP address
is not sent to anyone for this. We record the date (not the time), the page, the campaign and
keyword of the ad link, and the name, type (company, university or public body) and country of the
organisation that holds the network. If the network belongs to an internet, mobile or hosting
provider, or its holder may be a private person, we record only "private visitor". Your IP address
is not stored in this record. We use these records only to understand which kinds of organisations
our pages and ads reach. We do not build profiles of individuals, do not link visits to each other
or to a reservation, give the records to no one, and never use them to contact anyone. We delete
each record after 90 days.
Legal basis for all three: our legitimate interest in running the site securely, in knowing whether our advertising works and in understanding which kinds of organisations it reaches (GDPR art. 6(1)(f)). We have weighed this interest against your interests and rights and keep that assessment on file.
Your right to object. You can object at any time to this use of the server logs and to the organisation lookup (GDPR art. 21). Because we do not keep your IP address, we cannot find your past visits by it. Write to contact@unvexa.com and name your organisation: we delete the visit records held under its name and stop recording it from then on. We act within one month.
3. When you write to us
If you email contact@unvexa.com, we process your name, email address, and whatever you write or attach, to answer you and to prepare the free fit check.
Legal basis: steps at your request before a contract (art. 6(1)(b)), and our legitimate interest in answering business enquiries (art. 6(1)(f)). Our hosting and email providers store the website, reservations and our mailboxes (see section 7). The website and reservations are stored in the EU/EEA; we will state where our mailboxes are stored once the provider confirms it and tell you if it is outside the EU.
4. When you order a package
We process the documents you supply to prepare your bid. They may contain personal data of your staff or experts (CVs, qualifications, references).
For your own company's data we act on the contract with you (art. 6(1)(b)); personal data of your staff or experts (e.g. CVs) is processed only after your contract with us is confirmed, never at reservation; after that we act as your processor (art. 28) for your order, and as a separate controller for the learning use described in section 4b – you are responsible for having a lawful basis to share it with us. Free fit check, before any contract. To prepare your free fit check we send two things to our AI service provider, as our processor under data-processing terms: the buyer's request documents (for example the call text or the RFP), and the details of your request that you gave us when you reserved, cut down to company details and a short description, with email addresses, web addresses and phone numbers removed, and the contact names you gave us removed. We do not send any document of your own, and no CV or other personal data of your staff or experts, to any AI provider until you confirm an order under a contract. The buyer's documents can themselves contain names and work contact details of the buyer's staff; we use them only for the fit check. Processing by our AI service provider takes place in the United States under the EU Standard Contractual Clauses included in its data-processing terms. The current list of providers is available on request and on our provider list (/privacy/providers/). Your documents, and the facts and ideas in them, are never shown, quoted or reproduced in work for another customer, and never used to train or fine-tune any AI language model. After you order, we also learn from them to improve our service (section 4b). We store what you send when you reserve a place on our own systems and with our hosting provider. The step-1 description is kept only if you submit the form. To limit automated sign-ups and to rate-limit usage events, the form keeps a pseudonymous, keyed hash of your IP address (not the address itself); the key changes every day, the hash is still personal data, and it is deleted after 24 hours (sooner if your reservation is erased). When you reserve a place, the VAT number you give is checked against the European Commission's VIES service, which returns the registered name and address.
After you confirm your email address, the form offers a separate, unticked option to receive product updates from us by email. It is never required for a reservation. Legal basis: your consent (art. 6(1)(a)). You can withdraw it at any time by writing to contact@unvexa.com; we then stop sending updates.
Review waitlist. If you ask through the reservation form to be told when the review of a declined application opens, we use your email address only to send you the confirmation link and, later, that one message. Legal basis: your consent (art. 6(1)(a)), given when you confirm your email; you can withdraw it at any time by writing to contact@unvexa.com. We delete the request 180 days after you made it, whether or not the review has opened by then.
4a. Documents we collect from public sources
What we collect and where from. To research how EU and national funding programmes work, we download funding proposals, project documents and related records that programmes, projects and repositories have published on the open internet. We did not receive them from you. We keep each document as it was published, together with its source address and the date we downloaded it. The controller is the company named in section 1.
Whose data and what data. People named in those documents: for example project staff, researchers, experts and consultants. The data can include name, role, organisation, professional background (for example a CV) and work contact details. The source is a publicly accessible one.
Why, and on what legal basis. Programme research and intelligence: understanding how proposals are built and how programmes, calls, organisations and results relate, so that we can improve our service. The legal basis is our legitimate interest (GDPR art. 6(1)(f)). We have weighed it against your interests and rights and keep that assessment on file. We use what we learn at the level of organisations and roles. We do not build profiles of individuals, we do not contact anyone named in these documents, and we do not publish or pass on their personal data.
Who receives it. Our AI providers, as our processors (section 7 and the provider list). They may process it in the United States under the EU Standard Contractual Clauses included in their data-processing terms. We do not show these documents to our clients.
How long. As long as needed for this research, and deleted on request.
Why we do not tell each person individually. These documents name very many people, often without current contact details, and our use has no effect on any of them as individuals. Informing each person would involve a disproportionate effort (GDPR art. 14(5)(b)), so we publish this information instead.
Your right to object. You may object at any time to our use of documents that name you (GDPR art. 21). Write to contact@unvexa.com and name the document or project. We then delete or exclude the documents naming you within one month, unless we show compelling legitimate grounds.
Your other rights. You may ask us for access to your data, for erasure, and, if data is inaccurate, for rectification. We keep documents as published and do not edit them, so we meet a rectification request by deleting or excluding the document. Write to the same address (contact@unvexa.com). You may complain to the Bulgarian Commission for Personal Data Protection (section 6).
4b. Reviews of declined applications, and learning from client documents
What you send for a review. When we agree in writing to review a declined application of yours, you send us the application as you submitted it and the evaluation summary report (ESR) you received for it. We use them to prepare your review.
Learning is part of the service. Every order, whatever the programme, is made under our terms, and our terms include this learning use. There is no separate consent and no opt-out for your company's information. We learn from what you send for an order, from the result of the application or bid, and from any evaluation report such as an ESR, to improve our service for all customers.
What learning means. From these documents we work out general results: totals (counts and averages across orders), weights (numbers that tell our software how much a factor matters) and check definitions (rules our software applies to each new package). Only these general results are used in work for other customers. No customer's text, facts or ideas reach another customer's work. Your documents are never shown, quoted or reproduced for anyone else, never published, and never used to train or fine-tune any AI language model.
Two copies. We keep the documents as you sent them. For learning we may also keep a second copy in which names are masked. That copy is still personal data: it is pseudonymised, not anonymised, because we can link it back to the original.
Whose data, and where it comes from. Your documents can name people: your staff, partners and experts (for example in a CV), and sometimes contact persons of a funder or buyer. We hold their name, role, professional background and work contact details as they appear in the documents. We receive these from you, not from the people named. When you upload documents, you confirm that you are entitled to share this data with us and that the people concerned gave their consent, as set out in our terms. We build no profile of any individual and do not contact anyone named in your documents.
Legal basis. For personal data: our legitimate interest in improving our service (GDPR art. 6(1)(f)), weighed against the interests and rights of the people concerned in a written assessment we keep on file. For your company's own business information, which is not personal data: our contract with you. For this learning use we are a separate controller, not your processor.
Right to object to learning. Anyone named in your documents may object at any time to the use of their personal data for learning (GDPR art. 21), by writing to contact@unvexa.com. We then exclude their data from learning, and reply within one month. Learning on the rest of the documents continues.
Recipients and storage. Our AI service provider, as our processor under data-processing terms, processes the documents in the United States under the EU Standard Contractual Clauses. Our hosting and email providers store what you send through the form or by email (section 7). On our own systems the documents are kept in encrypted, access-controlled storage. Nothing is sold.
How long. We keep the documents as received and the learning copy; neither is deleted automatically or on a schedule. We keep them as long as they help us improve the service and as long as we may need them to establish, exercise or defend legal claims. How to ask for deletion: section 5.
5. How long we keep data
We keep the documents you send for an order, as received, and the learning copy described in section 4b; they are not deleted automatically. Reservations, and the emails you send us, are kept and are not deleted automatically. Invoices and accounting records: as required by Bulgarian accounting law. Raw usage events of the reservation form: 90 days, then only counts. Analytics (only if you accepted): the cookies for 180 days from your last visit; the event data at Google for 2 months. Server logs at our hosting provider: for a period it sets (see section 2). Our copy of a server log: deleted after each count, at the latest after 7 days. Daily visit totals: 24 months; they contain no personal data. Records of which organisation a visit came from (section 2): 90 days, then deleted. Review waitlist requests: 180 days from the request.
How to ask for deletion. Write to contact@unvexa.com and say what you want deleted, for example a reservation, the documents of an order, or your personal data in a customer's documents. We deal with each request when it arrives. We delete what the law requires us to delete, tell you what we must keep and why (for example accounting records, or documents needed for a legal claim), and reply within one month.
6. Your rights
You have the right of access, rectification, erasure, restriction, objection and data portability (GDPR arts. 15–21), including withdrawing analytics or advertising consent at any time. Write to contact@unvexa.com. You may complain to the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни, www.cpdp.bg).
7. Providers we use
We use service providers in the categories below. Which provider currently fills each category (we name our AI provider on request), where it processes data and since when is on our provider list, /privacy/providers/, which is dated and versioned.
| Category | What it does | Your data it handles | Where |
|---|---|---|---|
| Hosting and email providers | Store and serve this website, keep its server logs, store reservations and the files uploaded through the form, hold our mailboxes and send the reservation emails | Server-log data (section 2); what you enter and upload in the form; emails you send us and our replies | Website and reservations: EU/EEA (Germany). Mailboxes: location to be stated once the provider confirms it (see the provider list) |
| Domain and DNS providers | Register our domain name and point browsers and mail to our hosting and email providers | None of your personal data from us; they hold only our company's registration details | USA |
| Analytics provider (Google) | Site analytics on the public pages named in section 2 – only after you accept (section 2); search performance reports (Search Console, no cookies) | As described in section 2 | USA |
| AI providers | AI processing of tender and customer documents (sections 4 and 4b) | Before a contract: the buyer's request documents and your request details (cut down, no contact data you gave us). None of your own documents. After you order: the documents you send for the order, also for learning (section 4b) | USA |
| Payment providers (when we take payments) | Processing your payment | Payment details, name, billing address and amount | Named on the provider list before the first payment |
Every provider that processes personal data on our behalf must meet all of these criteria:
- it is bound by a data-processing agreement that meets GDPR art. 28: it acts only on our documented instructions, keeps the data confidential, helps us respect your rights, and deletes or returns the data when the service ends;
- it uses the data only to provide its service to us and never sells it; if it handles your documents, it never uses them for advertising or to train AI models;
- where it processes data outside the EU/EEA, it does so under a safeguard the GDPR recognises (today, the EU Standard Contractual Clauses), as the table above and the provider list say;
- it protects the data with security measures appropriate to the risk (GDPR art. 32).
A provider may also keep limited data under its own responsibility, for example to protect its service against abuse or to meet its legal obligations; its own privacy notice covers that. Payment providers usually act partly in their own right in this way, for fraud prevention and legal duties. A domain or DNS provider receives none of your personal data from us; if that ever changes, it must meet the criteria above first.
A new provider that fits a category and these criteria is added to the provider list without changing this notice. A new category, a new country outside the EU/EEA or a different transfer safeguard is a change to this notice. Business customers whose personal data we process under our data-processing annex are told in writing before a new provider receives that data, and may object.
Version: 6 October 2026 (eighth edition).