Trust
Privacy Policy
How Insights Hive LTD collects, uses and protects personal data.
Draft for legal review. This policy is complete in structure and substance, but several details are still to be confirmed and the whole document must be reviewed by a qualified adviser before publication.
Last updated
1. Who we are
Insights Hive LTD ("Insights Hive", "we", "us") is a company registered in Bulgaria, with its registered office in Sofia, Bulgaria.
- Registered name: Insights Hive LTD
- Registered office: Sofia, Bulgaria
- Company registration number (UIC/EIK)
- Contact for privacy matters
- Data protection officer
2. What this policy covers
This policy explains how we handle personal data for which we are the controller: visitors to this website, people who contact us, and people we deal with commercially.
It does not govern personal data that our customers process using the Insights Hive platform. For that data the customer is the controller and we act as processor on their documented instructions, under the data processing agreement in their contract. If you are an employee of one of our customers and want to know how your data is used in the platform, please contact your employer.
3. Personal data we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Enquiry data | Name, business email, company, role, country, store estate size, and anything you write in a message or demo request | You, via our forms |
| Commercial contact data | Business contact details and records of our correspondence and meetings | You, or publicly available business sources |
| Website usage data | IP address, browser and device type, pages visited, referring page, and approximate location derived from IP | Automatically, when you use the site |
| Recruitment data | Anything you send us if you apply for a role | You |
This website uses Google Analytics 4 to understand how the site is used — which pages are read, how visitors arrive, and which content leads to a demo request. Google Analytics sets cookies and processes your IP address. Google acts as our processor for this data, and Google Ireland Limited is the contracting entity for visitors in the European Economic Area. No other analytics, advertising or chat tools run on this site.
4. Why we use it, and our lawful basis
| Purpose | Lawful basis (Article 6 GDPR) |
|---|---|
| Responding to your enquiry or demo request | Steps at your request prior to entering a contract (Art. 6(1)(b)), or our legitimate interest in responding to business enquiries (Art. 6(1)(f)) |
| Managing our relationship with customers and partners | Performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) |
| Operating, securing and improving this website | Legitimate interests in running a secure, functioning website (Art. 6(1)(f)) |
| Sending business communications about our services | Consent where required (Art. 6(1)(a)), or legitimate interests in business-to-business marketing (Art. 6(1)(f)) |
| Meeting legal, tax and accounting obligations | Legal obligation (Art. 6(1)(c)) |
| Establishing or defending legal claims | Legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and you may object at any time (see section 8).
5. Store imagery
The Insights Hive platform analyses photographs of retail shelves. It is designed to identify products, prices and shelf conditions. It does not perform facial recognition and does not identify individuals.
Photographs taken in a working store may nonetheless capture people incidentally. Where that happens in a customer deployment, the customer is the controller for that imagery and we process it only on their instructions.
6. Who we share it with
We do not sell personal data. We share it only with
- Service providers acting as our processors — hosting, email, and business tooling — bound by contract to process data only on our instructions. This includes Google, for website analytics (see sections 3 and 10).
- Professional advisers such as accountants and lawyers, where necessary.
- Authorities, where we are legally required to do so.
7. Where your data is processed
We are established in Bulgaria and process personal data within the European Union. Our hosting is located in the EU.
If any provider processes data outside the European Economic Area, we put an appropriate transfer mechanism in place, normally the European Commission's Standard Contractual Clauses, together with any additional safeguards required.
Google Analytics is the one such case today. Google Ireland Limited is our contracting entity in the European Economic Area, and data may be transferred to Google LLC in the United States under the EU–US Data Privacy Framework and Standard Contractual Clauses.
8. How long we keep it
- Enquiries that do not become a commercial relationship
- Customer and partner records: for the duration of the relationship and then as required for legal, tax and accounting purposes (in Bulgaria, generally up to 10 years for accounting records)
- Website usage data
- Recruitment data
9. Your rights
Under the GDPR you have the right to access your personal data; to have inaccurate data corrected; to have data erased in certain circumstances; to restrict or object to processing; to data portability; and, where we rely on consent, to withdraw that consent at any time without affecting processing already carried out.
To exercise any of these rights, contact us at . We will respond within one month, and will tell you if we need longer.
If you are not satisfied, you may complain to the Bulgarian supervisory authority
- Commission for Personal Data Protection (Комисия за защита на личните данни)
- 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria — cpdp.bg
You may also complain to the supervisory authority in your own country of residence.
10. Cookies
This site sets strictly necessary cookies required for it to function, and analytics cookies set by Google Analytics 4 (see section 3). The analytics cookies record which pages are viewed, how long visitors stay and how they reached the site. They are not used for advertising and we do not sell or share this data.
You can block or delete cookies in your browser settings, and Google publishes a browser opt-out add-on for Google Analytics.
11. Security
We apply technical and organisational measures appropriate to the risk, described on our Security & Compliance page.
12. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed, and material changes will be highlighted on this page.
13. Contact
Insights Hive LTD, Sofia, Bulgaria