Privacy Policy
Effective date: 30 September 2026
Last updated: 30 September 2026
This policy explains what personal data axialsys.com collects, why, and what your rights are. The site is operated by Axial Systems DPK (ДПК), which is the data controller for everything described here.
We have tried to keep this document specific. Every statement below describes something the site or its email service actually does.
Who we are
Axial Systems DPK (ДПК)
ul. “Braila” 8
Plovdiv, 4003, Bulgaria
Email: info@axialsys.com
Use that address for any privacy question or to exercise any of the rights described in “Your rights” below.
Because we are established in Bulgaria, the applicable law is the EU General Data Protection Regulation (Regulation (EU) 2016/679), the Bulgarian Personal Data Protection Act, and the cookie and electronic-communications rules in the Bulgarian Electronic Communications Act.
What data we collect
Data you give us
The site has exactly one form: the inquiry form, which appears in the contact section of the home page and on each product page. It collects:
| Field | Required | Notes |
|---|---|---|
| Name | Yes | |
| Organisation | No | |
| Email address | Yes | We reply to this address |
| Message | Yes | Free text, up to 4000 characters |
| Language | Yes, set automatically | Which language version of the site you used |
The form also contains one hidden field that is never shown to you and that a person never fills in. It exists only to detect automated submissions. If it arrives filled in, the submission is discarded and no email is sent.
We do not operate user accounts, logins, newsletters, payments or shopping functions, so we collect no credentials, no payment data and no subscription data.
Data collected automatically
Web server logs. Our web server records each request to the site in its access and error logs. These entries contain your IP address, the date and time, the page or file requested, the response status, the referring page and your browser’s user-agent string.
IP address in inquiry handling. When you submit the inquiry form, your IP address is included in the notification email we receive, and is written to the service’s own log alongside the language you used. Your IP address is also counted, in memory only, against a rate limit that allows five inquiries per IP address per hour; those counters hold nothing but an IP address and timestamps, expire after one hour and are lost when the service restarts. Our web server applies a second, similar rate limit keyed on IP address.
Analytics, only if you allow it. Google Analytics 4, loaded through Google Tag Manager, tells us which pages are read. Nothing is requested from Google and no analytics cookie is set unless you accept the analytics category in the cookie banner. If you accept, your IP address, the page you are on and your browser’s user-agent string are disclosed to Google as part of that request. If you decline, or simply never choose, no connection to Google is ever made.
Fonts are served from our own servers. The typefaces this site uses are hosted by us, not fetched from Google Fonts, so displaying a page sends nothing to any third party.
Data from third parties
We do not buy, rent or receive personal data about you from anyone else.
How we use it and the legal basis
| Purpose | Data used | Legal basis (GDPR Art. 6(1)) |
|---|---|---|
| Reading and answering your inquiry, and any correspondence that follows from it | Name, organisation, email address, message, language | Legitimate interests, Art. 6(1)(f) — responding to someone who has contacted us about our products. Where the exchange leads towards a contract, Art. 6(1)(b) |
| Detecting and blocking automated or abusive form submissions | IP address, hidden anti-bot field | Legitimate interests, Art. 6(1)(f) — keeping a public form usable and preventing it being used to send mail |
| Operating and securing the website, and diagnosing faults | Web server log data (IP address, timestamp, request, status, referrer, user-agent) | Legitimate interests, Art. 6(1)(f) — keeping the site available and investigating attacks and errors |
| Recording that you accepted or refused cookies, and honouring it | The axial_consent cookie: categories, timestamps, version, random consent ID | Art. 6(1)(c) and Art. 6(1)(f) — we are obliged to be able to demonstrate consent under Art. 7(1), and storing the choice is the only way to act on it. This cookie is strictly necessary and is set whichever way you decide |
| Remembering your product-list filter | The axial-family entry in your browser’s local storage | Consent, Art. 6(1)(a) — the functional category in the cookie banner. Withdraw it at any time and the entry is deleted |
| Measuring how the site is used | Google Analytics 4 page-view data and the _ga cookies | Consent, Art. 6(1)(a) — the analytics category in the cookie banner. Nothing is loaded from Google and no cookie is set until you accept |
Where the basis is consent you may withdraw it at any time through the Cookie settings link in the footer of every page, and withdrawing is as easy as granting. Withdrawal does not affect anything done while the consent was valid.
Cookies and similar technologies
We ask before we store anything that is not strictly necessary. On your first visit a banner appears with three equally weighted choices — accept everything, reject everything, or open the preferences and decide category by category. Until you choose, nothing optional runs: the Google Tag Manager tag is present in the page but inert, so no request goes to Google and no analytics cookie exists. Closing or ignoring the banner, scrolling, or clicking elsewhere on the page is not consent, and there is no cookie wall — the site is fully usable if you refuse everything.
Strictly necessary
Set regardless of choice, because it is what records the choice.
| Name | Provider | Purpose | Duration | Party |
|---|---|---|---|---|
axial_consent | axialsys.com | Stores which categories you accepted, when you accepted them, a policy version number and a random consent ID, so we can honour your decision and stop asking | 6 months | First party |
The consent record contains no IP address and nothing that identifies you personally. Its full contents are the accepted categories, a first and last consent timestamp, the revision number, the language you saw the banner in, and a randomly generated identifier that exists only to tell one consent record from another.
Functional — off unless you turn it on
| Name | Provider | Purpose | Duration | Party |
|---|---|---|---|---|
axial-family | axialsys.com | Remembers which product family you last filtered the line-up by. Local storage, not a cookie | Until you clear it | First party |
Declining costs you nothing: the filter works exactly the same during your visit, it simply starts fresh next time.
Analytics — off unless you turn it on
Accepting this category loads Google Tag Manager, which in turn loads Google Analytics 4. Neither is requested from Google before you accept.
| Name | Provider | Purpose | Duration | Party |
|---|---|---|---|---|
_ga | Distinguishes one visitor from another for traffic statistics | 13 months | Third party | |
_ga_9FPKS95JEQ | Keeps analytics session state for this site | 13 months | Third party |
These two durations are what Google’s own tag actually sets, measured in a browser rather than taken from documentation.
Changing your mind
Every page has a Cookie settings link in the footer. It reopens the same
preferences panel, and withdrawing is a single click — exactly as easy as
granting was. When you withdraw a category we delete what it placed on your
device: the _ga cookies are erased and the page reloads so the analytics
script stops running, and the line-up preference is removed from local storage.
You can also clear everything through your browser’s own site-data settings. If
you delete axial_consent, the site returns to its default state with
everything optional switched off, and the banner asks again.
We ask again after six months. A choice made half a year ago should not bind you indefinitely, so the consent cookie expires and the banner reappears. It also reappears if we add or change a service, because the stored record carries a version number and an out-of-date record is treated as no consent at all.
Google Consent Mode
As an additional safeguard, the site sets Google Consent Mode v2 to denied for
every storage signal before any Google code could run, and only relaxes the
signals you have agreed to. The three advertising signals — ad_storage,
ad_user_data and ad_personalization — are never granted and are not
offered as a category, because this site carries no advertising.
Who we share data with
We use two service providers, one of which is used only with your consent. We do not sell personal data, and we do not share it with anyone else.
We previously served this site’s typefaces from Google Fonts, which disclosed every visitor’s IP address to Google on every page view whether they wanted it or not. Those files are now hosted by us, and Google Fonts is no longer a recipient of any data.
| Provider | What it does for us | Country |
|---|---|---|
| Google (Google Ireland Limited, with processing by Google LLC) | Google Tag Manager and Google Analytics 4, for aggregate traffic measurement — only if you accept the analytics category. Your browser then fetches them directly from Google’s servers, which discloses your IP address and request data to Google. If you do not accept, no connection to Google is made at all | Ireland, with processing in the United States and elsewhere |
| Twilio SendGrid (Twilio Inc.) | Delivers the notification email generated by the inquiry form. The message contains the name, organisation, email address, language and message text you submitted, and the IP address the submission came from | United States |
The website itself is static and is served from a virtual server that we rent and administer ourselves; the same server runs the small service that handles the inquiry form. The provider of that server is a processor for hosting purposes and has no access to the data for its own purposes.
Beyond this, we may disclose personal data where we are legally required to do so, for example in response to a lawful request from a competent authority.
International transfers
Twilio SendGrid, and Google where you have accepted analytics, both involve the transfer of personal data outside the European Economic Area, principally to the United States. If you refuse the analytics category, no transfer to Google occurs at all.
We cannot state from our own records which specific transfer instrument applies to each of these providers. These transfers therefore rely on appropriate safeguards under Chapter V of the GDPR — in practice either the provider’s certification under the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses, as set out in the provider’s own data-processing terms. If you want to know which applies to a particular provider, write to info@axialsys.com and we will confirm it and update this policy.
Retention
| Data | How long |
|---|---|
| Inquiry emails and any correspondence that follows | For as long as needed to deal with your inquiry and to keep a record of the business relationship it may lead to. We have not set a fixed period; if you ask us to delete your inquiry, we will, unless we are legally required to keep it |
| Per-IP rate-limit counters in the inquiry service | One hour, and in any event only until the service restarts. They are held in memory and never written to disk |
| Web server access and error logs, and the inquiry service’s own log | For as long as they remain useful for security and fault diagnosis, after which they are rotated and deleted. We have not fixed a retention period for them in configuration |
Your consent record (the axial_consent cookie) | 6 months, after which it expires and we ask again. It is held on your device only — we keep no server-side copy, so we cannot retrieve or produce it ourselves |
The axial-family local storage entry | Until you clear it, or until you withdraw functional consent, at which point we delete it |
Google Analytics cookies (_ga, _ga_9FPKS95JEQ) | 13 months, as set by Google’s tag. Erased immediately if you withdraw analytics consent |
| Data held by Google and Twilio SendGrid | Governed by those providers’ own retention settings and terms, which we do not control from this site |
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you, and obtain a copy (Art. 15);
- rectification of data that is inaccurate or incomplete (Art. 16);
- erasure of your data, where one of the grounds in Art. 17 applies;
- restriction of our processing, in the cases listed in Art. 18;
- data portability — to receive data you provided to us in a structured, commonly used, machine-readable format (Art. 20);
- object to processing based on our legitimate interests, including the disclosures to Google described above (Art. 21); and
- withdraw consent at any time where processing is based on consent, without affecting anything done before you withdrew it (Art. 7(3)). For cookies, the Cookie settings link in the footer of every page does this in one click.
You are also not subject to any decision based solely on automated processing — see “Automated decision-making” below.
To exercise any of these rights, email info@axialsys.com. We will respond within one month of receiving your request. If the request is complex or you have made several, we may extend that by up to two further months, and we will tell you within the first month if we do. We may need to ask you for information to confirm who you are, so that we do not disclose your data to someone else.
If you are unhappy with how we have handled your data, you can lodge a complaint with the Bulgarian supervisory authority:
Commission for Personal Data Protection (Комисия за защита на личните данни)
Website: https://www.cpdp.bg
You may also complain to the supervisory authority in the EU or EEA country where you live or work.
Security
The measures actually in place are:
- The whole site is served over HTTPS, with certificates from Let’s Encrypt. Plain HTTP requests are redirected, and HTTP Strict Transport Security is set so browsers refuse an unencrypted connection.
- The site sends a Content-Security-Policy that restricts which origins may load
scripts, styles, fonts, images, frames and form submissions, together with
X-Content-Type-Options,X-Frame-Options,Referrer-Policyand aPermissions-Policythat denies geolocation, microphone and camera access. - The site is static: there is no database and no content management system behind it, so an inquiry you send is not stored in any system that is reachable from the internet.
- The service that handles the inquiry form listens only on the server’s loopback interface, runs as a dedicated unprivileged user under a restrictive systemd sandbox, and is reachable only through the web server.
- Our email provider’s API key is held in a root-owned, permission-restricted file on the server and is never sent to your browser. The inquiry form needs no credentials of its own because it cannot choose who the message goes to: both sender and recipient are fixed on the server.
- The inquiry endpoint is rate-limited at two levels, and everything you type is escaped before it is placed into the notification email.
- The consent cookie is first-party,
SameSite=Laxand markedSecure, so it is only ever sent over HTTPS and is not exposed to cross-site requests. - Administrative access to the server is by SSH key.
No system is perfectly secure, and we do not claim that this one is. We hold no certification for our information security, and we have not had these measures independently audited.
Children
The site presents equipment supplied to government and allied-defence customers. It is not directed at children, has no features aimed at them, and we do not knowingly collect personal data from anyone under 18.
Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects for you or otherwise significantly affects you. The only automatic decision the site makes is whether a form submission looks like a bot, based on the hidden field and the rate limits described above; a rejected submission simply means the message is not delivered, and you can always reach us by emailing info@axialsys.com instead.
Changes to this policy
If we change how the site handles personal data, we will update this policy and change the effective date at the top. Where a change materially affects you and we hold a means of contacting you, we will tell you directly.
Contact
Questions, requests and complaints about this policy or about your personal data:
Axial Systems DPK (ДПК)
ul. “Braila” 8
Plovdiv, 4003, Bulgaria
info@axialsys.com