Privacy Policy

Who we are

Codeberry is the trading name (DBA) of KODPLOD OOD, a company registered in Bulgaria under company registration number 203382315 ("we", "us", or "our"). KODPLOD OOD is the controller of personal information processed for the purposes described in this policy.

This policy explains how we handle personal information when you visit codeberry.io, enquire about our marketing services, or communicate with us. Processing carried out on a client's behalf when delivering services is governed by the relevant client agreement and, where applicable, a data processing agreement.

Information we collect

Information you provide. When you contact us, we may receive your name, business email address, telephone number, company, role, and any information you include in your message, project brief, or other correspondence. Please provide only information relevant to your enquiry and avoid sending sensitive personal information unless we have agreed an appropriate way to receive it.

Technical information. Visiting the website may generate records such as your IP address, browser and device information, pages requested, referring page, and access timestamps. These records help operate and secure the website and diagnose problems.

Analytics information. We use Google Analytics and PostHog to understand how visitors find and use the website. These services can collect information about pages viewed, interactions, referring sources, browser and device characteristics, approximate location, and cookie or similar identifiers. PostHog also receives information about contact form submission outcomes, application errors, and diagnostic events. The sections below explain these services further.

Why we use information and our legal bases

We use personal information for the following purposes:

• Responding to enquiries and discussing projects: our legitimate interests in communicating with prospective clients and managing business relationships. Where you personally request steps before entering into a contract with us, we may instead rely on those pre-contractual steps.
• Administering agreed services and relationships: performance of a contract where you are personally a party, or our legitimate interests in administering a relationship with your organisation where you act on its behalf.
• Operating and protecting the website: our legitimate interests in maintaining a reliable website, troubleshooting, preventing abuse, and protecting our business and visitors.
• Measuring website use through Google Analytics and PostHog: consent where required for analytics technologies and related personal information processing, including session replay where enabled.
• Diagnosing technical problems through PostHog: our legitimate interests in maintaining a reliable and secure website, subject to consent where required for the technologies used.
• Sending optional marketing communications, if offered: consent where required by law; otherwise an applicable lawful basis for permitted business communications. You may unsubscribe or object to direct marketing at any time.
• Meeting legal obligations and handling claims: compliance with applicable legal obligations, and our legitimate interests in establishing, exercising, or defending legal claims.

Where we rely on legitimate interests, we consider whether your interests or fundamental rights override them. Providing enquiry information is voluntary, but without relevant contact and project details we may be unable to respond or take the steps you request.

Google Analytics and cookies

We use Google Analytics, a service provided by Google, to measure website traffic and visitor interactions and improve our content and website experience. Google Analytics uses cookies and similar technologies to distinguish visits and measure activity. Analytics information is processed by Google on our behalf under the applicable service terms and settings. Google may also process information for purposes described in its own policies, depending on the service and settings used.

Where consent is required, analytics cookies and related tracking require your prior consent. You may refuse or withdraw consent without losing access to the website's general information. Withdrawing consent does not affect the lawfulness of earlier processing.

You can manage cookies through your browser, although blocking strictly necessary cookies may affect website functions. Google also offers a Google Analytics opt-out browser add-on, which works with supported browsers. This add-on is an additional choice and does not replace any consent controls required on the website.

Learn more about how Google uses information from sites and apps that use its services and Google's Privacy Policy.

Strictly necessary cookies or similar technologies, where used to provide a function you request or keep the website secure, are distinct from optional analytics technologies. Merely visiting the website or reading this policy does not constitute consent to optional tracking.

PostHog analytics and diagnostics

We use PostHog, provided by PostHog, Inc., to understand website use, improve the visitor experience, and diagnose technical problems. Depending on the features enabled, PostHog collects page views, clicks and other interactions, referring pages, timestamps, browser and device information, IP-derived location information, and pseudonymous visitor and session identifiers. Cookies and local storage may be used to recognise a browser and connect activity across visits.

We also send events about whether an introductory call request was submitted successfully or failed, associated failure categories and response status codes, and whether an alternative meeting time was supplied. These custom events do not include the name, email address, or message entered in the form. Error tracking and diagnostic logs may include error messages, stack traces, page addresses, and technical context.

If session replay is enabled, PostHog may reconstruct a visit from page content and interactions such as clicks, scrolling, and navigation. This can include personal information visible on the page unless it is masked or excluded. Session replay is used to understand usability problems and investigate errors. Where consent is required, it must be obtained before recording begins.

Where required by law, PostHog analytics cookies, local storage, and related tracking require prior consent. You may refuse or withdraw consent without losing access to the website's general information. Withdrawal does not affect earlier lawful processing. Browser cookie controls alone may not disable local storage or stop tracking; contact us using the details below if you need help exercising your choices.

Our PostHog integration uses the EU service endpoint. PostHog states that its EU Cloud service stores customer event data in Frankfurt, Germany. This does not exclude other processing or transfers by PostHog or its service providers under the applicable agreements. Where a restricted international transfer occurs, the safeguards described below apply.

For more information, see PostHog's Privacy Policy and its privacy documentation.

Who receives information

We may share relevant information with service providers supporting website hosting, security, business email, communications, and analytics, including Google for Google Analytics and PostHog, Inc. for analytics, error tracking, diagnostic logs, and session replay where enabled. Providers acting on our behalf may process information only as authorised and subject to appropriate contractual safeguards.

Information may also be accessed by authorised personnel and professional advisers where necessary for their work, disclosed to authorities where legally required, or used to establish, exercise, or defend legal claims. In a proposed or completed merger, acquisition, or business transfer, relevant information may be shared subject to appropriate confidentiality and data protection safeguards and any required notice.

International transfers

Our providers, including Google and PostHog, may process personal information outside Bulgaria and the European Economic Area, including in the United States. Where a transfer is subject to GDPR restrictions, we use an applicable European Commission adequacy decision or appropriate safeguards such as the European Commission's standard contractual clauses, with supplementary measures where necessary. You may contact us for information about safeguards applicable to your information and how to obtain a copy, subject to lawful redactions.

How long we keep information

We keep personal information only for as long as reasonably necessary for its purpose. Enquiry correspondence is kept for the time needed to respond, follow up on the project, and maintain relevant business records. If a client relationship follows, relevant records may be retained for that relationship and any applicable legal retention or claims period.

Technical logs are kept for the period reasonably needed for security and troubleshooting. Analytics data is retained according to the Google Analytics property's configured retention settings; those settings and applicable cookie lifetimes determine how long identifiable analytics records and cookies remain. PostHog analytics events, error records, logs, and session recordings, where enabled, are retained according to the retention settings and limits applicable to each feature in our PostHog project. Cookie and local storage identifiers may have separate lifetimes. You may contact us for the current retention details for either service.

Where information is needed to meet a legal obligation or resolve a claim, we retain only what is necessary for that purpose. We delete or anonymise information when it is no longer needed.

Security

We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration, and disclosure. No internet transmission or storage system can be guaranteed completely secure.

Your rights

Subject to the conditions and exceptions in applicable law, you may request access to your personal information, correction, deletion, restriction of processing, and a portable copy of information processed by automated means on the basis of consent or a contract.

You may object, on grounds relating to your particular situation, to processing based on legitimate interests. You may object to direct marketing at any time. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.

To exercise your rights, use the contact details below. We may request information reasonably necessary to verify your identity. We normally respond within one month; if a lawful extension is necessary, we will explain it within that first month.

You may complain directly to Bulgaria's Commission for Personal Data Protection or the competent supervisory authority where you habitually reside, work, or believe an infringement occurred. You do not need to contact us first.

Children

This website and our marketing services are directed at business users and are not intended for children. If you believe a child has provided personal information to us, please contact us so we can assess and address it in accordance with applicable law.

External websites

Links to third-party websites are governed by those operators' privacy practices. Please review their policies before providing information to them.

Changes to this policy

We may update this policy as our website, practices, or legal obligations change. We will publish updates here and revise the date above, providing additional notice where required. A policy update does not itself provide consent for a new use of personal information.

Contact

For privacy questions or to exercise your rights, contact KODPLOD OOD, doing business as Codeberry, using the contact details published on codeberry.io.