1. Who we are and what this policy covers
ZAGATA BIO SISTEMS Ltd, UIC 175090144, registered office at 47 Bigla, Lozenets District, Sofia, Bulgaria, operates the TOHOL website and is the controller of personal data processed for the website and related communications described here. Contact us at office@tohol.org about your personal data or this policy.
This policy covers visits to the public TOHOL website and enquiries about CIRMS, demonstrations, partnerships and related business matters. It explains the information involved, the reasons for processing it and the choices available to you.
The public website does not require an account. It is not a customer CIRMS deployment or a service for uploading operational datasets. Processing within a customer deployment needs to be addressed separately in the relevant privacy notices and contractual arrangements.
Reading this policy or continuing to browse the website is not, by itself, consent to optional tracking or other processing that requires consent.
2. Information we handle and why
Enquiries and correspondence
When you submit the contact form or send us an email, we receive your email address, the contents of the message and the details you choose to include. The website form also allows up to 10 optional supporting attachments with a combined maximum size of 20 MB. The website form accepts standard business documents, spreadsheets, presentations, text/data files, images, diagrams, CAD and project files. Archives, executables, scripts and macro-enabled files are not accepted by the website form for security; direct emails may contain attachments subject to the mail provider’s controls. These may include your name, organisation, role, telephone number and the business or technical context of your enquiry.
We use this information to respond, discuss requested demonstrations or services, and manage the relevant correspondence. For general enquiries and contact with business representatives, the lawful basis is our legitimate interest in communicating about our products and activities (GDPR Article 6(1)(f)). Where processing is necessary to take steps at your request towards a contract with you personally, Article 6(1)(b) may apply instead.
How the direct contact form works
The Contact page lets you submit your name, business email address, subject, message and area of interest directly to our website. You may also provide your organisation and role, and optionally attach up to 10 supporting files with a combined maximum size of 20 MB. Selecting Send message transmits those fields, the security-check response and any optional attachments to our server over HTTPS. The server validates the submission and, if accepted, passes the enquiry to the mail service for delivery to office@tohol.org. You do not need to open your own email application.
Our website hosting and business mailbox services are provided by Hostinger. The contact handler does not save enquiry contents or attachments to a website database. Uploaded files are handled as temporary PHP uploads for the duration of the request and, if the submission is accepted, are attached to the outgoing email. The mail system and mailbox then process the message and attachments, and normal hosting or provider logs and backups may apply. A confirmation means the sending service accepted the message for delivery; it is not a guarantee of inbox delivery.
Copy message is a separate, optional browser action. It copies your draft to your clipboard, or displays it for manual copying; it does not submit the enquiry. You can also use the email link and send a message from your own email app. No automatic reply or copy is sent to an unverified visitor address.
Simple CAPTCHA and abuse prevention
The contact form uses a simple first-party arithmetic question and a hidden anti-spam field. The answer and hidden field are checked only as part of the submitted request to reduce automated abuse. No third-party CAPTCHA service is loaded, and the form does not create an analytics or advertising profile.
Contacting us is voluntary, although we need a way to reply and enough information to understand your request. The direct form requires a name, email address, area of interest, subject, message and the simple security answer; organisation, role and attachments are optional; you can also email us directly. Please do not send passwords, access keys, payment-card details, special-category personal data or confidential customer records through an initial enquiry or attachments unless a secure channel has been specifically agreed. Recruitment applications, if requested, require the information and retention arrangements appropriate to that recruitment process.
Technical access and server logs
Delivering website pages involves processing connection information such as your IP address, the requested resource, time of access and browser request headers. Hosting or security logs may also record response codes, errors and security events.
The lawful basis for necessary website delivery, diagnostics and proportionate security logging is our legitimate interest in operating a reliable website, investigating faults and preventing abuse (Article 6(1)(f)). Hostinger provides the hosting. The website is currently hosted on infrastructure located in the United Kingdom, with website backups stored in Germany.
Legal obligations and requests about your data
We may process correspondence or relevant records to meet a specific legal obligation, including responding to a valid data-rights request (Article 6(1)(c)), or where necessary for the establishment, exercise or defence of legal claims (Article 6(1)(f)). Only information relevant to the obligation or claim should be retained for that purpose.
3. Cookies and audience analytics
Privacy-friendly analytics with Counter.dev
We use Counter.dev for limited website audience measurement. Its published service description states that its analytics uses no tracking cookies, no logging and no IP-address fingerprinting. We use it to understand aggregate website activity, such as which pages are viewed, referring websites, device category, browser, operating system, language, screen size, approximate country and general time-based trends.
Counter.dev states that its personalised tracking script maps a visitor IP address to a country and stores statistical information in aggregated form rather than keeping individual visitor data points. Counter.dev states that its server resources and services are hosted in Frankfurt, Germany.
We do not use Counter.dev for advertising, behavioural advertising, cross-site profiling or to build customer profiles. The TOHOL website does not add its own analytics cookies or advertising identifiers for Counter.dev.
The analytics script is loaded from cdn.counter.dev. Counter.dev is a separate service provider and its own privacy information applies to its service. You can read the Counter.dev Privacy Policy ↗.
Our purpose is to understand aggregate use of the public website and improve its content, navigation and technical quality. We treat this limited audience measurement separately from enquiries submitted through the contact form. Where applicable law requires additional consent or controls for analytics technology, we will apply those requirements.
Previously used analytics
An earlier website version used Clicky, provided by Roxr Software Ltd. Its loading code and forwarding functionality were removed before Counter.dev was introduced. If you have a question about earlier analytics processing, contact office@tohol.org.
4. Sharing and international transfers
We do not sell your personal information. Hostinger provides our website hosting and mailbox services. These services handle information needed to deliver the website, protect its operation and manage correspondence. Professional advisers or public authorities may receive relevant information where necessary for a legal obligation or claim.
The website is currently hosted on infrastructure located in the United Kingdom, with website backups stored in Germany. Where personal data is processed in the United Kingdom for website hosting, transfers currently rely on the European Commission adequacy decision for the United Kingdom.
Hostinger publishes a Data Processing Addendum ↗ for relevant services. Our business email service is also provided through Hostinger. This policy does not state a specific storage country for mailbox data; email services may use provider infrastructure and authorised subprocessors in accordance with Hostinger's contractual and legal arrangements.
For website audience measurement we use Counter.dev. Counter.dev states that its server resources and services are hosted in Frankfurt, Germany. Its tracking script is delivered from its own CDN. We do not send contact-form contents or attachments to Counter.dev.
5. How long information is kept
We keep information only for as long as needed for the purposes described in this policy, subject to applicable legal requirements. The retention criteria are:
- Enquiries: until the enquiry and any requested follow-up are complete, unless the correspondence remains necessary for an ongoing relationship or a specific legal reason.
- Form attachments: not stored as a separate website record; if sent successfully, they become part of the relevant email correspondence and follow the same retention approach as that correspondence.
- Contract and claim records: for the applicable statutory period or for as long as the relevant claim requires them, limited to records needed for that purpose.
- Hosting logs and backups: provider retention and deletion cycles apply separately. Relevant security records may be kept where needed for a specific investigation. Mailbox messages remain subject to the enquiry, contract and legal-claim criteria above; clearing the form’s temporary state does not delete an email or its provider backups.
- Website analytics: Counter.dev controls the retention of analytics statistics within its service. Its published privacy information states that statistics are aggregated and that some historical daily aggregates may be retained. Earlier analytics data held by previous providers is separate from current Counter.dev processing.
6. Your data-protection rights
Where the GDPR applies, you may request access to your personal data, correction of inaccurate information, erasure or restriction of processing. The conditions for each right depend on the processing concerned.
You may object to processing based on legitimate interests for reasons relating to your situation. You can object to direct marketing at any time. Where processing is based on consent, you may withdraw it without affecting the lawfulness of processing before withdrawal. Portability may apply to data you provided where processing is automated and based on consent or contract.
Send requests to office@tohol.org. We may ask for proportionate information to verify your identity where needed. We must normally respond within one month; a permitted extension of up to two further months requires an explanation within the first month. Requests are normally free.
You may complain directly to a supervisory authority, including in the country where you live or work or where an alleged infringement occurred. Bulgaria's authority is the Commission for Personal Data Protection ↗. The EDPB directory ↗ lists other European authorities. You do not have to contact us first.
The public website does not provide an automated decision-making service that produces legal or similarly significant effects on visitors. Descriptions of planned CIRMS AI capabilities do not mean those capabilities are being applied to website visitors.
7. Security and external websites
We are committed to proportionate technical and organisational safeguards against unauthorised access, loss, alteration and disclosure. No website, email service or method of electronic storage can be guaranteed completely secure. Please avoid sending sensitive information through ordinary email unless an appropriate secure channel has been agreed.
Links to other websites
Links to institutions, communities, service providers and other resources take you to websites operated by third parties. Their privacy notices govern their own processing. Review those notices before providing information. Links in this policy are provided for transparency and do not mean that every feature described by a provider is enabled on TOHOL.
8. Contact and policy updates
For privacy questions or requests concerning the TOHOL website, contact ZAGATA BIO SISTEMS Ltd at office@tohol.org. Including Privacy enquiry in the subject will help identify your message.
When this policy is updated, the revised version and date will appear on this page. Where a change affects how your information is processed, additional notice or consent will be provided where required. Changes to policy text do not themselves authorise new processing.
Policy updated: 28 September 2026.