Privacy policy

Leo Loison Consulting EOOD, trading as Pipewell (UIC 208915945, Ul. General Parensov 43A, 1142 Sofia, Bulgaria), decides how your personal data is used on this site. Contact: leo@pipewell.co. No data protection officer is appointed.

I use personal data in these cases only.

• Visiting the site. Your IP address, the time, the page you request, your browser and device type, and error and security logs. Purpose: deliver the site and keep it secure. Legal basis: legitimate interest in running and securing the site (GDPR Art. 6(1)(f)).
• Writing to me by email. Your name, email address and the content of your message. Purpose: answer you. Legal basis: steps before a contract if you ask about a service (Art. 6(1)(b)), otherwise legitimate interest (Art. 6(1)(f)).
• Booking a call. The details you enter on the booking page: name, email, company, time zone and your answers to the meeting form. Purpose: schedule and prepare the call. Legal basis: steps before a contract and legitimate interest (Art. 6(1)(b) and (f)).
• Using the LinkedIn Ads or Google Ads self-audit. Your answers are scored in your browser and are not sent anywhere unless you ask for your full report. When you do, your first name, last name, work email, your answers, your score and result, and whether you ticked the box for posts and tools are sent to HubSpot and stored as a contact in my CRM. Purpose: show you your report and know your answers if we talk. Legal basis: legitimate interest in following up on a request you made (Art. 6(1)(f)). If you tick the box for posts and tools, I email you on the basis of your consent (Art. 6(1)(a)), which you can withdraw with the unsubscribe link in any email.
• Measuring visits (only if you accept analytics cookies). Google Analytics records the pages you view, how long you stay, your device and browser type, your approximate location, how you arrived on the site, and an identifier stored in a cookie. Purpose: understand which pages are read and which campaigns bring visitors. Legal basis: your consent (Art. 6(1)(a)).
• Measuring ads (only if you accept advertising cookies). Google Ads and the LinkedIn Insight Tag record that you visited pipewell.co, the pages you viewed, that you clicked a booking button, advertising identifiers and, if you arrived from an ad, the ad click identifier. Purpose: measure which ads lead to booking clicks, and let LinkedIn build audiences of site visitors for Pipewell ads. Legal basis: your consent (Art. 6(1)(a)).
• Your cookie choice. Your choice in the banner, the date and the version of the banner text. Purpose: respect it and be able to show it. Legal basis: legal obligation and legitimate interest (Art. 6(1)(c) and (f)).
• Clients. Contract, invoicing and business contact data. Purpose: deliver and bill the service and meet tax and accounting law. Legal basis: contract and legal obligation (Art. 6(1)(b) and (c)).

I do not use your data for automated decisions or profiling.

• Lovable Labs Incorporated (USA), with Lovable Labs AB (Sweden) as its EU entity. It hosts this site and processes standard server logs on my behalf to deliver and protect the site. It does not profile visitors.
• HubSpot, which runs the booking page and stores my contacts (my CRM). It processes the details you send through either self-audit on my behalf, in my HubSpot account hosted in HubSpot's EU data centre. The "Book a call" button is a normal link, and no HubSpot script or cookie loads on pipewell.co. Once you follow the booking link you are on HubSpot's site and HubSpot's privacy terms apply.
• Google Ireland Limited, with Google LLC (USA). Google Ads and, if you accept analytics cookies, Google Analytics. Google receives data only after you accept the matching category. Google's privacy policy applies to its use of that data.
• LinkedIn Ireland Unlimited Company, with LinkedIn Corporation (USA). The LinkedIn Insight Tag. LinkedIn receives data only after you accept advertising cookies. LinkedIn's privacy policy applies to its use of that data.

I do not sell personal data.

Lovable Labs Incorporated is based in the United States, so server logs can be processed there. The safeguards for such transfers are those in Lovable's terms and data protection documentation. I have not signed a separate data processing agreement with Lovable. My HubSpot account is hosted in HubSpot's EU data centre. HubSpot, Inc. is based in the United States, and its own transfer terms apply to any access from outside the EEA, including when you use its booking page. Google and LinkedIn are US companies, so data collected through their tags can be processed in the United States. The safeguards for such transfers are those in their terms and data protection documentation. They receive data only if you accept the matching category.

• Server logs: kept by Lovable under its own retention rules.
• Emails and booking data from enquiries that do not become clients: 12 months after the last message, then deleted.
• Self-audit details from people who do not become clients: 12 months after our last contact, then deleted. If you ticked the box for posts and tools, your email stays on that list until you unsubscribe.
• Client contracts and invoices: as long as Bulgarian accounting and tax law requires.
• Advertising and analytics data: kept by Google and LinkedIn under their own retention rules. Google Analytics event data: 2 months. The cookies last as listed in the Cookie policy.
• Your cookie choice: stays in your browser until you clear it or change it. It is asked again when the banner text changes.

You can ask for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing that rests on legitimate interest. Where processing rests on consent, you can withdraw it at any time: for cookies with "Cookie settings" in the footer, for emails with the unsubscribe link or by writing to me. Withdrawal does not affect what happened before. When you withdraw consent for cookies, the tags stop loading and the page reloads. Cookies that Google or LinkedIn already set on their own domains stay in your browser until you delete them. Write to leo@pipewell.co. I answer within one month.

You can complain to the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни): 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, kzld@cpdp.bg. You can also complain to the data protection authority where you live or work.

Browsing the site needs no data from you beyond what your browser sends. Booking a call or writing to me needs the details listed above. Without them I cannot reply. Each self-audit shows your score without any details; the full report needs your name and work email.

I update this page when the site's tools change. The date at the top shows the version.