Privacy Policy
This policy explains how Lathe Works LLC processes personal data: what we collect, why, on what legal basis, who receives it, how long we keep it, and what rights you have under the EU General Data Protection Regulation (GDPR) and Bulgarian data protection law.
1. Controller and contact
The controller is Lathe Works LLC, Sofia, 1407, 83 – 85 James Bouchier blvd., office 3, Bulgaria (“Lathe Works”, “we”). For any question about your data or to use your rights, write to contact@latheworks.co with the subject “Privacy”.
2. Whom this policy covers
- Visitors of this website.
- People who contact us through the contact form or by email, including prospective clients.
- Our clients' staff: the people who sign contracts with us, receive invoices, hold API keys, or ask for support.
- People who appear in public data that we deliver to clients. Section 9 explains this part separately.
3. What we collect, why, and on what basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Technical data of a visit: IP address, browser type, time, requested page | Deliver the website and protect it against abuse and attacks | Legitimate interest, Art. 6(1)(f) |
| Contact form and emails: name, work email, company, your message | Answer your request and prepare a proposal or data sample | Steps at your request before a contract, Art. 6(1)(b); legitimate interest in answering business enquiries, Art. 6(1)(f) |
| Client contacts: name, work email, role, company | Conclude and perform the contract, support, service notices | Contract, Art. 6(1)(b); where the contract is with your employer, legitimate interest, Art. 6(1)(f) |
| API keys and usage records: key name, time and type of each call, volume used | Provide the service, apply agreed limits, bill usage, find faults and misuse | Contract, Art. 6(1)(b); legitimate interest in security, Art. 6(1)(f) |
| Billing data: company details, invoices, payments | Invoicing and accounting | Legal obligation, Art. 6(1)(c) |
We collect this data from you directly, or from your employer when it signs up for our service. Giving it is voluntary, but without contact details we cannot answer you, and without contract data we cannot provide the service. We do not use analytics, advertising or tracking tools, and we do not build profiles of visitors. See the Cookie Policy.
4. Who receives your data
We do not sell personal data and we do not share it for advertising. We share it only with:
- Service providers acting for us under data processing agreements: our hosting and security provider (Cloudflare, Inc.) and our email provider.
- Accountants, auditors and legal advisers, bound by confidentiality, where needed.
- Public authorities, when the law requires it.
Our data suppliers receive no information about our clients or about people who contact us.
5. Transfers outside the EU
Some service providers may process data outside the European Economic Area, for example in the United States. In that case we rely on an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework, or on the Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards.
6. How long we keep data
| Data | Kept for |
|---|---|
| Website security logs | Short-term, as set by our hosting provider |
| Enquiries that do not lead to a contract | 24 months after the last contact, then deleted automatically |
| Client contacts and API usage records | For the duration of the contract and up to 5 years after it ends, for legal claims |
| Invoices and accounting records | As long as Bulgarian accounting and tax law requires |
7. Your rights
You have the right to:
- get access to your data and a copy of it;
- have wrong data corrected;
- have your data deleted, where we no longer need it or have no legal basis for it;
- restrict how we use it while a question is open;
- receive data you gave us in a portable format;
- object at any time to processing based on our legitimate interest. We then stop, unless we have compelling legitimate grounds or need the data for legal claims.
Write to contact@latheworks.co. We answer within one month, free of charge. We may ask you to confirm your identity first. You can also complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or to the data protection authority in your EU country.
8. Security
Data travels encrypted (HTTPS). API keys and admin access codes are stored only as one-way hashes. Access to personal data is limited to staff who need it for their work. We make no automated decisions with legal or similar effect about you (Art. 22 GDPR).
9. Information for people who appear in public data
Our clients ask us to collect data that is already publicly available online, for example public business profiles and their public posts and comments. If you are the author of such public content, this section is for you (Art. 14 GDPR).
- Roles. The client decides why and how the data is used and is the controller for that use. We collect and deliver the data on the client's instructions, under a data processing agreement. Clients must have their own legal basis and may not use the data to profile or monitor individuals.
- What. Only public data: public account names, display names and descriptions, public posts and comments, and their public engagement counts. We do not collect private content, private messages, contact lists or special categories of data (such as health, religion or political views).
- Source. Publicly accessible online sources, collected through third-party data suppliers. Sources differ from project to project, so we describe them in general terms, as Recital 61 GDPR allows.
- Legal basis. The legitimate interests of the client and of Lathe Works in providing and using a lawful business data service (Art. 6(1)(f)), limited to public data about specific accounts or posts.
- How long. Collected results stay in our systems for 90 days so the client can retrieve them, and are then deleted automatically.
- Your right to object. Write to contact@latheworks.co with a link to your account or content. We stop collecting it for all clients and delete what we hold. You also have the other rights in section 7.
10. Children
Our website and service are for businesses. We do not knowingly collect data about children.
11. Changes
We update this policy when our processing changes. The date at the top shows the current version. We tell clients about important changes by email.