Controller and contact

The controller is Smart Cases Ltd. (Смарт Кейсис ЕООД), UIC 109598404, VAT number BG109598404, registered office: 326 Tsar Osvoboditel Street, Block 120, Floor 6, Apartment 20, 2500 Kyustendil, Bulgaria. Contact us at sales@smartcases.site or +359 888 800 204. Use the email address for privacy requests, including questions about a profile, an enquiry or uploaded material.

Information we process

For an enquiry: your name, email, telephone where required by the form, optional company/country information, equipment models, measurements, quantities, messages and any photographs you choose to attach. Required fields are marked in the form; optional fields can be left blank.

For a profile: name, email, Bulgarian telephone number, optional company, country check, email-verification status, login/session information and usage counters. We use a one-time email code for the configurator login. New profiles are currently available from Bulgaria and require a Bulgarian telephone number.

For the AI tools: messages and conversation history, equipment descriptions, supplied links and images, dimensions, design choices, generated previews and configuration/drawing files. A submitted quote request is associated with the signed-in profile. The general website chat also records the contact details, page address, conversation, IP address and browser information.

For website operation: IP address, requested URL, browser/device information, timestamps, security/error logs, cookies and similar browser storage. We do not request identity documents, payment-card data, health information or other sensitive personal information through these tools. Please remove unrelated people, documents and confidential details from photographs.

Purposes and legal bases

We answer your questions, prepare specifications and quotes, provide your requested profile/configurator functions and perform an agreed order under Article 6(1)(b) GDPR where you are the contracting person. For contacts acting for a business, the basis is our legitimate interest in communicating with that business and handling its enquiry, Article 6(1)(f).

We use necessary technical records, verification, rate limits and country checks to operate and secure the service and prevent misuse, under Article 6(1)(f). Accounting and other legally required records are processed under Article 6(1)(c). Optional cookies or optional marketing, if offered, require the relevant separate consent, Article 6(1)(a); sending an enquiry or ticking its privacy acknowledgement does not subscribe you to marketing.

If required contact information is missing, we may be unable to open a profile or answer a request. You can contact the team by email or telephone instead of using the AI tools. Withdrawing an optional consent does not invalidate processing before withdrawal or processing that has another lawful basis.

AI processing, photographs and human review

The website chat and configurator use external AI services to interpret text, analyse a supplied image or link and suggest a configuration. Messages, relevant history and uploaded material can be included in those requests. The website chat can include contact context in the AI request; do not put information into the chat that you do not want processed for that purpose.

The current integration uses Anthropic for language/image interpretation, OpenAI for optional generated previews, and Decodo for image/web lookup. An image search can pass the image or its URL to search services, including Google Lens. Opening a supplied equipment link can also contact the linked website. A generated image is an illustration, not a photograph of a manufactured product.

Temporary AI images, generated previews and drawing files can be served through difficult-to-guess URLs. Anyone given such a URL may be able to open it; an unlisted link is not the same as an authenticated private document. Ordinary quote-form attachments are stored separately with restricted web access. Use email to agree a suitable way of sharing confidential technical information before sending it.

AI answers and measurements can be inaccurate. They support preparation of an enquiry and do not determine a final price, accept an order or approve a manufacturing design. The Smart Cases team reviews the specification and quote. Country checks can automatically restrict registration; contact the team if the country is detected incorrectly. These tools are not used to make solely automated decisions producing legal or similarly significant effects on you.

Recipients and service providers

Access is limited to the Smart Cases team and people who need the data to handle the request, support the service, fulfil an order or meet a legal obligation. Enquiries and chat summaries are stored in the site database and can be sent to the business email. Providers include Hostinger for hosting/infrastructure, the business email provider, the AI and search providers above, and IPinfo where an external IP-to-country lookup is needed. Accounting, delivery and professional advisers receive relevant information when needed for an actual order or legal matter. Authorities receive data when legally required.

Provider information is available from Hostinger, Anthropic, OpenAI, Decodo and IPinfo. We do not publish profile details, private enquiry records or chat transcripts in the public product catalogue or machine-readable resources.

Processing outside the EEA

Some providers and their subprocessors operate outside the European Economic Area, including in the United States. Their location and processing arrangements depend on the particular service. Applicable transfer mechanisms may include an adequacy decision or the European Commission's Standard Contractual Clauses, with additional safeguards where needed. Contact sales@smartcases.site for information about the mechanism and a copy of the safeguards applicable to your data; the provider links above also describe their processing arrangements. We do not promise that all data remains in Bulgaria or the EU.

Retention

The website's email-verification record expires after 15 minutes and is removed on successful verification or after the allowed attempts. Temporary configurator AI sessions have a three-day expiry. The daily cleanup is configured to remove temporary AI photo folders older than 30 days; execution depends on the scheduled task running. These periods do not remove copies already included in an enquiry, an email or a provider's processing records.

Profiles are retained while needed to provide the account, unless deletion is requested or continued retention is otherwise justified. Enquiries, submitted configurations, drawings, correspondence and chat records are retained according to the progress of the request, any resulting order, follow-up needs and applicable limitation periods for claims. We assess whether the record is still needed rather than treating an enquiry as permanent permission to keep everything.

Accounting and legally required records follow the applicable statutory retention periods. Security records and provider-side records follow their operational and legal retention requirements. Deletion from the live system may not immediately remove protected recovery copies; these are subject to the applicable backup cycle and access restrictions. You may ask which period or criterion applies to your particular record.

Cookies, browser storage and external links

Necessary storage supports login, security, language choices, the consent preference and the interactive session. Optional analytics/advertising storage, if enabled, is subject to its own choice. See the cookie policy. Leaving our site through an external link makes the destination's own privacy information relevant to that visit.

Your rights and complaints

Subject to the conditions in the GDPR, you can request access, correction, erasure, restriction and data portability, object to processing based on legitimate interests, and withdraw consent where consent is the basis. An objection to direct marketing is unconditional. Some records must be retained to comply with law or establish, exercise or defend legal claims; if a request cannot be fully met, we explain why.

Write to sales@smartcases.site and tell us which profile or enquiry is concerned. We may ask for proportionate information to verify identity. We respond without undue delay and normally within one month; where the GDPR permits an extension, we explain it within that first month. You may complain to the Bulgarian Commission for Personal Data Protection: cpdp.bg, or to the competent supervisory authority where you live, work or consider that an infringement occurred. You do not have to contact us first.

Children and updates

The service is intended for adults arranging equipment cases. If you believe a child has supplied personal data, contact us so that we can assess and handle it. This notice may be updated when the service or legal requirements change; the date at the top identifies the current version. A policy update does not itself create consent for a new optional purpose.