Privacy Policy

The controller for the personal data described here is The Origami Corporation Ltd., a company registered in Bulgaria. Its registered address and company numbers are listed under Company details below.

For anything about your personal data, write to privacy@theorigamicorporation.com. Our security team handles these requests.

We may collect information about you in a variety of ways, including:

• Personal Data: Name, email address, phone number, and other contact information you voluntarily provide when contacting us.
• Usage Data: Information about how you access and use our website, including IP address, browser type, pages visited, and time spent on pages.
• Cookies: We use cookies and similar tracking technologies to track activity on our website. See our Cookie Policy for more details.

We use personal data only for the purposes below, each on the legal basis named (Article 6(1) GDPR):

• Answering an enquiry sent through a contact, partnership, offer or assessment form, or by e-mail: steps prior to a contract at your request (point b), or our legitimate interest in answering business enquiries (point f).
• Handling a job application: steps prior to an employment contract (point b).
• Sending the newsletter and requested downloads: your consent (point a), given with double opt-in where a confirmation mail is sent. You can withdraw it with the link in every mail.
• Analytics and advertising measurement: your consent (point a) in the cookie banner.
• Spam protection with reCAPTCHA, error monitoring and keeping the site secure: our legitimate interest in running a working, abuse-free site (point f).
• Keeping records we are required to keep, such as contracts and invoices: legal obligation (point c).

Where we rely on legitimate interest you can object at any time; where we rely on consent you can withdraw it at any time, without affecting what was done before.

With your consent to the analytics category we use Google Analytics, Google Tag Manager and Microsoft Clarity to understand how visitors interact with the site so we can improve it. These collect pages visited, approximate location, device and browser details, and in Clarity's case how a page is scrolled and clicked.

With your separate consent to the marketing category we load the LinkedIn Insight Tag, run by LinkedIn Ireland Unlimited Company. It measures what our LinkedIn campaigns lead to and lets us show our ads to people who have visited the site. Accepting analytics does not load it.

Neither category is requested before you have consented to it, and refusing a category removes its tags. You can change your choice at any time with the Cookie settings button in the footer of every page, which asks again.

Our forms are protected by Google reCAPTCHA v3, run by Google Ireland Limited. It loads only when you start filling in a form, never when you just read a page. It then sends Google information such as your IP address, browser and device details and how you interact with the page, and Google may set or read its own cookies, so that it can tell people from bots.

We rely on our legitimate interest in keeping the forms free of spam and abuse (Art. 6(1)(f) GDPR), so reCAPTCHA is not one of the choices in the cookie banner, and declining cookies does not stop the forms from working. The Google Privacy Policy (policies.google.com/privacy) and Terms of Service (policies.google.com/terms) apply. Contact us to object.

When a page throws an error in your browser, we post a report to a Grafana Faro collector that we run ourselves on our own infrastructure (rx.rso.dev). It sets no cookie, stores no identifier, and does not follow you between pages or visits.

The report contains the error message, its stack trace and the full address of the page it happened on, including any query string. Like any web request, it also reaches the collector with your IP address and your browser's user agent. Nothing else is read out of the page. We rely on our legitimate interest in keeping the site working rather than on your consent, so it is not one of the choices in the cookie banner. Contact us to object.

We share personal data only with the service providers needed for the purposes above, under data processing terms where they act for us, and with authorities where the law requires it. These include:

• Google Ireland Limited: reCAPTCHA, and with your consent Google Analytics and Google Tag Manager.
• Microsoft Ireland Operations Limited: Microsoft Clarity, with your consent.
• LinkedIn Ireland Unlimited Company: the LinkedIn Insight Tag, with your consent.
• Twilio Inc. (SendGrid): delivers the e-mails our forms send.
• UAB MailerLite: manages the newsletter list.
• Our hosting providers in the EU, where the site, the form service and the error collector run.

If the company or part of it is sold or merged, data may pass to the buyer under the same terms.

Google, Microsoft, LinkedIn and Twilio are part of groups based in the United States, so data may be transferred to or accessed from the US. Where the recipient is certified under the EU-US Data Privacy Framework we rely on the European Commission's adequacy decision (Article 45 GDPR); otherwise on the European Commission's standard contractual clauses (Article 46 GDPR). Write to us for a copy of the relevant safeguards.

We keep personal data only as long as the purpose needs it:

• Enquiries: while we handle them and for up to 3 years after our last contact, unless a contract follows.
• Contracts, invoices and related correspondence: for the periods required by Bulgarian accounting and tax law.
• Job applications: up to 6 months after the position is filled, longer only with your consent.
• Newsletter: until you unsubscribe or withdraw your consent.
• Analytics and advertising data: as set by each provider and listed in the cookie policy, at most 14 months for Google Analytics data.
• Error reports: up to 30 days.

We implement appropriate technical and organizational measures to protect your personal information. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Under the GDPR you have the right to:

• Access your personal data
• Have inaccurate data corrected
• Have your data deleted
• Restrict processing
• Receive your data in a portable format
• Object to processing based on legitimate interest
• Withdraw consent at any time, without affecting earlier processing

To use any of these rights, write to privacy@theorigamicorporation.com. We may ask you to confirm your identity.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work or where an alleged infringement took place. Our lead authority is the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, www.cpdp.bg.

We do not use your data for automated decision-making or profiling with legal or similarly significant effects.

Legal entity

Company registration number (UIC)

VAT number

Registered address

Questions about this document go to privacy@theorigamicorporation.com