Privacy Policy

Last updated: 25 September 2026

1. Who processes your data

The data controller is IKT Proekt EOOD (ИКТ Проект ЕООД), UIC 208289594, VAT No. BG208289594, with its registered seat at 189 Slivnitsa Blvd., floor 3, office 32, Varna 9000, Bulgaria («we», «us») - the company that sells the tickets for CONNEXUS 2026 (Black Sea Technology Forum).

The Forum is organized by ICT Cluster Varna. The two roles are distinct and do not conflict: the Cluster organizes the event, while IKT Proekt EOOD is the seller of the tickets and the controller of the personal data processed in connection with the Forum.

For any questions about how we process your personal data, write to us at [email protected] or call +359 876 658 296.

2. What data we collect

Depending on how you interact with the website and the event, we may collect the following categories of data:

• Ticket registration data: first and last name, email address, phone number, ticket type and (optional) company type.
• Exhibitor/sponsor data: company name, contact person, email, package of interest and any additional information you provide.
• Correspondence: the content of emails and messages you send us directly.
• Technical data: IP address, device and browser type, pages visited, and cookie data loaded via Google Tag Manager - Google Analytics 4, Google Ads, the Meta (Facebook) Pixel and the Reddit Pixel (see item 5).
• Photo and video material: photos and video recordings that may include attendees may be taken during the event (see Terms of Use, item 9).

3. Purposes and legal basis for processing

• Performance of a contract - processing ticket registrations, issuing documents and organizing your attendance at the forum (Art. 6(1)(b) GDPR).
• Legitimate interest - communicating with exhibitors and sponsors, analysing website traffic and improving our content, and taking photographs and video recordings for coverage, promotion and archiving of the event (Art. 6(1)(f) GDPR). You have the right to object to processing on this basis at any time.
• Consent - sending marketing communications and non-essential analytics cookies, where applicable (Art. 6(1)(a) GDPR). Consent may be withdrawn at any time.
• Legal obligation - accounting and tax record-keeping for payments made.

4. Ticket sales via URBO (UPASS JSC)

Tickets for the Forum are sold online through the URBO CITY platform operated by UPASS JSC, UIC 207327088, correspondence address 3 Dobromir Hriz St., Sofia 1124, Bulgaria, [email protected], tel. 0700 70 270. When you buy a ticket you enter your details in URBO’s checkout, not on this website.

The GDPR roles are split. For the data URBO processes in order to issue your ticket on our behalf, UPASS JSC acts as a processor under a signed contract containing an Art. 28 GDPR clause. For your URBO CITY user account, for the payment and for its own marketing activities, UPASS JSC acts as an independent controller under its own policies.

• Data is stored on servers within the European Economic Area or in a country covered by a European Commission adequacy decision.
• In the event of a security breach, URBO must notify us within 36 hours of becoming aware of it.
• When you exercise your GDPR rights, URBO provides us with the necessary data within 3 business days.
• URBO does not engage sub-processors without our prior written authorization, and on termination of the contract the data is returned or erased at our choice.
• Card payments are processed by DSK Bank. Neither we nor URBO store your card details.
• At the entrance to the Forum, URBO performs access control by scanning the QR code on your ticket.
• URBO also promotes the Forum in its own email campaigns to its own user base - that is processing on URBO’s own legal basis, and we do not provide your address for that purpose. Email communication and the Forum newsletter run through URBO; we do not use a separate newsletter platform.

UPASS JSC’s own documents: Privacy Policy and Terms and Conditions.

5. Cookies and analytics

Through Google Tag Manager, the website loads analytics and advertising tools that place cookies on your device: Google Analytics 4, Google Ads, the Meta (Facebook) Pixel and the Reddit Pixel. These cookies are not technically necessary for the website to work. The site does not currently use a consent-management banner - you can control or delete cookies through your browser settings, by blocking third-party cookies, or through the opt-out tools of the respective providers. Doing so may limit some functionality.

The list reflects the cookies observed on the website on 21 September 2026. Providers may change the names and durations of their own cookies.

6. Data retention

We keep your personal data only for as long as necessary for the purposes for which it was collected, after which it is deleted or anonymized:

• Data of registered attendees and exhibitors - up to 24 months after the Forum ends.
• Correspondence (emails and messages sent through the website forms) - up to 24 months from the last communication.
• Accounting and tax records - for the periods required by the Bulgarian Accountancy Act and tax legislation (up to 10 years).
• Technical data and cookies - for the lifetime of the respective cookie (see the table in item 5).
• Data processed by URBO on our behalf - until the contract with UPASS JSC ends, after which it is returned or erased (see item 4).

7. Sharing data with third parties

We do not sell your personal data. We share it only with service providers acting on our behalf or on their own legal basis: UPASS JSC / URBO CITY (ticket sales and access control - see item 4); DSK Bank (card payment processing); our website hosting provider; Resend (delivery of the emails generated by the website forms); Google, Meta and Reddit (analytics and advertising - see item 5); and event-organization partners (e.g. Hotel Cherno More, Varna) to the extent necessary for the logistics of your attendance. We do not provide personal data to sponsors or exhibitors. All processors are bound by contractual data-protection obligations.

8. International data transfers

Some of our providers (e.g. Google) may process data outside the European Economic Area. In these cases we rely on European Commission adequacy decisions or standard contractual clauses that ensure a level of protection consistent with the GDPR.

9. Data security

We apply appropriate technical and organizational measures (encrypted connections, restricted access, regular access reviews) to protect your personal data against unauthorized access, loss or disclosure.

10. Your rights

Under the GDPR you have the right to:

• access your personal data and obtain a copy of it;
• rectify inaccurate or incomplete data;
• erasure of your data (the «right to be forgotten»), where applicable;
• restrict processing;
• data portability;
• object to processing based on legitimate interest;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia, www.cpdp.bg.

To exercise these rights, write to us at [email protected]. We will respond within 30 days.

11. Children's data

CONNEXUS 2026 is a business and technology event intended for individuals over 18. We do not knowingly collect data from children. If we learn we have received data from a minor without parental/guardian consent, we will delete it.

12. Changes to this policy

We may update this policy from time to time. In the event of material changes, we will publish the new version on this page with an updated «Last updated» date.

13. Contact

Seller and data controller: IKT Proekt EOOD (ИКТ Проект ЕООД), UIC 208289594, VAT No. BG208289594, 189 Slivnitsa Blvd., floor 3, office 32, Varna 9000, Bulgaria · [email protected] · +359 876 658 296.
Organizer of the Forum: ICT Cluster Varna.