Effective 23 October 2026
Controller and contact
Atlant Security, Svoboda 27-69, Sofia 1231, Bulgaria, VAT BG205426422, is the controller for this website and initial business enquiries. Contact alexander@atlantsecurity.com about privacy. A response engagement requires separate confidentiality, evidence-handling and, where applicable, data-processing terms.
Information and purposes
We process your name, work email, organisation, request urgency, message, optional NDA/RFP document and subsequent correspondence to respond to your request and discuss services. The incident brief builder runs locally in the page without AI processing or browser storage. Its selected answers reach us only when you submit the reviewed form.
We process IP addresses and request/security metadata to protect forms, investigate abuse and operate the site. The original visitor IP is included in the internal enquiry record and owner notification; it is not added to prospect-facing confirmations or AI correspondence. Cloudflare hosts the site and provides security and email services.
Legal bases
Our legitimate interests in responding to professional enquiries, operating a secure service and managing business relationships support this processing under GDPR Article 6(1)(f). Article 6(1)(b) applies where you personally request pre-contractual steps. Legal obligations may require processing under Article 6(1)(c); legal claims may require retention under legitimate interests.
Required form fields are name, business email, organisation and message. Providing them is voluntary, but we cannot use the form to respond without them. You may email us instead. We do not enrol you in newsletters or make automated decisions with legal or similarly significant effects through this site.
Recipients and correspondence
Authorised Atlant Security personnel receive enquiries and documents. Cloudflare processes hosting, security, routing and email delivery. The acknowledgement includes an optional Calendly booking link; following that link uses Calendly under its own privacy terms. AI incident enquiries are handed to the human team rather than an automated AI qualification conversation. Uploaded documents are not sent to an AI model.
Where providers process data outside the EEA, applicable transfer mechanisms, including adequacy decisions or standard contractual clauses where required, form part of the relevant processing arrangements. Contact us for information about safeguards applicable to your request.
Retention and secure handling
We retain initial enquiry correspondence for up to 24 months after the last substantive contact unless a contract, legal obligation or claim requires longer retention. Rate-limit records are short-lived; provider security retention follows the applicable service terms. Unneeded attachments should be removed once their purpose ends. Agreed engagement evidence follows the separate retention schedule in that engagement.
Do not submit logs, credentials, confidential prompts, personal records or incident evidence through the public form. Attach only an NDA or RFP. We agree a secure channel and permitted evidence scope separately.
Your rights
Depending on the circumstances, you may request access, correction, deletion, restriction or portability, and may object to processing based on legitimate interests. Contact our privacy address. You may complain to Bulgaria’s Commission for Personal Data Protection at cpdp.bg, or another competent supervisory authority. We may need proportionate information to verify a request.
Search and website measurement
Search operates on a public index in your browser. Queries may appear in the URL and request metadata; do not enter confidential information. Where enabled, Cloudflare Web Analytics measures usage and performance without analytics cookies or cross-site profiling storage. We do not include form contents or documents in analytics. See the cookie notice.