Privacy Policy
This Privacy Policy describes how „GP INNOVATION” Ltd. processes and protects the personal data of individuals in connection with the services provided through the gesto.bg web portal and its related systems (including registration and management of a digital/PDF menu).
1. Data Controller
The data controller is „GP INNOVATION” Ltd. UIC 203922341, with registered address in Yambol, Zlaten rog 1.
Contact for data protection matters: e-mail: office@gesto.bg, phone: +359 892 713 639.
2. What personal data we collect
2.1. On venue registration: the name of the establishment, e-mail address and contact phone of the person performing the registration.
2.2. Account access data: username (e-mail) and an automatically generated password sent to you by e-mail.
2.3. Technical data: IP address, date and time of registration and similar system log information, needed for security and abuse prevention.
2.4. Partially completed data: if you start a registration and fill in a field but do not complete it, the data you entered (e.g. e-mail and/or phone) may be stored so that we can assist you in completing the registration. You may request its deletion at any time.
3. Purposes and legal bases for processing
3.1. Creating and maintaining your account and providing the „digital/PDF menu” service — legal basis: performance of a contract (Art. 6(1)(b) of Regulation (EU) 2016/679 — GDPR).
3.2. Sending access credentials and account-related messages — legal basis: performance of a contract.
3.3. Storing partially completed registrations and follow-up assistance — legal basis: legitimate interest of the controller (Art. 6(1)(f)), which may be objected to at any time.
3.4. Analytics cookies — legal basis: your consent (Art. 6(1)(a)), provided via the cookie banner and revocable at any time.
3.5. Security, abuse prevention and compliance with legal obligations — legitimate interest and legal obligation.
4. Cookies
The site uses strictly necessary cookies that provide basic functionality, and analytics cookies (Google Analytics) for anonymous visit statistics. Analytics cookies are loaded only after your explicit consent via the cookie banner. You may withdraw your consent at any time by deleting cookies in your browser.
5. Recipients of the data
Access to the data is limited to authorized staff of the controller and the hosting and e-mail infrastructure providers serving gesto.bg, acting as data processors on our instructions. Data may also be provided to competent state authorities where required by law.
6. Retention period
6.1. Data related to an active account is kept for the duration of the service and up to 12 months after its termination, unless a longer period is required by law.
6.2. Partially completed (abandoned) registrations are kept for up to 6 months, after which they are deleted.
6.3. System logs are kept for the period necessary for security purposes.
7. Transfers outside the EU/EEA
As a rule, we do not transfer personal data outside the European Union / European Economic Area. Should we use a service provider outside the EU/EEA, this is done with appropriate safeguards under the GDPR.
8. Your rights
As a data subject you have the right to: access your personal data; rectify inaccurate data; erase data („right to be forgotten”); restrict processing; data portability; object to processing; and to withdraw a given consent at any time, without affecting the lawfulness of processing before the withdrawal.
To exercise your rights, contact us at office@gesto.bg.
9. Right to lodge a complaint
You have the right to lodge a complaint with the supervisory authority — the Commission for Personal Data Protection (CPDP), Sofia 1592, „Prof. Tsvetan Lazarov” Blvd. No. 2, phone: +359 2 915 35 18, e-mail: kzld@cpdp.bg, website: www.cpdp.bg.
10. Data security
We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss or alteration. We recommend that you change the password sent by e-mail on your first login and keep it confidential.
11. Changes to this Policy
We may update this Privacy Policy upon changes in how we process data or in applicable law. The current version is published on this page.
Last updated: 26 May 2026