Privacy policy

How MACHORY handles personal data.

Effective from 05.11.2026

1. Who is responsible for personal data

The controller of the personal data processed to run MACHORY is EVRODEKOR.BG EOOD, company ID (EIK) 208125641, VAT number BG208125641.

Address: 48 Voyvodina Mogila Str., Sofia, Bulgaria
E-mail for questions and for exercising your rights: contact@machory.com

This policy explains how we process the personal data of visitors, registered users, company representatives and people who send inquiries or contact us. Information about a legal entity is not personal data as such, but the names and contacts of its representatives can be.

2. What data we process

Depending on the functions used, we can process:
• Account data: name, business e-mail, company, position or role, phone, settings and information for authenticating access.
• Inquiry data: contacts, machines of interest, requirements, indicative budget, project location, messages and attached files.
• Company and product content: presentations, descriptions and professional contacts provided for publication or obtained from permitted public sources.
• Verification data: information needed to confirm the right to manage a company profile.
• Service usage data: saved projects, comparisons and preferences, where the function is available.
• Technical data: IP address, browser and device data, access time, events and logs needed for operation, troubleshooting and security.
• Analytics data: pages visited, interactions and related identifiers, when you have allowed analytics.

We do not ask for special categories of personal data such as health information or political opinions. Do not send such data or copies of identity documents without a specific need and prior instructions. Fields needed for a service are marked; without them we may not be able to provide that service.

3. Where we get the information

We get information directly from you, from authorised company representatives, through the use of the site and from public professional sources such as company websites and registers.

When data about a natural person is obtained from another source, we provide the information required by Art. 14 GDPR, including the source, within the applicable time limits, unless a legal exception applies. Public availability does not by itself set aside the data protection rules.

4. Purposes and legal bases

Account and requested services: we process the necessary data to perform a contract or take steps at your request before a contract, where you are a party to it — Art. 6(1)(b) GDPR.

Contact with company representatives and handling business inquiries: where the represented company is the party to the relationship, the basis is our legitimate interest in organising professional communication and providing our services — Art. 6(1)(f).

Company catalogue and professional information: where the content includes personal data, we may rely on the legitimate interest in maintaining a current business catalogue, after weighing necessity, reasonable expectations and the rights of the people concerned. This does not allow unlimited publication of personal contacts.

Verification of representation, security, prevention of abuse and defence of legal claims: legitimate interest in protecting the platform, company profiles and legal rights — Art. 6(1)(f).

Compliance with specific legal obligations, including accounting, where applicable: Art. 6(1)(c).

Analytics and loading external video players: your consent — Art. 6(1)(a), together with the applicable rules on access to information in your device.

Where we rely on legitimate interest, we assess whether it is overridden by your interests, rights and freedoms. You can object to this processing as described in section 10.

5. Who can receive data

Access is given to authorised persons who need it and to providers of hosting, technical support, e-mail, security and other services needed to run MACHORY. Where they process data on our behalf, this is governed by the applicable processing agreements and instructions.

Inquiries are provided to the selected or named recipients. If no recipient has been chosen, we agree the companies with you before forwarding the inquiry. When processing for their own offers and contracts, these companies usually act as independent controllers under their own policies.

Information intended for a public company or product profile is visible to visitors and can be indexed by search engines. Passwords, private correspondence, verification documents and non-public offers are not published as part of the catalogue.

Data can be provided to competent authorities, professional advisers or other recipients where there is a legal obligation or a justified need to establish, exercise or defend legal claims.

6. Automatic translations with OpenAI and Anthropic

MACHORY uses the services of OpenAI and Anthropic (Claude) through application programming interfaces (API) to translate product descriptions and company presentations. The content needed is sent to the respective provider; not every text is necessarily processed by both.

Only the necessary text fields are sent for translation. Login data, company verification documents, personal correspondence and non-public offers are excluded. Fields with names of contact persons, phone numbers and e-mail addresses are excluded as well. Do not include such data in free descriptions meant for translation.

If a text for translation nevertheless contains personal data, this policy and the respective legal basis apply. Depending on the relationship, this is the necessity to perform a contract with the person or the legitimate interest in presenting company and product content in the supported languages, after weighing the rights of the people concerned.

For the API services used, the providers do not use the input texts and results to train their models by default. MACHORY does not opt in to sharing this content for training. This does not mean there is no storage: processing and technical logs follow the terms of the respective service, its settings and applicable legal requirements.

The providers:
• OpenAI: the provider is OpenAI Ireland Limited (Dublin, Ireland), API service for text processing. By default inputs and outputs are kept for up to 30 days in abuse-monitoring logs, unless the law requires otherwise. Processing can also take place in the USA; the standard contractual clauses of the provider’s data processing agreement (DPA) apply.
• Anthropic: the provider is Anthropic Ireland, Limited (Dublin, Ireland), Claude API service. By default inputs and outputs are deleted within 30 days, unless longer retention is needed to enforce the usage policy or by law. Processing can also take place in the USA; the standard contractual clauses of the provider’s data processing agreement (DPA) apply.

Automatic translation can contain errors. It is not an automated decision with legal or similarly significant effects for you. Automatically translated texts are marked on the page and the English original is available.

7. Analytics and YouTube

We use Google Analytics 4 of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) to measure visits and the use of the site. Analytics is switched on only after consent and can be switched off at any time through “Cookie settings”. Refusing does not prevent you from browsing the catalogue. Google Analytics 4 does not log IP addresses; event data is kept for 14 months. We do not send inquiry content, names, e-mails or phone numbers to analytics, and account, dashboard and inquiry pages are not measured.

Videos from manufacturers’ YouTube channels can be shown on the pages. The embedded player and related external resources, including thumbnails, are loaded only after you allow external video content. When they load, Google/YouTube can receive your IP address, device information and your interaction with the video under its own rules.

If you open the video through an external link, you visit YouTube and its privacy policy applies. Details about the technologies and your choices are in the Cookie policy.

8. Processing outside the European Economic Area

Using international technical providers and sending an inquiry to a company outside the European Economic Area can involve an international transfer of personal data.

When we transfer such data, we apply the appropriate mechanism under Chapter V GDPR: an adequacy decision where it covers the specific recipient, or appropriate safeguards such as standard contractual clauses and additional measures where needed. Derogations are used only when their legal conditions are met.

Choosing a foreign supplier for an inquiry is not taken as general consent to any international transfers.

Specifically:
• Hosting and e-mail: the site, the database and the mail are run by a hosting provider in the European Union.
• OpenAI and Anthropic (translations): the contract is with their Irish companies; processing in the USA is possible under standard contractual clauses (section 6).
• Google Analytics and YouTube: Google Ireland Limited; transfers to Google LLC in the USA are possible on the basis of the EU–US Data Privacy Framework, in which Google participates, and Google’s standard contractual clauses.
• Inquiries to companies outside the EEA (for example in Türkiye or China): we transfer only the data of the inquiry itself, because this is necessary for you to get an offer at your request — Art. 49(1)(b) GDPR. The receiving company processes the data as an independent controller.

You can ask for information about or a copy of the applicable safeguards at contact@machory.com, protecting the rights of others and confidential information where necessary.

9. Retention and security

We do not keep data longer than needed for the purposes it was collected for. The following periods or criteria apply:
• Accounts: while the account is active; after closing — deletion within 30 days, except for limited data we must keep on a separate basis.
• Inquiries and correspondence: 3 years after the respective inquiry is closed.
• Proof of representation: 1 year after the check is completed; documents not needed are removed.
• Public company contacts: while they are current and needed for the permitted purpose; reviewed after a notice, a change or an objection.
• Technical and security logs: 12 months.
• Analytics data: 14 months (retention setting in Google Analytics).
• Data at the AI providers: under the periods stated in section 6.
• Backups: overwritten on a 30-day cycle.
• Cookies and local storage: under the periods in the Cookie policy.

Where the law requires longer retention or the data is needed for a specific legal claim, we keep only what is necessary for the respective statutory period or until the dispute is finally closed. Access and use are limited to that purpose. When the basis ends, the data is deleted or irreversibly anonymised.

We apply technical and organisational measures appropriate to the risk, including access restrictions and measures to protect communication and systems. No internet service can guarantee absolute security.

10. Your rights

Under the GDPR you have the right to:
• access your personal data and information about the processing;
• correct inaccurate or incomplete data;
• erasure and restriction of processing in the applicable cases;
• data portability, where processing is automated and based on consent or a contract;
• object to processing based on legitimate interest on grounds relating to your particular situation;
• withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, write to contact@machory.com. If there is reasonable doubt about your identity, we may ask only for the additional information needed to confirm it.

We reply without undue delay and as a rule within one month of receiving the request. Where the legal conditions are met, this can be extended by two further months; we tell you within the first month, with the reasons.

You can lodge a complaint with the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, https://cpdp.bg/, or with another competent supervisory authority under the GDPR. Contacting MACHORY first is not a condition for a complaint.

11. Changes to this policy

We publish the current version with its effective date. For material changes we give appropriate notice. Where a new purpose or technology needs consent, we obtain it before the respective processing.

For questions: contact@machory.com.