B2B Outreach — Privacy Notice (GDPR Art.14)
This is the Article 14 disclosure for the B2B outreach programme of pragma-lab. It is paired with a Bulgarian-language version, which is the version that legally governs recipients in Bulgaria (Art.12(1) GDPR — "concise, transparent, intelligible … in clear and plain language").
1. Who we are (controller)
Controller: NetOps EOOD (trading as pragma-lab) — ЕИК BG205566292, represented by Radoslav Ivanov Mitov (CEO).
Registered business address: Sofia, ul. Tsar Shishman 4, 1000 Sofia, Bulgaria.
Contact for privacy matters: hello@pragma-ai.eu (same mailbox used as the cold-email From: / reply-to; live on the pragma-ai.eu Workspace — PRAA-28 closed).
We have not appointed a DPO. Based on Art.37 GDPR, the volume and nature of processing described here does not require one; this assessment will be revisited if our processing changes.
2. What data we hold and where we got it (Art.14(1)(d), Art.14(2)(f))
We process business-contact data only, obtained from publicly available sources (public web directories, clinic websites, business listings). Categories:
- Clinic / practice name and public business email address
- Publicly listed services, languages, and location
- The result of a response-time check we ran against the clinic's own public inquiry channel
We do not process patient data, health data, or any natural person's personal data beyond a publicly listed business contact. Source: public directories (Art.14(2)(f)).
3. Why we process it, and our legal basis (Art.14(1)(c), Art.13/14 + Art.6(1)(f))
Purpose: one-to-one B2B commercial outreach about a response-time audit of the clinic's public inquiry channel, and the service that addresses the gap it revealed.
Legal basis: legitimate interest — GDPR Art.6(1)(f). Our legitimate interest is direct B2B marketing of a relevant service to a business that demonstrably has the gap our service fixes. We have weighed this against the recipient's interests (legitimate-interest assessment summary): data is business-only and already public; volume is low and targeted; every message carries an immediate one-click opt-out; we hold no special-category or patient data.
The full internal Legitimate-Interest Assessment is recorded at runbooks/RB-11-lia-outreach.md (founder-accepted on Path A, PRAA-37; grounded verbatim in runbooks/RB-11-citations.md). This is an internal risk-assessment document, not a counsel-signed legal opinion. Counsel confirmation is deferred to the pre-scale milestone per Path A-1 (PRAA-29); the page is moving forward on the founder-accepted risk decision, not on counsel pre-clearance.
4. Who we share it with (Art.14(1)(e))
We do not sell or share this data. At the date of publication no email-sending or storage processors are engaged for this outreach — the list lives in a single human-operated spreadsheet and emails (when sent) leave from the controller's own mailbox. When a sending/storage processor is engaged, this section will be updated with the processor's name, processing purpose, and location before any further send. No transfers outside the EU/EEA are intended at this time.
5. How long we keep it (Art.14(2)(a), Art.5(1)(e))
We keep a contact's data only as long as needed for this outreach. If you opt out, we keep the minimum needed to honour the opt-out (a suppression record) and delete the rest. Retention period if no engagement: 6 months from last contact attempt, after which we delete or anonymise the record. The controller sets this period on its own authority under GDPR Art.5(1)(e); the period is stated as a decided value, not a counsel-pending item. Operational records of a concluded transaction (e.g. an accepted service offer) follow the statutory Bulgarian 5-year bookkeeping retention (ДДС чл.41 / Търговски закон чл.38).
6. If you are a sole proprietor (natural-person layer, ЗЗЛД)
If you are a sole proprietor / ЕТ and the address we hold is your personal contact (a mailbox you operate personally rather than a generic office@ / info@ of a multi-person entity), the data we hold about you is also your personal data as a natural person under ЗЗЛД. In that case you additionally have the right to: (a) know the source of the data (publicly available directories, per Art.14(2)(f)); (b) object to processing for direct marketing at any time, with effect from that moment (Art.21(2) + ЗЕТ чл.6 ал.4); (c) lodge a complaint with КЗЛД as named below. We apply the same opt-out, retention, and complaint rights to natural-person sole proprietors as to legal-entity recipients.
7. Your rights (Art.14(2)(c)/(e), Art.21)
You can at any time: access your data; have it corrected or erased; restrict or object to processing; and request portability. Because our basis is legitimate interest, you have an absolute right to object to direct marketing (Art.21(2)) — on objection we stop immediately and suppress your address.
To exercise any right, reply to our email or contact us at the address in section 1.
Opt-out now: reply STOP and you will not hear from us again.
8. Complaints (Art.14(2)(e))
You have the right to lodge a complaint with the Bulgarian supervisory authority:
Комисия за защита на личните данни (КЗЛД / CPDP) — cpdp.bg · kzld.bg.
9. Automated decision-making
None. We do not carry out automated decision-making or profiling that produces legal / significant effects on you (Art.14(2)(g)). A response-time check is an observation, not profiling.
10. Send status (honest disclosure)
This page is published. The cold-email send programme that links to it is not yet sending — it remains gated on the items in section 11, which the human owner must resolve before any first send. Publishing the Art.14 URL in advance is required by Art.14(3)(b); the page going live is therefore a publish-side milestone, not a send authorisation.
11. Open items (none counsel-pending — Path A reframe, PRAA-50)
Six items remain open. None of them is a counsel-pending blank: the page is moving forward on Path A (runbooks/RB-11-risk-decisions.md §Path-A-1 + §Path-A-2, PRAA-37; the BG ЗЕТ re-distill is PRAA-23; the founder-accepted risk-decision log is the canonical record). Counsel sign-off is a Path-A-1 expiry trigger and a pre-scale gate (PRAA-29), not a publish-time gate. The internal LIA in §3 is a founder-accepted risk assessment per Path A-2 — it is not a counsel-signed legal opinion.
- Publish at a real URL (CTO/human) and link it inside the first cold email (GDPR Art.14(3)(b)). Live target:
https://pragma-ai.eu/privacy/outreach/. - Processor names on this page —
[ЛИПСВА](genuine page-copy blank). Owner: founder. Closes the page publish. - Retention period — decided: 6 months no-engagement per GDPR Art.5(1)(e); 5-year Bulgarian bookkeeping retention follows ДДС чл.41 / Търговски закон чл.38 by statute. (No further action on this row.)
- ЗЕТ counsel sign-off — controller is proceeding on the grounded reading of the ЗЕТ чл.6 opt-out regime: legal-entity recipient = opt-out (КЗП register check, ЗЕТ чл.6 ал.2–3); consumer (потребител per § 1 т. 4 ДР на ЗЕТ) = prior opt-in (ЗЕТ чл.6 ал.4). Source:
runbooks/RB-11-risk-decisions.md§Path-A-1. Counsel deferred to the pre-scale milestone (PRAA-29). (No further action on this row at publish time.) - КЗП register per-recipient check — ongoing pre-send operator process, not a fillable blank on this page. The operator runs the check at send time per Path-A-1 §"Operational checklist" item 3; on register → halt for that recipient (ЗЕТ чл.6 ал.3). (Operator owner at first-send time.)
consentcolumn indata/dental-prospects.csv— the only genuine open data item on this cycle. CSV schema hasrecipient_type,kzp_register_checked,send_eligible,mailbox_type(PRAA-25) but does not yet have aconsentcolumn per RB-00 §4 / RB-11 Check 2. Owner: data-curator / BizDev. This is a DATA task, not page copy; it does not block the page republish. It blocks the first send per Path-A-1 §"Operational checklist" item 8.
Identity-fill carry-forward: items formerly numbered 1–3 in this section (controller legal name + EIK, registered business address, monitored privacy / reply-to mailbox) are resolved in §1 above; the identity-fill was completed and republished on 2026-06-16, PRAA-47. The Path-A reframe of items 1–4 (counsel-pending blanks removed) was applied 2026-06-16, PRAA-50.