Last updated: 20 May 2026

Privacy Policy

Warning LTD (“Warning LTD”, “we”, “us”, or “our”) is committed to protecting your personal data. This Privacy Policy explains what data we collect, why we collect it, how we use it, and what rights you have under the General Data Protection Regulation (GDPR). For information about cookies specifically, please read our Cookie Policy.

1. Who is the Data Controller?

The data controller responsible for your personal data is:

Warning LTDul. "20-ti April" 13, 1606 Sofia, Bulgaria
Email: info@warning-machines.com

2. What data we collect and why

When you fill in our quote form or contact form we collect: your name, email address, company name (optional), and the project details you provide.

Why: To respond to your enquiry, assess your project requirements, and provide a proposal. We will not use this data for marketing without your separate consent.

Legal basis: Article 6(1)(b) GDPR — processing necessary to take steps at your request prior to entering a contract.

If you book a consultation call, we collect your name, email address, and preferred meeting time. Payment data (card details) is handled entirely by Stripe and PayPal — we never see or store your payment card numbers.

Legal basis: Article 6(1)(b) GDPR — performance of a contract.

With your consent, we use Google Analytics 4 to collect aggregated, anonymised data about how visitors use our site — such as pages visited, session duration, and traffic source. This data does not identify you personally.

Legal basis: Article 6(1)(a) GDPR — your consent, given via the cookie preference centre. You can withdraw consent at any time.

If you create an account or sign in via Google to use our shop, we store your name, email address, and Google profile ID in our database to manage your orders and session.

Legal basis: Article 6(1)(b) GDPR — performance of a contract.

3. How long we keep your data

Data type	Retention period
Quote & contact form submissions	3 years from last contact, or until you request deletion
Booking & payment records	7 years (legal accounting obligation)
Analytics data	14 months (Google Analytics default)
Account data	Until you delete your account or request erasure

4. Who we share your data with

We do not sell your data. We share it only with trusted service providers who process it on our behalf:

Vercel Inc. — hosting and serverless infrastructure (USA, Standard Contractual Clauses)
Neon / Vercel Postgres — database storage (EU region)
Nodemailer / SMTP provider — sending email replies to your enquiries
Stripe Inc. — payment processing (USA, Standard Contractual Clauses)
PayPal Holdings Inc. — payment processing (USA, Standard Contractual Clauses)
Google LLC — Google Analytics, Google Sign-In (USA, Standard Contractual Clauses)

All third-party processors are bound by data processing agreements and may only use your data for the specified purpose.

5. International transfers

Some of our service providers (Vercel, Stripe, Google) are based in the United States. Where data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs) as the legal transfer mechanism. You can request a copy of the applicable safeguards by contacting us at the address below.

6. Your rights under GDPR

As a data subject in the EEA you have the right to:

Access — request a copy of the personal data we hold about you
Rectification — correct inaccurate or incomplete data
Erasure — request deletion of your data (“right to be forgotten”)
Restriction — ask us to limit how we use your data
Portability — receive your data in a structured, machine-readable format
Object — object to processing based on legitimate interests
Withdraw consent — at any time, without affecting prior lawful processing
Lodge a complaint — with the Commission for Personal Data Protection (Bulgaria) at www.cpdp.bg

To exercise any of these rights, email us at info@warning-machines.com. We will respond within 30 days.

7. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encrypted connections (HTTPS), access controls, and restricted data access on a need-to-know basis. However, no internet transmission is 100% secure — if you believe your data has been compromised, please contact us immediately.

8. Children

Our services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, please contact us and we will delete it promptly.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will update the “Last updated” date at the top of this page. We encourage you to review this page periodically.

10. Contact us

For any privacy-related questions or to exercise your rights: