Last updated: 30 September 2026
ACSO Consulting EOOD, a company incorporated under Bulgarian law with its registered office in Sofia, operates the website acsoconsulting.com and is the controller of the personal data described in this notice.
ACSO Consulting EOOD is entered in the Bulgarian Commercial Register kept by the Registry Agency, registered office Sofia, Bulgaria. The company is not registered for VAT and therefore holds no VAT identification number. We provide our registration number and a register extract with the first reply to an enquiry.
To write to us, use the contact form.
Data reaches us by three routes:
a) Data you enter in the contact form
You submit this data voluntarily. It is used solely to answer your enquiry and to assess whether our activities match what you need.
b) Analytics cookies (only with your consent)
We use Google Analytics 4 (GA4) and Microsoft Clarity to understand how visitors use the site. These tools collect usage data such as pages viewed, scroll depth, click patterns and referral source. Clarity additionally produces session recordings and heatmaps. Sensitive form inputs are masked automatically.
This data is pseudonymised: it is processed under a cookie identifier that does not name you directly. It therefore remains personal data within the meaning of Art. 4(1) GDPR and is not anonymous. Your IP address is also processed by these services; we do not truncate or mask it.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| _ga | Distinguishes individual visitors | 2 years | |
| _gid | Distinguishes visitors within a single day | 24 hours | |
| _clck | Microsoft | Stores the Clarity user ID | 1 year |
| _clsk | Microsoft | Links page views within one session | 1 day |
| CLID | Microsoft | Recognises returning users | 1 year |
| MUID | Microsoft | Recognises the same browser across Microsoft services | 1 year |
| ANONCHK | Microsoft | Checks technically whether identifiers can be set | 10 minutes |
| SM | Microsoft | Synchronises the identifier across Microsoft domains | Session |
The durations are set by the respective providers and may be changed by them.
These cookies are set only if you click “Accept” in the banner. If you reject, or do not interact with the banner at all, no analytics cookies are set and no tracking data is collected.
Your consent covers analytics only. No advertising, remarketing or personalisation cookies are set, and the advertising consent signals (ad_storage, ad_user_data, ad_personalization) remain denied at all times, including after you click “Accept”. Google Signals is not enabled.
c) Your IP address
When you submit the contact form, our server derives an MD5 digest from your IP address and stores the timestamps of your submissions under that digest, in order to enforce a limit of five submissions per IP address per hour. The IP address itself is not stored in clear text. Separately, the web server keeps ordinary access logs which contain the IP address; these serve the secure operation of the service and the investigation of faults and attacks.
Your data is not used for automated decision-making, profiling or advertising.
We do not sell, rent or pass on your personal data to any other third party.
Transfers outside the EEA. Both processors are established in the EEA. They may pass data on to their group companies in the United States, in particular to Google LLC and Microsoft Corporation. That onward transfer relies primarily on the certification of both companies under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023. The European Commission’s standard contractual clauses are additionally in place as a supplementary measure, covering transfers not caught by that certification.
Under the GDPR you have the right to:
Withdrawal of consent (Art. 7(3) GDPR). You may withdraw your consent to analytics cookies at any time. Withdrawal does not affect the lawfulness of processing carried out on the basis of that consent before it was withdrawn. To withdraw, use the “Withdraw cookie consent” control at the foot of this page, or the “Cookies” control in the site footer. This resets the stored consent, switches analytics off and deletes the analytics cookies already set; the consent banner then appears again.
To exercise these rights, use the contact form. We respond within 30 days.
Your data is protected by HTTPS encryption in transit, server-side validation, submission rate limiting and restricted access to form submissions. No system is entirely secure, but the measures applied are proportionate to the sensitivity of the data.
This notice may be updated from time to time. The “last updated” date at the top indicates the current version. Material changes are announced on the site.
See also: Terms of use ·