1. The Short Version
We collect only what you type into two forms on this site: the contact form and the calculator email report. We run no analytics and no tracking pixels; the only third-party script on the Site is an invisible bot-protection layer (Vercel BotID) that keeps automated spam out of those forms. Your data is used to answer you, never sold, and shared only with the infrastructure providers that deliver this website and its email. This page explains all of it in detail.
2. Who We Are
ecomlabs360.com (the "Site") is operated by Ecom Performance Labs Ltd., trading as EcomLabs360 ("we", "us"): a performance marketing agency registered in Bulgaria under UIC 203850550, with registered address at 94 Knyaz Boris I Street, Vazrazhdane District, 1000 Sofia, Bulgaria. We provide growth services to direct-to-consumer ecommerce brands globally. For every question about this policy and for all data requests, contact us at office@ecomlabs360.com. Ecom Performance Labs Ltd. is the data controller for personal data collected through the Site.
3. Data You Give Us
Contact form. When you submit the contact form we collect your name, email address, website URL, and the project brief you write. The submission is delivered to our team mailboxes by email. We use it to respond to your enquiry, evaluate whether we are a fit, and follow up about a potential engagement.
Calculator email report. Our free tools (such as the Breakeven ROAS Calculator) run entirely in your browser: the numbers you enter are encoded in the page URL and are not sent to us while you use the tool. Only if you choose "Email me this" do we receive your email address and the calculator inputs you submitted. We use them to generate the report you requested, send it to you, and receive an internal copy so we can follow up if you become a lead.
What we never collect on this Site: payment details, account credentials, or special categories of personal data (such as health or political data). The Site has no login and no user accounts.
4. Data Collected Automatically
Our hosting infrastructure records standard server logs when you visit: IP address, browser type, requested pages, and timestamps. These logs exist for security, abuse prevention, and debugging, and rotate automatically within short retention windows. When you interact with certain informational widgets on the Site, we log which option was clicked (for example, a vertical or scenario name); these events contain no personal data fields.
When you submit one of our forms, an invisible bot-protection layer (Vercel BotID) additionally evaluates technical browser and device signals to classify the submission as human or automated. These signals are used solely for that classification, never for advertising, and are processed by Vercel as our processor (Sections 5 and 6).
We do not use analytics platforms, advertising pixels, session recording, or advertising-purpose fingerprinting on the Site. See the Cookie Policy for the complete picture: the Site sets no advertising or analytics cookies.
5. Purposes and Legal Bases (EU/EEA/UK)
| Processing | Data | Legal basis |
|---|---|---|
| Responding to contact form enquiries | Name, email, website, brief | Legitimate interest (Art. 6(1)(f) GDPR): responding to a business enquiry you initiated |
| Sending a calculator report you requested | Email, calculator inputs | Steps you request prior to a potential contract (Art. 6(1)(b) GDPR) |
| Following up on a report request as a business lead | Email, calculator inputs | Legitimate interest: business development toward a B2B audience |
| Server logs and abuse prevention | IP, browser, request metadata | Legitimate interest: security and reliable operation of the Site |
| Spam and bot protection on form submissions | Technical browser and device signals evaluated by Vercel BotID | Legitimate interest: preventing automated abuse of our forms and email infrastructure |
Where we rely on legitimate interest, you have the right to object at any time (see Section 9).
6. Who Receives Your Data
We do not sell or rent personal data, and we do not share it with advertising networks. Data is processed by the service providers that run this Site, each acting as our processor under a data processing agreement:
- Vercel Inc. (USA): website hosting and serverless infrastructure with a global delivery network. Form submissions pass through Vercel's systems and appear briefly in operational logs. Vercel also provides the Site's invisible bot-detection layer (Vercel BotID), which evaluates technical browser signals when a protected form is submitted, solely to distinguish human visitors from automated abuse.
- Resend: email delivery. Form submissions and calculator reports are sent as email through Resend, configured in their European Union region (Ireland, eu-west-1).
- Google Workspace: our team mailboxes, where contact form submissions and lead copies are ultimately stored and read.
If a prospective engagement progresses, correspondence continues over email; we do not currently load Site submissions into any other CRM system.
7. International Transfers
We are based in Bulgaria (EU). Email sending runs in the EU (Ireland). Our hosting and mailbox providers are US companies, so some processing involves transfers to the United States. Those transfers rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses adopted by the European Commission, as applicable to each provider.
8. Retention
- Contact form submissions and calculator lead copies: kept in our mailboxes for up to 24 months from your last interaction with us, then deleted, unless an active client engagement or a legal obligation requires longer.
- Server and function logs: rotate automatically within days to a few weeks.
- Email delivery metadata at our providers: retained for the providers' short operational windows.
9. Your Rights (EU/EEA/UK)
You can ask us at any time to: access the personal data we hold about you; correct it; delete it; restrict its processing; receive it in a portable format; or object to processing based on legitimate interest. We do not use automated decision-making or profiling that produces legal effects. To exercise any right, email office@ecomlabs360.com; we respond within 30 days.
You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Bulgarian Commission for Personal Data Protection (CPDP), Sofia, Bulgaria (cpdp.bg), or you may contact the authority in your own member state.
10. Information for United States Residents
In the terminology of US state privacy laws (such as the California Consumer Privacy Act as amended by the CPRA): we collect identifiers (name, email address, website URL), commercial information (the contents of your enquiry or calculator scenario), and internet or network activity (server logs), directly from you and from your device. We use them for the business purposes described in Section 5.
We do not sell personal information, do not share it for cross-context behavioral advertising, and have not done either in the preceding 12 months. We do not use or disclose sensitive personal information. Because no tracking runs on this Site, there is nothing for a Global Privacy Control signal to switch off; the Site behaves as if the signal were always on.
Although our company may fall below the thresholds at which some of these laws formally apply, we honor their core rights for all US residents: the right to know, access, correct, and delete your personal information, and the right not to be discriminated against for exercising those rights. Requests: office@ecomlabs360.com.
11. Security
All traffic to the Site is encrypted with HTTPS. Form submissions are validated server-side, protected against cross-site request forgery, and filtered by a honeypot against bots. Access to our mailboxes and infrastructure accounts is restricted to team members who need it and protected by strong authentication.
12. Children
The Site is a business-to-business service directed at adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has submitted data to us, email office@ecomlabs360.com and we will delete it promptly.
13. Changes to This Policy
When we change this policy, we update the "Last updated" date on this page. If we ever introduce processing that materially changes what happens with your data (for example, deploying analytics), we will update this policy first and, where required, ask for consent before the change takes effect.
14. Contact
Privacy questions and data requests: office@ecomlabs360.com. Postal enquiries: Ecom Performance Labs Ltd., 94 Knyaz Boris I Street, 1000 Sofia, Bulgaria.
