1. The Short Version
We collect only what you type into two forms on this site: the contact form and the calculator email report. We run no advertising pixels and no cross-site tracking. Two scripts beyond the site itself exist: an invisible bot-protection layer (Vercel BotID) that keeps automated spam out of our forms, and consent-gated Google Analytics that stays completely off until you accept it in the cookie banner. Your data is used to answer you, never sold, and shared only with the service providers that deliver this website, its email, and (with your consent) its analytics. This page explains all of it in detail.
2. Who We Are
ecomlabs360.com (the "Site") is operated by Ecom Performance Labs Ltd., trading as EcomLabs360 ("we", "us"): a performance marketing agency registered in Bulgaria under UIC 203850550, with registered address at 94 Knyaz Boris I Street, Vazrazhdane District, 1000 Sofia, Bulgaria. We provide growth services to direct-to-consumer ecommerce brands globally. For every question about this policy and for all data requests, contact us at office@ecomlabs360.com. Ecom Performance Labs Ltd. is the data controller for personal data collected through the Site.
3. Data You Give Us
Contact form. When you submit the contact form we collect your name, email address, website URL, and the project brief you write. The submission is delivered to our team mailboxes by email. We use it to respond to your enquiry, evaluate whether we are a fit, and follow up about a potential engagement.
Calculator email report. Our free tools (such as the Breakeven ROAS Calculator) run entirely in your browser: the numbers you enter are encoded in the page URL and are not sent to us while you use the tool. Only if you choose "Email me this" do we receive your email address and the calculator inputs you submitted. We use them to generate the report you requested, send it to you, and receive an internal copy so we can follow up if you become a lead.
What we never collect on this Site: payment details, account credentials, or special categories of personal data (such as health or political data). The Site has no login and no user accounts.
4. Data Collected Automatically
Our hosting infrastructure records standard server logs when you visit: IP address, browser type, requested pages, and timestamps. These logs exist for security, abuse prevention, and debugging, and rotate automatically within short retention windows. When you interact with certain informational widgets on the Site, we log which option was clicked (for example, a vertical or scenario name); these events contain no personal data fields.
When you submit one of our forms, an invisible bot-protection layer (Vercel BotID) additionally evaluates technical browser and device signals to classify the submission as human or automated. These signals are used solely for that classification, never for advertising, and are processed by Vercel as our processor (Sections 5 and 6).
Analytics, only with your consent. If you accept analytics in the cookie banner, Google Analytics 4 collects pseudonymous usage data: pages viewed, referral source, approximate region, device and browser type, and interaction events (for example that a contact form was submitted or the calculator was used - never the contents of what you typed). Until you accept, the analytics script is not even loaded and nothing is sent to Google. We use no advertising pixels, no session recording, and no advertising-purpose fingerprinting, and we have Google's advertising signals features switched off. See the Cookie Policy for the exact cookies and how to change your choice.
5. Purposes and Legal Bases (EU/EEA/UK)
| Processing | Data | Legal basis |
|---|---|---|
| Responding to contact form enquiries | Name, email, website, brief | Legitimate interest (Art. 6(1)(f) GDPR): responding to a business enquiry you initiated |
| Sending a calculator report you requested | Email, calculator inputs | Steps you request prior to a potential contract (Art. 6(1)(b) GDPR) |
| Following up on a report request as a business lead | Email, calculator inputs | Legitimate interest: business development toward a B2B audience |
| Server logs and abuse prevention | IP, browser, request metadata | Legitimate interest: security and reliable operation of the Site |
| Spam and bot protection on form submissions | Technical browser and device signals evaluated by Vercel BotID | Legitimate interest: preventing automated abuse of our forms and email infrastructure |
| Aggregate site analytics | Pseudonymous identifiers plus device, page, and interaction data in Google Analytics | Consent (Art. 6(1)(a) GDPR), given in the cookie banner and withdrawable at any time via the footer's Cookie choices link |
Where we rely on legitimate interest, you have the right to object at any time (see Section 9).
6. Who Receives Your Data
We do not sell or rent personal data, and we do not share it with advertising networks. Data is processed by the service providers that run this Site, each acting as our processor under a data processing agreement:
- Vercel Inc. (USA): website hosting and serverless infrastructure with a global delivery network. Form submissions pass through Vercel's systems and appear briefly in operational logs. Vercel also provides the Site's invisible bot-detection layer (Vercel BotID), which evaluates technical browser signals when a protected form is submitted, solely to distinguish human visitors from automated abuse.
- Resend: email delivery. Form submissions and calculator reports are sent as email through Resend, configured in their European Union region (Ireland, eu-west-1).
- Google Workspace: our team mailboxes, where contact form submissions and lead copies are ultimately stored and read.
- Google Ireland Limited (Ireland): consent-gated site analytics (Google Analytics 4). Receives pseudonymous usage data only after you accept analytics in the cookie banner, with Google LLC (USA) acting as sub-processor. Advertising features and Google Signals are switched off.
If a prospective engagement progresses, correspondence continues over email; we do not currently load Site submissions into any other CRM system.
7. International Transfers
We are based in Bulgaria (EU). Email sending runs in the EU (Ireland). Our hosting, mailbox, and analytics providers are US companies or have US parents, so some processing involves transfers to the United States. Those transfers rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses adopted by the European Commission, as applicable to each provider; Google LLC is certified under the Data Privacy Framework.
8. Retention
- Contact form submissions and calculator lead copies: kept in our mailboxes for up to 24 months from your last interaction with us, then deleted, unless an active client engagement or a legal obligation requires longer.
- Server and function logs: rotate automatically within days to a few weeks.
- Email delivery metadata at our providers: retained for the providers' short operational windows.
- Analytics data (only if you consented): event-level data is retained in Google Analytics for 14 months, then deleted automatically. Your consent choice itself lives in your own browser until you change it or clear site data.
9. Your Rights (EU/EEA/UK)
You can ask us at any time to: access the personal data we hold about you; correct it; delete it; restrict its processing; receive it in a portable format; or object to processing based on legitimate interest. Where processing is based on consent (analytics), you can withdraw that consent at any moment via the Cookie choices link in the footer, with immediate effect and no impact on anything else on the Site. We do not use automated decision-making or profiling that produces legal effects. To exercise any right, email office@ecomlabs360.com; we respond within 30 days.
You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Bulgarian Commission for Personal Data Protection (CPDP), Sofia, Bulgaria (cpdp.bg), or you may contact the authority in your own member state.
10. Information for United States Residents
In the terminology of US state privacy laws (such as the California Consumer Privacy Act as amended by the CPRA): we collect identifiers (name, email address, website URL), commercial information (the contents of your enquiry or calculator scenario), and internet or network activity (server logs and, only if you opted in, pseudonymous analytics events), directly from you and from your device. We use them for the business purposes described in Section 5.
We do not sell personal information, do not share it for cross-context behavioral advertising, and have not done either in the preceding 12 months. We do not use or disclose sensitive personal information. Because no tracking runs on this Site, there is nothing for a Global Privacy Control signal to switch off; the Site behaves as if the signal were always on.
Although our company may fall below the thresholds at which some of these laws formally apply, we honor their core rights for all US residents: the right to know, access, correct, and delete your personal information, and the right not to be discriminated against for exercising those rights. Requests: office@ecomlabs360.com.
11. Security
All traffic to the Site is encrypted with HTTPS. Form submissions are validated server-side, protected against cross-site request forgery, and filtered by a honeypot against bots. Access to our mailboxes and infrastructure accounts is restricted to team members who need it and protected by strong authentication.
12. Children
The Site is a business-to-business service directed at adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has submitted data to us, email office@ecomlabs360.com and we will delete it promptly.
13. Changes to This Policy
When we change this policy, we update the "Last updated" date on this page. If we ever introduce processing that materially changes what happens with your data (for example, deploying analytics), we will update this policy first and, where required, ask for consent before the change takes effect.
14. Contact
Privacy questions and data requests: office@ecomlabs360.com. Postal enquiries: Ecom Performance Labs Ltd., 94 Knyaz Boris I Street, 1000 Sofia, Bulgaria.
