Privacy Policy | BlitzPoll

I. Data Controller

CNTS Ltd (CNTS Ltd. / Center for New Technological Systems) is the data controller within the meaning of Regulation (EU) 2016/679 (GDPR).

Company registration (EIK): 206255746
VAT number: BG206255746
Registered address: 44 Dunav Street, fl. 3, 1202 Sofia, Bulgaria
Managing Director: Hristina Todorova Panayotova
Data protection email: [email protected]

II. Scope of This Policy

This policy covers the processing of personal data when using the BlitzPoll platform (blitzpoll.com) — a free survey, feedback, and NPS platform operated by CNTS Ltd.

III. Applicable Legislation

This policy has been prepared in accordance with:

Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation — GDPR);
The Personal Data Protection Act (ZZLD) of the Republic of Bulgaria.

IV. Roles in Data Processing

CNTS Ltd acts as the data controller for users of the BlitzPoll platform.

Organizations and companies that use BlitzPoll to collect feedback may act as joint controllers or data processors only when the user has explicitly consented to sharing their data with a specific organization.

Where joint controllership applies, the respective responsibilities are defined by agreement between CNTS Ltd and the organization. The essence of such arrangement is available to data subjects upon request.

V. Types of Personal Data

Depending on how you use the BlitzPoll platform, we may process the following categories of personal data:

Contact data: email address provided during registration.
Demographic data: year of birth, gender, and location — provided voluntarily.
Additional profile data: any other information the user voluntarily chooses to add to their profile.
Usage data: questionnaire responses, ratings, preferences, and settings.

Users enter data only for themselves. The platform does not envisage or allow entry of personal data of third parties.

Free-text survey responses on BlitzPoll may, at the user's initiative, contain special category data within the meaning of Art. 9 of the GDPR (e.g., health data, political opinions, religious beliefs). CNTS Ltd does not require or encourage the provision of such data. If a user voluntarily enters such information, processing is based on their explicit consent (Art. 9(2)(a) GDPR), expressed through the voluntary submission. We recommend that users do not include sensitive personal data in their responses unless they expressly wish to do so.

VI. Age Restriction

The BlitzPoll platform is not intended for individuals under the age of 14 (per Art. 25b of the Bulgarian Personal Data Protection Act — ZZLD). If we discover that data has been collected from a person under this age threshold, that data will be immediately deleted.

VII. Purposes and Legal Bases for Processing

We process personal data on the following legal grounds under Art. 6(1) of the GDPR:

Performance of a contract (Art. 6(1)(b)): processing is necessary to provide the platform services — registration and use of BlitzPoll.
Consent (Art. 6(1)(a)): when the user voluntarily provides additional data or consents to sharing information with a specific organization.
Legal obligation (Art. 6(1)(c)): when processing is necessary to comply with applicable legislation.
Legitimate interest (Art. 6(1)(f)): to maintain platform security, prevent abuse, and improve services.

CNTS Ltd has conducted a legitimate interest balancing test, which concluded that the stated interests do not disproportionately affect the rights and freedoms of data subjects. A copy of the assessment is available upon request at [email protected].

VIII. How We Collect Data

We collect personal data through the following means:

Registration: when creating a user profile on BlitzPoll.
Platform usage: data generated through your interaction with the platform (questionnaire responses, preferences, settings).
Email communication: when you contact us at the provided email addresses.

Providing an email address is a contractual requirement necessary for creating a profile on BlitzPoll (Art. 13(2)(e) GDPR). Without this data, it is not possible to provide the service. Providing demographic data is entirely voluntary, and refusal does not restrict access to the services.

IX. Disclosure of Data to Third Parties

Feedback provided through BlitzPoll is transmitted to client organizations in aggregated and pseudonymized form by default, where individual responses cannot be linked to a specific user without additional information held solely by CNTS Ltd. A user's personal data is disclosed to a specific organization only with the user's explicit consent, with the organization clearly identified at the time consent is given.

For the provision of our services, we use the following sub-processors (data processors):

Cloudflare Inc. (USA; content delivery network with processing in the EU, SCCs) — hosting, CDN, and execution of server-side functions for blitzpoll.com.
Plausible Analytics (EU) — cookieless web analytics for blitzpoll.com.

CNTS Ltd has entered into Data Processing Agreements (DPA) in accordance with Art. 28 GDPR with all listed sub-processors. These agreements ensure that sub-processors process personal data only under our documented instructions and apply appropriate technical and organizational measures. A copy of the applicable DPAs may be obtained upon request at [email protected].

We do not sell, rent, or share personal data with third parties for marketing purposes.

We may disclose personal data when required by law, court order, or a binding request from a competent authority. We will notify the data subject where legally permissible.

X. International Transfer of Data

The primary data processing takes place within the European Union. For sub-processors established in the USA (Cloudflare), data transfer is carried out on the basis of Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with Art. 46(2)(c) GDPR.

XI. Data Retention Period

Personal data is retained for the duration of the active user profile. After profile deletion, data is retained for an additional period of 180 days, after which it is permanently deleted.

Anonymized and aggregated data has no retention limit, as it does not constitute personal data.

XII. Security and Breach Notification

We implement appropriate technical and organizational measures to protect personal data:

Data is stored on servers within the European Union.
Communication is protected through SSL/TLS encryption.
Data at rest is encrypted.
Access to data is restricted on a need-to-know basis.

In the event of a personal data breach, CNTS Ltd will notify the Commission for Personal Data Protection (CPDP) within 72 hours of becoming aware of the breach, as well as affected individuals where applicable.

XIII. Cookies and Analytics

The BlitzPoll platform uses a single cookie — kazvabg_cookie. This cookie is encrypted and is used for:

Recognizing the user on return visits;
Preserving user preferences and functionality;
Storing interaction history;
Preventing abuse.

The blitzpoll.com website uses Plausible Analytics — a web analytics tool that does not use cookies, does not collect personal data, and is fully GDPR compliant. No marketing cookies, advertising pixels, or tracking tools are used.

For more information, see our Cookie Policy.

XIV. Rights of Data Subjects

Under the GDPR, you have the following rights regarding your personal data:

Right of access (Art. 15): to obtain information about whether and what personal data we process about you.
Right to rectification (Art. 16): to request correction of inaccurate data.
Right to erasure (Art. 17): to request deletion of your data ("right to be forgotten").
Right to restriction (Art. 18): to request restriction of processing.
Right to data portability (Art. 20): to receive your data in a structured, machine-readable format.
Right to object (Art. 21): to object to processing based on legitimate interest.
Right not to be subject to automated decision-making (Art. 22): including profiling with legal effects. BlitzPoll does not make automated decisions with legal effects.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing prior to withdrawal.

XV. How to Exercise Your Rights

You can exercise your rights in the following ways:

Self-service: through the profile deletion function on the BlitzPoll platform.
By email: by sending a request to [email protected].
By post: to: CNTS Ltd, 44 Dunav Street, fl. 3, 1202 Sofia, Bulgaria.

We will respond to your request within 1 month of receipt. Where necessary, this period may be extended by an additional 2 months for complex or multiple requests, of which you will be informed.

XVI. Marketing Communications

CNTS Ltd does not send unsolicited marketing communications to BlitzPoll users. Communication with users is limited to:

Technical and system notifications;
Platform maintenance messages;
Responses to user inquiries.

XVII. Data Protection Officer

Following an assessment of our processing activities pursuant to Art. 37 GDPR, we have determined that the appointment of a Data Protection Officer is not mandatory. Nevertheless, data protection inquiries may be directed to [email protected].

XVIII. Version and Changes

CNTS Ltd reserves the right to update this policy. When significant changes occur, the updated version will be published on the BlitzPoll platform. Where changes materially affect user rights, affected individuals will be notified by email.

Last updated: 16.03.2026

XIX. Right to Complain

If you believe the processing of your personal data violates your rights, you have the right to file a complaint with:

Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
www.cpdp.bg

Before filing a complaint, we encourage you to contact us at [email protected] so we can attempt to resolve the matter.

XX. Contact

For questions about this personal data protection policy:

Company: CNTS Ltd (CNTS Ltd.)
Company registration (EIK): 206255746
Address: 44 Dunav Street, fl. 3, 1202 Sofia, Bulgaria
Email: [email protected]