Privacy Policy
How MAGNET MINDS OOD collects, uses and protects personal data when you visit our websites, book a call, send us a brief or work with us.
Data Controller
The controller of your personal data is MAGNET MINDS OOD, the company behind the Magnet Minds agency and the mAInds AI video studio.
We have not appointed a Data Protection Officer. For any question about your personal data, write to [email protected].
Personal Data We Collect
We collect only what we need to answer you, plan and deliver the work, and keep our website running.
What you give us:
- When you book a call through Cal.com: your name, email address, the time you pick and anything you write in the booking notes.
- When you send a brief on our AI video pages: your email address, business name, website, the services and budget range you select, and any details you add.
- When you email, call or message us on WhatsApp: your name, contact details and the content of your message.
- When you become a client: contact details of your team, billing details, and the access, brand assets and files you share for the project.
What is collected automatically:
- Server logs: when a page loads, our hosting provider Cloudflare processes your IP address, browser type and the page requested, to deliver the site and protect it from attacks.
- Analytics, only if you accept cookies: Google Analytics records which pages you view, how you arrived, your approximate location (country and city), and your device and browser type.
We do not use advertising pixels on our website, and we do not ask for sensitive data such as health information, religious beliefs, ethnic origin or political opinions. Please do not include it in a brief or message.
Purposes of Processing
We use personal data for these purposes:
- Replying to you. To answer enquiries, briefs and messages and to hold the calls you book.
- Proposals and delivery. To prepare proposals, deliver the services you order and manage the project with you.
- Billing and accounting. To issue invoices and keep the accounting records the law requires.
- Improving the website. To see, in aggregate, which pages help visitors, using Google Analytics and only with your consent.
- Security. To protect the website and our systems from abuse and spam.
- Updates for clients. To send existing clients occasional news about services similar to the ones they use. You can opt out at any time.
- Legal obligations. To meet tax, accounting and other legal duties and to answer lawful requests from authorities.
Legal Basis for Processing
Under the General Data Protection Regulation (GDPR), we rely on these legal bases:
- Contract (Art. 6(1)(b)). For the steps you ask for before a contract, such as a call or a proposal, and for delivering the services you order.
- Consent (Art. 6(1)(a)). For Google Analytics cookies. You can withdraw consent at any time on our Cookie Policy page. Withdrawal does not affect processing that happened before it.
- Legitimate interests (Art. 6(1)(f)). To answer messages from businesses, keep the website secure and send existing clients occasional updates about similar services. We have weighed these interests against your rights, and you can object at any time.
- Legal obligation (Art. 6(1)(c)). To keep invoices and accounting records and to answer lawful requests from authorities.
Giving us your details is voluntary. Without an email address, though, we cannot reply to a brief or confirm a booking.
We do not make decisions about you based solely on automated processing, including profiling.
Who Receives Your Data
We do not sell your personal data, and we do not share it with anyone for their own marketing.
- Service providers. Companies that run parts of our website and operations for us, listed in Section 6. They process your data on our instructions under data processing terms.
- Platforms you choose to use. When you message us on WhatsApp or open our Instagram, Facebook or LinkedIn profile, that platform handles your data under its own privacy policy.
- Advisers and authorities. Our accountant, lawyers and auditors where needed, and public authorities when the law requires it.
- Business transfers. If the company or part of it is sold or merged, your data may pass to the new owner, who must keep protecting it in line with this policy. We will tell you before your data falls under a different privacy policy.
Service Providers
These providers process personal data for us:
| Provider | What it does for us | Data involved | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting and security for our website | IP address, browser data, pages requested | USA, global network |
| Google Ireland Limited (Google Analytics) | Website statistics, only after you accept cookies | Pages viewed, approximate location, device and browser data, online identifiers | EU, USA |
| Google Ireland Limited (Google Workspace) | Business email and calendar | Emails, briefs, booking confirmations, contact details | EU, USA |
| Cal.com, Inc. | Booking calls | Name, email, chosen time, booking notes, IP address | USA |
| Formspree, Inc. | Delivers the brief form to our inbox, only when the form sends directly instead of opening your email app | The brief fields you fill in, IP address | USA |
| WhatsApp Ireland Limited | Messages you choose to send us on WhatsApp, as a separate controller | Phone number, messages | EU, USA |
Some providers are based in the United States or may access data from there. These transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, or on the Standard Contractual Clauses approved by the European Commission.
How Long We Keep Your Data
We keep personal data only as long as the purposes in this policy require:
- Enquiries and briefs that do not lead to work. Up to 90 days.
- Clients. For the whole engagement and up to 2 years after it ends, so we can pick the work up again and handle any disputes.
- Invoices and accounting records. For the periods set by Bulgarian accounting and tax law, generally up to 10 years.
- Google Analytics data. For the retention period set in our Google Analytics account, at most 14 months, after which it is deleted automatically.
- Server logs. For short periods, under Cloudflare’s retention policy.
When data is no longer needed, we delete or anonymise it.
Your GDPR Rights
You have the following rights over your personal data. To use any of them, write to [email protected]. We reply within one month. If a request is complex, we may extend this by up to two more months and will tell you why.
Get a copy of the personal data we hold about you and information on how we use it.
Ask us to correct inaccurate or incomplete data.
Ask us to delete your data where we have no legal reason to keep it.
Receive your data in a structured, machine-readable format and pass it to another controller.
Ask us to limit processing, for example while we check an objection or the accuracy of your data.
Object to processing based on legitimate interests, including direct marketing.
Where we rely on consent, you can withdraw it at any time. This does not affect processing before the withdrawal.
Lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) or with the authority where you live or work.
To stop receiving emails from us, use the unsubscribe link in any email or write to [email protected] with the subject “Unsubscribe”.
How We Protect Your Data
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or disclosure. These measures include:
- Encrypted connections (HTTPS) on every page
- Access controls limiting who within our team can view personal data
- Use of trusted, security-maintained third-party platforms for data storage
- Regular review of our data handling practices and security posture
No method of transmission over the internet is completely secure. If a breach creates a risk to your rights, we will notify you and the CPDP as the law requires.
Changes to This Policy
We may update this policy when our services, tools or the law change. When we do, we change the date at the top of this page, and for significant changes we tell our clients by email.
Data Requests and Enquiries
If you have a question about this policy, want to use your rights or are worried about how we handle your data, contact us:
MAGNET MINDS OOD
You can also file a complaint with the Bulgarian supervisory authority:
Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg