# Privacy policy

Last updated October 23, 2026

## Who we are

RetailVerify is a product of ForkPoint Ltd. ("ForkPoint", "we", "us", "our"), a
company registered in Bulgaria with its registered address at 14 Slivnitza Str., Ruse, Ruse 7000, Bulgaria.

For the personal data described in this policy, ForkPoint is the **data
controller** under the EU General Data Protection Regulation (GDPR) and the Bulgarian Personal
Data Protection Act. You can reach us about any privacy matter at  [hello@forkpoint.com](mailto:hello@forkpoint.com).

## Data and purposes

If you email us, we receive your email address, message, and any details you include. We use them to
answer your request. Please do not send sensitive personal data. The hosting provider may process IP
addresses and request logs to deliver and secure the site.

## Forms and payments

1 of 1 general forms have a submission endpoint. Connected forms send the entered fields and form name to the configured service. Abuse-prevention proof is included when enabled. Forms without an endpoint do not send data. This site has no course purchase buttons.
Service acknowledgement does not prove email delivery or subscription creation.
Before activation, the operator must name the actual provider, hosting location, lawful basis,
and retention period in this policy.

## Accessibility reports

The accessibility form uses an email address, affected page URL, and problem description.
Your name, assistive technology, and issue type are optional. Do not include diagnoses,
passwords, or payment details. The accessibility form sends report fields to the configured report service. Service acceptance does not prove email delivery.
Before enabling it, the operator must name the provider, legal ground, and retention period here.
We cannot process a report through this form without an email address and description.

## Legal grounds

Where the GDPR applies, steps you request before a contract may rely on Article 6(1)(b). Optional
marketing and analytics require consent where applicable. Security processing may rely on a documented
legitimate interest under Article 6(1)(f). Legal recordkeeping may rely on Article 6(1)(c). The
operator must confirm each ground for its actual processing before launch.

## Cookies and local preferences

The site stores cookie choices and interface preferences in your browser. Optional Google Analytics,
Microsoft Clarity, and Meta Pixel run only when the operator configures the service and you allow it.
Analytics measures visits; Clarity can record interactions; Meta Pixel measures advertising events.
Use Cookie settings in the footer to change or withdraw permission. The default configuration enables
none of these services.

The `cc_cookie` cookie stores your consent choice for 182 days.
Colour theme, high-contrast, and reduced-motion preferences remain in local storage until you clear them
in your browser. Before enabling external services, the operator must list their actual cookies,
lifetimes, recipients, and purposes. Clearing site data also removes saved preferences.

## Recipients and international transfers

Before launch, identify the hosting and email providers, other recipients, their locations, and any
transfers outside the European Economic Area. Where required, specify an adequacy decision or
appropriate safeguards and how you can obtain a copy. No provider or transfer arrangement is confirmed
by this draft.

## Retention

Keep personal data only as long as needed for the stated purpose or a legal obligation. Before launch,
publish specific periods or clear criteria for messages, server logs, consent records, and any
customer records. These periods remain to be confirmed.

## Your rights

Where the GDPR applies, you may request access, correction, deletion, restriction, or portability
where the relevant conditions apply. You may object to processing based on legitimate interests and to
direct marketing. You may withdraw consent without affecting earlier lawful processing. Contact us
using the details below. You may also complain to a competent data protection authority, including the
Bulgarian Commission for Personal Data Protection at cpdp.bg.

Under the GDPR, the response period for a rights request is generally one month.
The law permits an extension in specific circumstances, with notice to you.
The operator must provide a working address for these requests before launch.

## Updates

We will update this page when our data practices change. The date above identifies this version. This
draft does not confirm any automated decision-making or profiling; review and disclose these
activities before enabling them.

## Contact us

For questions about this policy or how we handle personal data, contact us:

**ForkPoint Ltd.**, 14 Slivnitza Str., Ruse, Ruse 7000, Bulgaria
Email: [hello@forkpoint.com](mailto:hello@forkpoint.com)
Telephone: [+359878466722](tel:+359878466722)