Privacy Policy

Last updated / Effective date: 25 October 2026

1. Introduction

This Privacy Policy explains how Architecton LTD (“RetainMail”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data in connection with our website and the enquiries, bookings, and marketing communications that flow from it.

RetainMail is a boutique email and SMS retention marketing agency based in Bulgaria. We work exclusively within Klaviyo for direct-to-consumer ecommerce brands. Our public presence is a single marketing website with a contact form and a “book a call” booking flow.

This policy covers the personal data we handle as a controller through our website and our own business development activities. It does not govern the personal data we handle on behalf of our clients inside their Klaviyo accounts — that relationship is described in Section 2 and is governed by our client contracts, not by this policy.

For the purposes of the EU General Data Protection Regulation (“GDPR”), the Bulgarian Personal Data Protection Act (“PDPA”), and, where relevant, the UK GDPR, the controller of the data described in this policy is:

  • Entity: Architecton LTD
  • Registration / EIK: 207320866
  • Registered address: 18 Borimechka Str., 7000 Ruse, Bulgaria
  • Contact: bozhidarmarinov04@gmail.com

2. Our two roles: controller and processor

We handle personal data in two distinct capacities, and it matters which one applies.

As a data controller. For the people who visit our website, contact us, book a call, or become leads and prospects, we decide why and how their data is used. This includes names, business email addresses, phone numbers, business details, marketing preferences, and usage data. Everything in this Privacy Policy describes what we do in this controller role.

As a data processor. When we deliver paid services, we work inside a client’s own Klaviyo account and handle that client’s customer data strictly on the client’s documented instructions. In that work, the client is the controller of their customer data and we are the processor. The client — not RetainMail — decides the purposes for which their customers’ data is used. That processing is governed by our Master Services Agreement, the applicable Statement of Work, and a separate Data Processing Addendum (DPA), not by this website policy. If you are a customer of one of our clients and have a question about your data, the brand you purchased from is the right first point of contact, as they control that data.

3. Information we collect

We keep data collection proportionate to running a small B2B agency. In our controller role we collect:

  • Contact and enquiry data you submit through our contact form or booking flow — typically your name, business email address, phone number (where you provide it), company or brand name, and the details of your enquiry.
  • Booking data processed through our booking/calendar tool (Calendly) when you schedule a call — for example the meeting time, your time zone, and any information you add when booking.
  • Marketing preferences — the consent you give (or withdraw) to receive email and/or SMS from us, and your engagement with those messages.
  • Usage and analytics data — information about how you interact with our website, such as pages viewed, referring source, approximate location derived from IP, device and browser type, and similar technical data, collected via analytics and cookies.
  • Cookie and similar-technology data — as described in Section 6.
  • Communications — the content of messages you send us and our correspondence with you.

We do not intentionally collect special categories of data (for example health, political, or biometric data) through our website, and we ask that you do not submit such data through our forms.

4. How and why we use your data — and our lawful basis

We only use personal data where the GDPR gives us a lawful basis to do so. The list below maps each purpose to that basis.

  • Responding to your enquiry or booking request. So we can reply, arrange a call, and evaluate whether we’re a fit to work together. Lawful basis: performance of, or steps taken at your request prior to entering, a contract; and our legitimate interest in responding to business enquiries.
  • Sending marketing email and SMS to you. So we can follow up on your enquiry and share relevant offers and content. Lawful basis: your explicit consent, captured at the point of contact or booking (see Section 5).
  • Operating, securing, and improving our website. Including analytics and preventing misuse. Lawful basis: your consent for non-essential cookies and analytics; and our legitimate interest in maintaining a secure, functional site.
  • Managing our business records and client development. Keeping a record of enquiries and prospects. Lawful basis: our legitimate interest in running and growing the agency.
  • Meeting legal and regulatory obligations. Such as tax, accounting, and responding to lawful requests. Lawful basis: compliance with a legal obligation.
  • Establishing, exercising, or defending legal claims where necessary. Lawful basis: our legitimate interest, and legal obligation where applicable.

Where we rely on legitimate interests, we have considered your rights and would not process your data where those rights override our interests. You can ask us for more detail on that balancing at any time.

5. Email and SMS marketing communications

We send marketing emails and SMS messages to leads who contact us or book a call.

Our lawful basis is your explicit consent, captured at the point of contact or booking. Because people who enquire or book a call are prospective enquiry contacts rather than existing paying customers, we do not rely on the ePrivacy “soft opt-in” for these messages. The soft opt-in is a narrow exception that generally applies only to marketing similar products to a person who has already bought from you, and we do not assume it covers enquiry leads. We therefore treat clear, affirmative consent as the basis for marketing to you.

For SMS specifically, we obtain separate, express consent to send text messages — distinct from any email consent — consistent with US TCPA/CTIA expectations of prior express written consent for marketing texts. Consenting to email does not sign you up for SMS, and vice versa.

A few practical points:

  • Message frequency varies, and message and data rates may apply for SMS depending on your carrier and plan.
  • To stop email: click the unsubscribe link in any marketing email.
  • To stop SMS: reply STOP to opt out at any time. Reply HELP for help. We honour opt-outs promptly.
  • We include accurate sender identification and a valid postal address in our marketing emails, and we do not use deceptive subject lines, consistent with CAN-SPAM.

Withdrawing consent is as easy as giving it, and doing so does not affect the lawfulness of anything we did before you withdrew.

6. Cookies and tracking technologies

Cookie consent is a legal requirement under the ePrivacy Directive as implemented in Bulgarian law, not merely a banner. We ask for your prior consent before setting any non-essential cookies or similar technologies.

We use the following categories:

  • Strictly necessary cookies, required for the website to function. These do not require consent.
  • Functional / preference cookies, which remember choices you make.
  • Analytics / performance cookies, which help us understand how the site is used.
  • Marketing / advertising cookies, where used, to measure and support our marketing.

You can accept, reject, or manage non-essential categories through our consent tool (Cookiebot) and through your browser settings. Withdrawing cookie consent later is straightforward via the same tool. Full details of the specific cookies in use are available in our cookie notice / consent tool.

7. Third parties and sub-processors

We share personal data only with trusted service providers who help us run our website and communications, and only as needed. Our current providers include:

  • Klaviyo — email and SMS delivery
  • Cloudflare — website hosting and infrastructure
  • Google Analytics — website analytics
  • Calendly — call booking and scheduling
  • Cookiebot — cookie consent management

Each provider is engaged under terms that require them to protect personal data and to process it only on our instructions. We may also disclose data where required by law, to enforce our terms, or in connection with a business transfer. We do not sell your personal data.

8. International data transfers

Some of our providers — including Klaviyo, Google Analytics, Calendly, and Cloudflare, and their respective sub-processors — are based in or transfer data to the United States and other countries outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we rely on appropriate safeguards, which may include:

  • EU Standard Contractual Clauses (SCCs) approved by the European Commission;
  • an adequacy decision where the destination country (or a certified recipient under a relevant framework) has been recognised as providing adequate protection; and
  • for transfers of UK individuals’ data, the UK International Data Transfer Addendum to the EU SCCs.

You can request more information about the safeguards applied to a specific transfer using the contact details in Section 16.

9. Data retention

We keep personal data only for as long as we have a reason to, then delete or anonymise it. Our retention is tied to a stated basis rather than left open-ended:

  • Enquiry and booking data — kept while we are in active discussion and for a reasonable period afterward to follow up, then reviewed and deleted where there is no ongoing relationship. Basis: our legitimate interest in business development and the possibility of re-engagement.
  • Marketing consent and preference records — kept for as long as you remain subscribed and for a period after you unsubscribe, so we can evidence consent and honour your opt-out. Basis: legal accountability and compliance.
  • Data required for legal, tax, or accounting purposes — kept for the period required by applicable law. Basis: legal obligation.
  • Analytics data — retained for the period configured in our analytics tool.

Where data is no longer needed for any of these purposes, we securely delete or anonymise it.

10. Data security

We take the security of personal data seriously and maintain organisational and technical measures appropriate to our size and the data we handle — including access controls, use of reputable providers, and limiting who can access personal data. That said, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. We commit to acting responsibly and to responding promptly if an issue arises.

11. Your rights

Subject to the conditions in applicable law, you have the following rights over your personal data:

  • Access — to know what data we hold about you and obtain a copy.
  • Rectification — to have inaccurate or incomplete data corrected.
  • Erasure — to have your data deleted in certain circumstances.
  • Restriction — to limit how we use your data in certain circumstances.
  • Portability — to receive certain data in a portable format.
  • Objection — to object to processing based on legitimate interests, and to object to direct marketing at any time.
  • Withdraw consent — where we rely on consent, you can withdraw it at any time.
  • Not to be subject to solely automated decisions with legal or similarly significant effects (see Section 12).

To exercise any of these, contact us using Section 16. We will respond within the timeframes required by law and will not charge a fee except where permitted.

Complaints. If you believe we have mishandled your data, we’d like the chance to put it right — but you also have the right to complain to a supervisory authority. In Bulgaria this is the Commission for Personal Data Protection (CPDP). You may also complain to the supervisory authority in your own EU country of residence. If you are in the UK, you may complain to the Information Commissioner’s Office (ICO).

For California residents (CCPA/CPRA). If you are a California resident, you have additional rights: to know the categories and specific pieces of personal information we collect, use, and disclose; to delete your personal information; to correct inaccurate information; and to be free from discrimination for exercising your rights. The categories we collect are described in Section 3. We do not sell your personal information, and we do not share it for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA. Because we do not sell or share in that sense, no “Do Not Sell or Share My Personal Information” action is required — but if you would like written confirmation of our position or wish to exercise any California right, contact us using Section 16.

12. Automated decision-making and profiling

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Any profiling we carry out is limited to basic marketing analytics (for example, segmenting our own leads by engagement) and does not have such effects. If this ever changes, we will update this policy and provide the information required by law.

13. Data breach handling

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority (the CPDP, and the ICO where UK data is affected) without undue delay and, where required, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to affected individuals, we will also inform those individuals without undue delay. We maintain internal procedures to detect, assess, and respond to breaches.

14. Children’s privacy

Our website and services are directed to businesses, not to children, and we do not knowingly collect data from minors. We do not knowingly process the personal data of anyone under 16. If you believe a minor has provided us with personal data, please contact us and we will delete it.

15. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date and version above and, where changes are significant, take reasonable steps to bring them to your attention. Your continued use of our website after an update means you accept the revised policy.

16. How to contact us / make a data request

For any privacy question or to exercise your rights: