Privacy Policy
Last updated: 28 September 2026
This policy explains how Ventus collects and uses personal data when you visit this website or contact us, and what rights you have under the EU General Data Protection Regulation (GDPR) and the applicable Bulgarian and Spanish data protection laws.
Who is responsible
This website is operated jointly by Ventus Bulgaria EOOD, 33 Konstantin Preslavski Street, 9006 Varna, Bulgaria (UIC 200165790), and Ventus Iberia SL, Rambla de Catalunya 92, 2ª planta, 08008 Barcelona, Spain (CIF B67171553), together “Ventus”, “we” or “us”. Both companies act as joint controllers for the personal data processed through this website. The Ventus company you correspond with is responsible for any further processing of your enquiry.
You can contact us about data protection at any time at office@ventus.bg or office@ventusiberia.com.
What data we collect
- Visiting the website: when you open a page, our hosting provider automatically records technical data such as your IP address, the date and time of access, the page requested, the referring page and your browser type. Our security plugin also checks requests (including your IP address) to block attacks. This is needed to deliver the website securely.
- Contact form: your name, company, email address, phone number (optional), country, subject and message.
- Project submission form: your name, company, email address and country, and details of your project (location, capacity, number of turbines, development stage, description). Documents such as project teasers are sent to us by email.
- Email and phone: the data you give us when you contact us directly.
- Cookie choice: whether you accepted all cookies or only necessary ones (see our Cookie Policy).
Form submissions are stored in our website database without your IP address. We do not use analytics, advertising or social media tracking on this website, and we do not make automated decisions or create profiles about visitors.
Why we use it and on what legal basis
- To answer your enquiry and assess projects you submit, including steps before a possible contract – Art. 6(1)(b) GDPR, and our legitimate interest in responding to business enquiries – Art. 6(1)(f) GDPR.
- To operate and secure the website, prevent abuse and spam – our legitimate interest, Art. 6(1)(f) GDPR.
- To show embedded maps from OpenStreetMap on our Contact page – your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time via Cookie settings.
- To comply with legal obligations, for example retention duties under commercial and tax law – Art. 6(1)(c) GDPR.
Who receives your data
Your data is only accessible to the Ventus employees who need it to handle your request. Depending on your country and subject, an enquiry may be passed between Ventus Bulgaria EOOD and Ventus Iberia SL so that the right team can answer it.
We use carefully selected service providers who process data on our behalf under a data processing agreement, in particular our website hosting provider WP Engine, our email service providers, and Wordfence (Defiant Inc.), the security service that protects this website and may check IP addresses against its threat database. Where needed, data may also be shared with our professional advisers (for example lawyers or auditors), who are bound by confidentiality. When you load a map on our Contact page, your IP address is sent to the OpenStreetMap Foundation. We do not sell your personal data.
Transfers outside the EU
Some of our service providers, including our hosting provider and our website security service, are based or part of groups based outside the European Economic Area, notably in the United States. Where personal data is transferred outside the EEA, we ensure an adequate level of protection, for example through the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.
How long we keep it
We keep messages and project submissions only as long as we need them to handle your request. We review stored form submissions regularly and delete those that are no longer needed, normally within 24 months of receipt, unless they have led to a business relationship or we are required by law to keep them longer. Correspondence that becomes part of a business relationship is kept for as long as needed for that relationship and the applicable statutory retention periods. Technical access and security logs are kept by our hosting provider and security service for a limited period. Your cookie choice is stored in your browser for 180 days.
Your rights
You have the right to access your personal data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interests. Where processing is based on your consent, you can withdraw it at any time with effect for the future.
To exercise your rights, write to office@ventus.bg or office@ventusiberia.com. You also have the right to lodge a complaint with a supervisory authority, in particular the Commission for Personal Data Protection in Bulgaria (www.cpdp.bg) or the Spanish Data Protection Agency (www.aepd.es), or the authority in your country of residence.
Security
This website is served over an encrypted connection (HTTPS). We use technical and organisational measures appropriate to the risk to protect your data against loss, misuse and unauthorised access. Form submissions are only accessible to authorised Ventus staff.
Changes to this policy
We may update this policy when our website or the law changes. The current version is always available on this page.