Information for approving Dyasol as a supplier

Company and accountability

• Dyasol Ltd (Диасол ЕООД), UIC 207785566, is registered in Sofia, Bulgaria.
• Every engagement has a named lead. The proposal identifies the participating specialist roles before work starts.
• A senior specialist reviews and approves every deliverable before it leaves Dyasol.

People, access and subcontractors

• The responsible senior specialist determines and authorises access on a need-to-know basis for the task. The record identifies person, role, system, permissions and duration; a deputy or specialist has no automatic access to all customers.
• Confidentiality, conflicts, permitted access and information handling are recorded in the contract; a data-processing agreement is used when Dyasol processes personal data on the client’s behalf.
• Any specialist or subcontractor who needs access to client information is identified and agreed through the engagement process before that access is granted.

Delivery and independence

• The proposal states scope, deliverables, assumptions, timeline, price, client inputs and acceptance.
• Certification, statutory audit and legal opinions remain with the appropriately qualified independent bodies. Dyasol does not certify its own work.
• For an external expert role, the service window, escalation channel and substitute arrangements are written into the agreement.

For public contracting authorities

• The privacy notice describes website enquiries. We have secure file-exchange channels and adapt to each client’s specific needs, capabilities and preferences. The specific channel, access and retention period are agreed before any sensitive material is exchanged; where needed, we work in the client’s own repository.
• Deliverables are reviewed within ten working days, with one consolidated round of corrections within the agreed scope.
• Each engagement has a named lead and a named deputy for contact and coordination; technical and legal judgements stay with the responsible specialists.
• Work is remote-first. On-site visits — for interviews, workshops or training — are stated in the offer with their number and location.
• The offer lists what we need from your side: named responsible staff, access to the relevant systems and documents, and the cooperation of your IT contractor where you have one.
• Sensitive information is handled on a need-to-know basis through the channel agreed for the engagement. Where an engagement involves classified information, access conditions are agreed in advance under the Classified Information Protection Act.

Security and data handling

• The public privacy notice explains the website enquiry flow and providers. Project information is exchanged through an agreed channel appropriate to the task.
• Use the contact form for enquiries and security reports about Dyasol.
• Data location, retention and deletion requirements for an engagement are agreed before sensitive client information is exchanged.

Contracts, insurance and liability

• If your process requires insurance cover, its terms are agreed during contracting.
• Bulgarian and English specimens of the agreement, mutual NDA, DPA and audit schedule are prepared. They are available during procurement and completed before signature; a specimen is not an executed agreement.
• Our starting contractual position is Bulgarian law, the competent Bulgarian state court and Bulgarian as the governing bilingual text. For ordinary negligence we propose a cap of twice the engagement fee; retainers have a separate formula in the specimen. Intentional misconduct, gross negligence and non-limitable statutory rights are excluded from the cap.

Reviews, independence and incidents

• The audit schedule permits relevant Customer, appointed-auditor and competent-authority reviews. Planned notice is normally ten working days; necessary urgent reviews and statutory rights are not restricted by that period, an annual cap, extra fees or an authority signing an NDA.
• Relevant relationships and possible conflicts are recorded before participation and reassessed when circumstances change. A specimen form does not prove a particular participant’s independence.
• We propose contractual notification without undue delay and within 24 elapsed hours after awareness of a Dyasol incident affecting Customer data or materially affecting the agreed service. The first report may be incomplete. This is distinct from advisory response times and does not promise 24/7 detection.
• Answers about our own security identify the actual verified scope, evidence and unknowns. A plan or laboratory test is not presented as operating production protection.

What we provide during due diligence

• Company and contact details
• Written scope and commercial terms
• Relevant specialist roles and access needs
• Confidentiality, data-processing and subcontractor terms where applicable
• Answers to a proportionate supplier-security questionnaire

For your own supplier review process, see how questionnaire answers connect to verifiable evidence.