Data controller
Bulsmetka, 14 Tsar Osvoboditel Blvd., 4th floor, 1000 Sofia, office@bulsmetka.bg. Questions about personal data: office@bulsmetka.bg.
What data we process and on what legal basis
Requests sent through the site's forms (contact form, quote form, the guided "Get started" form): name, email, phone and the text of your message. In the guided form, also your answers: where you are based, what service you need, legal form, business activity, VAT registration, number of employees and documents, when you want to start, and, if you are outside Bulgaria, whether you are an EU citizen, whether you have a Bulgarian EIK/BULSTAT number and whether you need a registered address and help with a bank account. In the quote form, also your answers: what service you need, legal form, business activity, the estimated price based on the number of documents, employees and VAT registration, a convenient time for a call and a note. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
You are under no legal or contractual obligation to give us your name, email and phone, but without the contact details the form asks for we cannot reply to your request.
Document template requests from the template pages: name, email, phone (optional) and which template you want, so that we can send it to you and answer your questions about it. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
The server that receives the forms also stores the IP address the request was sent from, to limit spam and abuse. The IP address is kept together with the request. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Checklist download: your email address and the name of the material, so that we know who requested it (legitimate interest, Art. 6(1)(f) GDPR). We send you commercial offers only if you have ticked the consent box (Art. 6(1)(a) GDPR). Consent is voluntary, the checklist downloads without it, and you can withdraw it at any time by emailing office@bulsmetka.bg.
Request source data: with every form the site sends the page you are writing from, the page where your visit started, the referring address (referrer), the UTM parameters and ad click identifiers if they are in the URL, and the site language. We store them in our CRM together with your request, so that we know which pages and channels bring in requests. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). How they are kept in your browser is described in the Cookie Policy.
Phone, WhatsApp and Viber conversations: number, name and the content of the conversation, so that we can reply (Art. 6(1)(b) GDPR).
Data required for company registration and accounting services (personal ID number, ID card, banking details, employee data): on the basis of contract and legal obligation (the Accountancy Act, the Tax and Social Insurance Procedure Code, the Social Insurance Code).
Checks under the Bulgarian Measures Against Money Laundering Act (ZMIP): before we start working with a new client, we must identify the client and the beneficial owner of their company and keep copies of the documents and the information collected. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
Technical data collected when you visit the site (IP address, browser, pages opened): processed by our hosting provider and by Cloudflare to deliver the site and protect it from abuse, and used by Ahrefs Web Analytics to produce aggregated, cookieless statistics. Technical server logs are kept for a short period for security and are rotated automatically. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Request priority
The guided form uses your answers (for example when you want to start and what service you need) to calculate an internal priority score that helps us decide whom to contact first. The score does not lead to an automated decision that has legal effects for you or similarly significantly affects you (Art. 22 GDPR). Every request is answered by a person.
Purposes and retention periods
We do not set one fixed period for requests. We keep data for as long as the purpose requires, using the criteria below.
Form requests, template requests and email addresses left for a checklist: for as long as we need them to reply, prepare a quote and follow up on it, and until you ask us to delete them or object to the processing. The request source data and the IP address are kept together with the request.
Client data needed to perform the contract and meet legal obligations: for the periods in Art. 12(1) of the Accountancy Act (for example payroll records for 50 years, accounting registers and financial statements for 10 years). Documents and information collected under ZMIP: 5 years from the start of the calendar year after the relationship with the client ends (Art. 67 ZMIP).
Marketing messages: only with consent and until it is withdrawn.
Recipients
The National Revenue Agency (NRA), the National Social Security Institute (NOI), the Registry Agency, notaries, banks — as required by law and for the performance of the contract. The Financial Intelligence Directorate of the State Agency for National Security (DANS) — only where ZMIP requires us to provide information.
Providers that process data on our behalf under a data processing agreement (Art. 28 GDPR): DigitalOcean (hosting of the site and of the server that receives the forms; data centre in Frankfurt, Germany), Cloudflare (content delivery network and site protection that every visit passes through), NetHunt CRM (management of requests), Slack (internal notifications to our team about new requests), Forward Email (forwarding of emails sent to office@bulsmetka.bg), Google (the mailbox that receives the emails forwarded from office@bulsmetka.bg), Ahrefs (cookieless visit statistics).
If you choose to write to us on WhatsApp or Viber, the operators of those services process your data as separate controllers, under their own terms and privacy policies.
We do not sell or transfer data for marketing purposes to third parties.
Transfers outside the EEA
DigitalOcean, Cloudflare, Slack, Forward Email and Google are companies established in the United States (DigitalOcean stores the site's data in Frankfurt, Germany), Ahrefs is established in Singapore, and other providers may also process data outside the European Economic Area. In those cases the transfer relies on a European Commission adequacy decision (for the United States, the EU-U.S. Data Privacy Framework where the recipient is certified under it) or on standard contractual clauses approved by the Commission (Art. 45 and Art. 46(2)(c) GDPR). You can ask for information about the safeguard that applies, and for a copy of it, at office@bulsmetka.bg.
Your rights
Access, rectification, erasure, restriction, portability, objection and withdrawal of consent — submit a request to office@bulsmetka.bg. We respond without undue delay and in any event within one month; for complex requests this can be extended by two further months, in which case we tell you about the extension and the reasons for it within the first month. Complaints: Commission for Personal Data Protection, Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., cpdp.bg.
Right to object (Art. 21 GDPR): where we process your data on the basis of legitimate interest, you can object to that processing at any time on grounds relating to your particular situation. We then stop, unless we can show compelling legitimate grounds that override your interests, or the data are needed to establish, exercise or defend legal claims. You can object to processing for direct marketing at any time, without giving a reason, and we will stop sending you commercial messages. Send your objection to office@bulsmetka.bg.
Security
Encrypted connection (TLS), two-factor authentication for access to accounting systems, EU-based electronic archive with daily backups. Access to clients' accounting data is restricted to the responsible accountant; requests sent through the site are seen only by the team members who answer them.