Privacy policy
This page explains what personal data „БЪЛГАРИАН ЕКСПЕРТ“ ЕООД processes when you use this website and our services: what we receive, why and on what legal basis, who we share it with, how long we keep it, and what rights the EU General Data Protection Regulation (GDPR) gives you.
Who processes your data
The controller is „БЪЛГАРИАН ЕКСПЕРТ“ ЕООД (BULGARIAN EXPERT EOOD), UIC (ЕИК) 204290396, registered in the Commercial Register and Register of Non-Profit Legal Entities of the Registry Agency of Bulgaria. Registered office and management address: 10 Apostol Karamitev St, floor 5, office 13, Burgas 8000, Bulgaria. On this website and with clients the company trades as Bulgarian Expert.
- Offices: Burgas, 10 Apostol Karamitev St, floor 5, office 13; Plovdiv, 1 Han Kubrat St, floor 4, office 408.
- Personal-data requests: info@bulgarianexpert.com.
- Phone: 0700 70 355 — calls within Bulgaria; +359 89 876 6005 — from abroad, WhatsApp, Viber.
- Full company details are on the Company information page.
We have not appointed a data protection officer: the law does not require one of a company of our size and activity. Send any question about your data to the address above.
What data we receive
When you write to us through the form on the site
Your name and phone number are required; your e‑mail, your question and the area it concerns (immigration, business registration, accounting and tax, real estate, other) are optional. With your enquiry the site stores the address of the page you sent it from, the site language and any tracking tags (UTM) that were in the link.
When you order an online consultation
- The questionnaire: name, e‑mail, phone, meeting language, area, a description of your situation, your questions and your answers to the follow-up questions for that area (for example citizenship and current residence status). The questionnaire is saved with us after step 2 — before payment.
- Where the request came from: the address of the page it was sent from and any tracking tags (UTM) that were in the link.
- Documents, if you choose to attach any: PDF, JPG, PNG, DOC or DOCX files of up to 10 MB each, no more than 10 files. With each file we store its name, size and checksum. Documents may contain identity-document data and other information about you.
- Payment: amount, currency, status and Stripe payment identifiers. You enter your card details and the cardholder's name on Stripe's page; they never reach us.
- Booking: the time you choose, your time zone and the link to the online meeting.
- Confirmations before payment: that you acknowledged that the consultation is for information and is based on the details you provided; that you accepted the consultation terms and asked for the service to begin before the withdrawal period ends; the date and time; the page language; the amount to be paid; the address of the page the request was sent from; the version numbers of the terms and of this policy; your IP address and browser details (user agent).
When you write to us or call us directly
If you e‑mail us, write to us on WhatsApp, Viber or Telegram, or call us, we receive your number or address, your profile name and whatever you tell us.
Technical data
- Web-server logs: IP address, date and time of the request, the address of the page requested including its parameters, the address of the page you came from, and browser details.
Data about other people
In the questionnaire or in correspondence you may tell us about family members and other people — a spouse and children in a residence-permit case, for instance. We receive that data from you, not from them, use it only for your matter and keep it for as long as your request. Please let them know and give them a link to this policy.
Special categories of data
Please do not send information about health, religion, ethnic origin or other especially sensitive data unless it is needed. If it reaches us and your matter does not need it, we delete it. If it is needed (for example for a residence permit on the grounds of long-term medical treatment), we use it only with your explicit consent (GDPR art. 9(2)(a)).
Why, on what basis and for how long
The legal bases are articles of the GDPR: art. 6(1)(a) — your consent; art. 6(1)(b) — a contract with you, or steps you asked for before one; art. 6(1)(c) — a legal obligation; art. 6(1)(f) — our legitimate interest, which is described in the same row.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Replying to your enquiry — from the form, by phone, by e‑mail or by messenger | Name, phone, e‑mail, question, area, page, site language, UTM tags | Art. 6(1)(b) — steps you asked for before a contract; for a general question, art. 6(1)(f): our interest in answering whoever contacts us | 12 months after the last contact if no contract follows [period to be confirmed] |
| Preparing and holding the consultation | Questionnaire, the page the request was sent from and UTM tags, attached documents, booking details | Art. 6(1)(b) — contract; the page address and UTM tags — art. 6(1)(f): our interest in knowing where our clients come from | Questionnaire, page address and UTM tags — as the payment records (below); document files — 90 days after the consultation is held or cancelled [period to be confirmed] |
| Contacting you if a consultation request was not paid for | Questionnaire, page address and UTM tags, attached documents | Art. 6(1)(f): our interest in helping someone who started a request and did not finish it. You may object | Questionnaire, page address and UTM tags — 12 months [period to be confirmed]; document files — 30 days [period to be confirmed] |
| Taking payment, issuing the documents for it, keeping accounting and tax records | Name, e‑mail, amount, payment date and identifiers, request number | Art. 6(1)(b) and (c) — Accountancy Act, VAT Act (Bulgaria) | 10 years for registers and financial statements, 3 years for other accounting documents (Accountancy Act, art. 12) [period to be confirmed] |
| Proving that you received the contract information, accepted the terms and asked for the service to begin | The boxes ticked before payment (including the acknowledgement that the consultation is for information), date and time, page language, amount, the page the request was sent from, document versions, IP address, browser details | Art. 6(1)(c) — Consumer Protection Act (Bulgaria); art. 6(1)(f): our interest in having evidence in a dispute | 5 years after the consultation — the general limitation period (Obligations and Contracts Act, art. 110) [period to be confirmed] |
| Identifying a client where the Measures Against Money Laundering Act requires it (accounting services, company formation, property transactions) | Identity-document data and other information the law requires | Art. 6(1)(c) — Measures Against Money Laundering Act | 5 years after the business relationship ends (art. 67 of that Act) [period to be confirmed] |
| Telling staff about a new request | The content of the request (see «Who we share data with») | Art. 6(1)(b) and (f): our interest in replying quickly | 12 months in the staff chat and the mailbox [period to be confirmed] |
| Protecting the site and clients' data: server logs, rate limiting, protecting the sign-in to the staff area | IP address, browser details, page address, time; for staff sign-in attempts, the e‑mail entered | Art. 6(1)(f): our interest in protecting the site and clients' data from attacks and abuse | Server logs — up to 90 days [period to be confirmed]; sign-in attempts — 24 hours [period to be confirmed] |
| Restoring data after a failure | The contents of the database and the attached documents | Art. 6(1)(f) and GDPR art. 32: our interest in not losing clients' data | Backups — 14 days |
| Visit statistics — only if enabled and only after your consent | Google Analytics cookie identifier, pages viewed, device, approximate location | Art. 6(1)(a) — consent, which you can withdraw at any time | See the Cookie policy |
Visit statistics are not switched on on this site at present. If we switch them on, nothing will load until you consent in the cookie window.
We do not use your data for advertising, we do not sell it, and we do not pass it to anyone for advertising.
Who we share data with
Only those the site and our services cannot work without, and only as much as each of them needs. The documents you attach are kept on our server and are not passed to any of the services listed here.
| Recipient | Why | What data | Where, and on what basis |
|---|---|---|---|
| Contabo GmbH (Germany) — processor | Hosting: the site's server, the database, documents, backups | Everything stored on the site | Contabo data centre [location to be confirmed] |
| Stripe Payments Europe, Ltd. (Ireland) — processor; for fraud prevention and financial-regulatory duties, an independent controller | Taking payment | E‑mail, request number, consultation area, amount; card details and cardholder name — what you enter on Stripe's page | EU; transfer to the US (Stripe, LLC) — EU‑US Data Privacy Framework and standard contractual clauses |
| Calendly LLC (USA) — processor | Booking the consultation time | Name, e‑mail, request number and area — in the calendar link; the time you choose; IP address and browser details when you open the calendar | USA — EU‑US Data Privacy Framework and standard contractual clauses |
| Resend (USA) — processor | Sending e‑mail: confirmations to you and notifications to staff | The recipient's address and the content of the message; staff notifications repeat the content of the request — for an enquiry from the form, with the area, the site language, the page and UTM tags | USA — EU‑US Data Privacy Framework and standard contractual clauses |
| Google Ireland Limited, Google LLC — e‑mail service | The office mailbox bulgarianexpert@gmail.com: your e‑mails and request notifications | The content of the e‑mails | EU and USA — EU‑US Data Privacy Framework |
| Telegram | Staff chat: notifications about new requests | For an enquiry from the form — name, phone, e‑mail, the text of the enquiry, the area, the site language, the page it was sent from and UTM tags; for a consultation — name, phone, e‑mail, meeting language, area, the description of the situation, questions, questionnaire answers, file names (not the files), payment status and amount, the payment identifier and the meeting time | Outside the EEA [transfer basis to be confirmed] |
| Video-meeting service [to be confirmed] | Holding the online meeting | Name, e‑mail, voice and image during the meeting | [to be confirmed] |
| Google Ireland Limited, Google LLC — Google Analytics, only if statistics are enabled and you consent | Visit statistics | See the Cookie policy | EU and USA — EU‑US Data Privacy Framework |
| Public authorities, courts, notaries | Where the law requires it, or where you have asked us to file documents on your behalf | Only what is required | Bulgaria and the EU |
WhatsApp, Viber and Telegram, when you choose to write to us there, process the conversation under their own terms as independent controllers. [Cloudflare, Inc. (USA) — if the site runs through Cloudflare at launch; to be confirmed.]
Transfers outside the EEA
Some recipients are in the United States or transfer data there: Stripe, Calendly, Resend and Google. These transfers rely on the European Commission's adequacy decision for the EU‑US Data Privacy Framework (Decision (EU) 2023/1795), for companies certified under it, and on standard contractual clauses (Decision (EU) 2021/914). Telegram is outside the EEA and does not participate in the Data Privacy Framework [transfer basis to be confirmed].
You can ask for a copy of the safeguards used at info@bulgarianexpert.com.
Your rights
Under the GDPR you can:
- find out whether we process your data and get a copy of it — art. 15;
- have inaccurate or incomplete data corrected — art. 16;
- have your data erased — art. 17; data we must keep by law (accounting records, for example) is erased when the statutory period ends;
- restrict processing — art. 18;
- receive the data you gave us in a machine-readable format, or have it sent to another controller — art. 20;
- withdraw consent where processing is based on it, at any time; withdrawal does not affect the lawfulness of what was done before it (art. 7(3)).
Right to object (GDPR art. 21). You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (art. 6(1)(f)). We will then stop, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims. To object, write to info@bulgarianexpert.com.
How to contact us: write to info@bulgarianexpert.com or call. We reply within one month; for complex or numerous requests this may be extended by two further months, in which case we tell you within the first month. So that we do not hand your data to someone else, we may ask you to confirm your identity.
You have the right to complain to the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни, КЗЛД): 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, kzld@cpdp.bg, www.cpdp.bg — or to the supervisory authority of the EU country where you live or work.
Do you have to give us your data?
- The form on the site cannot be sent without a name and phone number: without them we cannot reply.
- A consultation needs your name, e‑mail and phone: the payment confirmation and the booking link go to your e‑mail, and we call if something goes wrong. Without them the consultation cannot take place.
- Attaching documents is optional.
- Where the Measures Against Money Laundering Act applies to a service, identification data is required by law; without it we cannot provide the service.
We make no automated decisions, including profiling, that produce legal effects for you: every enquiry is read by a person.
How we protect data
The site works only over an encrypted connection (HTTPS). Attached documents are stored outside the public part of the site: they have no address from which they can be opened on the internet. Only staff who need requests for their work can see them, after signing in to the staff area; password-guessing attempts are blocked. Backups are kept for 14 days.
Cookies and similar technologies
The site stores on your device only what it cannot work without: a note that you closed the cookie notice and, if statistics are enabled, your answer in the consent window (in localStorage), the consultation questionnaire draft while the tab is open (in sessionStorage), and a technical cookie for the duration of payment. Visit statistics only if they are enabled and only with your consent. The full list is in the Cookie policy.
Children
The site and our services are meant for adults. Children's data — in a family residence-permit case, for example — reaches us from parents or legal guardians and is used only for their matter.
Changes to this policy
We update this policy when the way we process data changes. The current version is always published on this page, with its number at the bottom; when you order a consultation, the version number is stored with your request. The terms of the consultation itself are in the Online consultation terms.
Version: 2026-10.