Privacy Policy
AT A GLANCE
Key facts about how we handle your personal data
The table below summarises the most important points. Please read the full policy for complete details.
Bulgaria For Business — a professional services firm based in Sofia, Bulgaria. We are the data controller for your personal data.
Contact details, correspondence, service-related information, and — where legally required — identity and source of funds documents. Details in Section 4.
To provide our services, comply with legal obligations (including AML law), and — with your consent or on our legitimate interests — to keep you informed of relevant developments.
Service providers who help us operate (hosting, email, CRM). Public authorities where required by law. We do not sell your data.
Generally 7 years for client service records; 5 years for AML records. Shorter periods for website enquiries and marketing. Details in Section 8.
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Contact info@bulgaria-for-business.com. Details in Section 10.
1. Who we are
Bulgaria For Business is a professional services firm based in Sofia, Bulgaria, providing company formation, legal, accounting, licensing, real estate, recruitment, HR administration, and business acquisition services to international businesses and individuals expanding into Bulgaria.
We are the data controller for personal data collected in connection with our website and our professional services — meaning we determine the purposes and means by which your personal data is processed.
| Organisation | Bulgaria For Business |
| Website | www.bulgaria-for-business.com |
| Data protection email | info@bulgaria-for-business.com |
| Registered address | 1 Atanas Dukov Str., floor 6., Lozenetz District, Sofia, Bulgaria, 1407 |
| Supervisory authority | Commission for Personal Data Protection (КЗЛД) — www.cpdp.bg |
2. What this policy covers
This Privacy Policy applies to personal data that we collect and process:
- • when you visit and interact with our website at www.bulgaria-for-business.com;
- • when you contact us with an enquiry about our services;
- • when you engage us to provide professional services;
- • when you subscribe to our newsletter or marketing communications;
- • when we process personal data in connection with the delivery of our services — including payroll processing for employer clients, real estate transaction support, and business acquisition advisory.
This policy does not cover personal data processed in connection with our own employment of staff, which is addressed in separate internal HR policies.
3. The personal data we collect
We collect only the personal data that is necessary for the purpose for which it is collected. The table below sets out the categories of personal data we collect, what is included in each category, why we collect it, and the legal basis under the GDPR.
| Type of data | What it includes | Why we collect it | Legal basis (GDPR) |
|---|---|---|---|
| Contact and identity information | Your name, job title, company name, email address, telephone number, and postal address — provided when you contact us, submit an enquiry, or engage our services. | To communicate with you and deliver services | Contract performance; legitimate interests |
| Service correspondence | Emails, letters, notes of telephone calls, and other correspondence relating to the services we provide — forming the client file for your matter. | To provide professional services and maintain records | Contract performance; legal obligation |
| Identity and verification documents | Passport or national ID, proof of address, and beneficial ownership information — collected for anti-money laundering (AML) compliance before or during onboarding. | Legal compliance — AML/KYC obligations | Legal obligation (ЗМИП) |
| Financial information | Invoicing and payment information, bank details for payments to you, and — where relevant to service delivery — financial statements or transaction data relating to a matter. | Billing, payment processing, and service delivery | Contract performance; legal obligation |
| Employment and payroll data (payroll clients only) | Employee personal data including name, ЕГН (personal ID), address, salary, social security records, and leave data — received from employer clients for payroll processing. | Payroll processing and NRA/NOI compliance on behalf of employer clients | Contract performance; legal obligation |
| Website usage data | IP address, browser type, pages visited, time spent, and referral source — collected automatically when you visit our website via cookies and similar technologies. | Website operation, analytics, and security | Consent (non-essential cookies); legitimate interests (security) |
| Marketing preferences | Your email address and communication preferences — where you have subscribed to our newsletter or marketing updates. | Sending relevant professional updates and news | Consent (non-clients); legitimate interests (existing clients) |
We do not collect or process special categories of personal data (such as health data, racial or ethnic origin, or political opinions) in the ordinary course of our business. The only exception is where this is strictly necessary for a specific service — for example, health data relating to sick leave when processing payroll for an employer client, or criminal record data required for regulatory fit-and-proper assessments. In such cases, processing is carried out under explicit consent or legal obligation.
4. How we collect personal data
Directly from you
Most personal data we process is provided directly by you — through enquiry forms on our website, email correspondence, telephone conversations, and the documents and information you provide in connection with our services.
Automatically when you use our website
When you visit our website, we automatically collect certain technical information through cookies and similar technologies — including your IP address, browser type, the pages you visit, and how long you spend on each page. This data helps us understand how our website is used and improve it. You can control what data is collected through our cookie consent tool. For full details, see our Cookie Policy at www.bulgaria-for-business.com/cookie-policy.
From public sources
In the course of providing legal and advisory services, we may collect information about clients or counterparties from publicly available sources — such as the Bulgarian Commercial Register, the Property Registry, or equivalent registers in other jurisdictions. This is limited to what is necessary for service delivery.
From other professionals
Where you are referred to us by another professional firm (such as a lawyer, accountant, or business broker), they may share basic contact and context information with us as part of the referral. We will always confirm with you directly how we handle your data.
5. Why we use your personal data
To deliver our professional services
The primary purpose for which we process personal data is the delivery of our professional services — company formation, legal advice, accounting and tax compliance, licensing, real estate support, recruitment, HR administration, payroll, and business acquisition advisory. Without your personal data, we cannot provide these services.
To comply with legal obligations
We are required by Bulgarian and EU law to process certain personal data. The most significant legal obligation is our anti-money laundering (AML) duty — we must verify the identity of clients and beneficial owners before establishing a business relationship. We also have obligations to retain records for tax and accounting purposes and to report to public authorities in defined circumstances. These obligations cannot be waived.
To communicate with you
We use your contact details to respond to enquiries, provide updates on your matters, deliver service outputs, and send invoices. For existing clients, we may also send information about regulatory changes, new services, or developments that are directly relevant to your situation — on the basis of our legitimate interests in maintaining a useful professional relationship.
For marketing (with your consent or legitimate interests)
We may send marketing communications to existing clients on the basis of our legitimate interests — you would reasonably expect to hear from us about relevant professional developments. For non-clients, we only send marketing communications where you have subscribed and given explicit consent. You can unsubscribe from any marketing email at any time using the link in the email or by contacting us.
To improve our website and services
Where you have consented to analytics cookies, we use aggregated, anonymised data about website usage to understand how visitors interact with our site and to improve its content and structure. This does not involve profiling individual users.
6. Who we share your personal data with
Service providers who help us operate
We share personal data with a small number of trusted third-party service providers who process data on our behalf — including our website host, email service provider, CRM system, cloud storage provider, and accounting software. All these providers are contractually bound to process data only as instructed by us and to maintain appropriate security standards.
Public authorities — when legally required
We share personal data with Bulgarian public authorities when required by law — including the National Revenue Agency (NRA) for tax filings, the National Social Security Institute (NOI) for payroll clients, and the Financial Intelligence Directorate for AML reporting. We share only what is strictly required.
Professional advisors engaged in your matter
Where we engage other professionals — such as notaries, specialist counsel, surveyors, or translators — in connection with your matter, we share the minimum personal data necessary for them to perform their role. All such advisors are subject to professional confidentiality obligations.
We do not sell your data — Bulgaria For Business does not sell, rent, or otherwise transfer your personal data to third parties for their own commercial purposes. Any data shared with service providers is shared solely to enable the delivery of our services to you — under strict contractual controls.
7. International data transfers
Our primary operations are based in Bulgaria — an EU member state — and most of your personal data is processed within the European Economic Area (EEA). Where any of our service providers process data outside the EEA (for example, cloud infrastructure providers), we ensure that appropriate safeguards are in place — such as Standard Contractual Clauses approved by the European Commission or equivalent transfer mechanisms under the GDPR.
If you would like information about the specific safeguards applied to any international transfer of your data, please contact us at info@bulgaria-for-business.com.
8. How long we keep your personal data
We keep personal data only for as long as is necessary for the purpose it was collected, and for as long as we are required to by law. The table below sets out our retention periods by data category.
| Data category | Retention period | Reason |
|---|---|---|
| Client service records | 7 years from end of engagement | Bulgarian tax and accounting record-keeping law requires business records to be kept for 7 years. |
| AML / Know Your Customer (KYC) records | 5 years from end of business relationship | Mandatory under the Bulgarian Measures Against Money Laundering Act (ЗМИП). Cannot be deleted earlier in response to an erasure request. |
| Invoicing and financial records | 7 years from date of invoice | Required for Bulgarian tax compliance and accounting obligations. |
| Payroll and employment records | 5 years from end of payroll service engagement | Bulgarian employment and social security record-keeping requirements. |
| Website contact / enquiry data (no engagement follows) | 3 years from last contact | Sufficient to allow reasonable follow-up; proportionate to the purpose. |
| Marketing subscriber data | Until unsubscribe or withdrawal of consent | Maintained only while consent is active. |
| Complaint records | 5 years from final resolution | To evidence the handling of the complaint and support quality improvement. |
| Website analytics data (aggregated) | Up to 26 months | As set out in our Cookie Policy. Shorter for session data. |
AML RECORDS — MANDATORY RETENTION: Identity verification and KYC records collected for anti-money laundering compliance must be retained for 5 years from the end of the business relationship under Bulgarian law (ЗМИП). During this period, a request to delete these records cannot be fulfilled — the legal obligation to retain them overrides the right to erasure. We will always tell you clearly if this applies to your request.
9. How we keep your data secure
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it, including:
- • Encrypted transmission of data via HTTPS/TLS on our website and in email communications.
- • Encrypted storage of sensitive client documents and files.
- • Access controls limiting who can view personal data — based on role and need.
- • Regular security reviews of our systems and processes.
- • Staff training on data protection and information security.
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Bulgarian supervisory authority (КЗЛД) within 72 hours and, where required, notify affected individuals without undue delay.
If you believe the security of your personal data held by us has been compromised, please contact us immediately at info@bulgaria-for-business.com.
10. Your rights
Under the GDPR and Bulgarian data protection law, you have the following rights in relation to your personal data. We will respond to all requests within 30 days (with the possibility of a two-month extension for complex requests).
| Your right | What it means | How to use it |
|---|---|---|
| Right of access | Request a copy of the personal data we hold about you and information about how we use it. | Email info@bulgaria-for-business.com |
| Right to rectification | Ask us to correct inaccurate data or complete incomplete data. | Email info@bulgaria-for-business.com |
| Right to erasure | Ask us to delete your personal data in certain circumstances — for example, where it is no longer needed, or where consent is withdrawn. Note: this right does not apply where we are required by law to keep the data (e.g. AML records for 5 years, tax records for 7 years). | Email info@bulgaria-for-business.com |
| Right to restriction | Ask us to pause processing of your data while a complaint or accuracy issue is resolved. | Email info@bulgaria-for-business.com |
| Right to data portability | Receive your personal data in a structured, machine-readable format, and transfer it to another organisation — where the processing is based on consent or contract and is automated. | Email info@bulgaria-for-business.com |
| Right to object | Object to processing based on legitimate interests or for direct marketing. We will stop direct marketing immediately on request. | Email info@bulgaria-for-business.com or use the unsubscribe link in any email |
| Right to withdraw consent | Where we rely on your consent — for example, for marketing emails or analytics cookies — you can withdraw consent at any time without affecting past processing. | Unsubscribe link in emails; cookie settings on our website; or email info@bulgaria-for-business.com |
| Right to complain | Lodge a complaint with the Bulgarian supervisory authority (КЗЛД) at www.cpdp.bg if you are not satisfied with how we handle your data. | www.cpdp.bg or email kzld@cpdp.bg |
To exercise any right, please email info@bulgaria-for-business.com with your name, contact details, and a description of your request. We may need to verify your identity before processing the request.
There is no charge for a rights request unless it is manifestly unfounded, repetitive, or excessive — in which case we may charge a reasonable fee or decline to act.
11. Cookies
We use cookies and similar technologies on our website to make it function correctly and to understand how it is used. Some cookies require your consent; others are strictly necessary for the site to work.
Full details of the cookies we use, why we use them, and how to manage your preferences are set out in our Cookie Policy at www.bulgaria-for-business.com/cookie-policy. Please read the Cookie Policy alongside this Privacy Policy.
12. Children
Our website and services are directed at business professionals and are not intended for children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has submitted personal data to us, please contact info@bulgaria-for-business.com and we will delete it promptly.
13. Changes to this Privacy Policy
We may update this Privacy Policy from time to time — to reflect changes in the law, our data processing practices, or how we operate. When we make changes, we update the version date and, for material changes, we will notify you by email (if we hold your email address) or by a notice on our website.
The current version of this policy is always available at www.bulgaria-for-business.com/privacy-policy. We encourage you to review it periodically.
14. Contact us and how to complain
Questions about this policy or your data
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:
| info@bulgaria-for-business.com | |
| Website | www.bulgaria-for-business.com |
| Address | 1 Atanas Dukov Str., floor 6., Lozenetz District, Sofia, Bulgaria, 1407 |
How to complain
If you are not happy with how we have handled your personal data, we ask that you contact us first — we aim to resolve all concerns directly. If you are still not satisfied, you have the right to complain to the Bulgarian supervisory authority:
| Authority | Commission for Personal Data Protection (Комисия за защита на личните данни — КЗЛД) |
| Website | www.cpdp.bg |
| Address | 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, Bulgaria |
| kzld@cpdp.bg | |
| Telephone | +359 2 915 3523 |
If you are based in another EU member state, you may also complain to the supervisory authority in your country of residence or place of work.
This Privacy Policy was last reviewed and updated in January 2025. It applies to Bulgaria For Business and the website www.bulgaria-for-business.com. For a more detailed technical statement of our GDPR compliance framework, see our Privacy Policy & GDPR Compliance Statement. This document does not constitute legal advice.