Privacy Policy
Last updated: 23 September 2026
This policy explains what personal data we process when you browse firmabulgaria.com, contact us or use our services, why we do it, who we share it with and what rights you have. It follows the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Bulgarian Personal Data Protection Act.
1. Who is responsible for your data
ФирмаБългария (FirmaBulgaria) is the name under which we offer our services. The company that will provide them is being registered. Until it is entered in the Commercial Register, the controller of your data is the team behind the brand, which you can reach at office@firmabulgaria.com. We will publish the company's name, EIK (company number) and address on this page once it is registered.
We only enter into service contracts in writing, and every contract states the provider's name, EIK and address. For data we process under such a contract, the controller is the provider named in it.
2. What data we process
Enquiries sent through the site
The contact form collects your name, email, phone number, the service you are interested in and your message. The questionnaire on the Start page collects the same contact details plus your answers: where you are based, what you need, which legal form and business activity you have in mind, whether you need VAT registration, how many employees and invoices you expect, whether you are an EU citizen and when you want to start.
Every enquiry automatically carries information about where it came from: the page you send it from, the language, the first page you landed on, the page that linked you to us (referrer), UTM parameters and ad click identifiers (for example Google's gclid or Facebook's fbclid, which ad platforms add to links) if they were in the page address. If you accepted analytics cookies, we also attach your Google Analytics client ID. The server records the IP address the form was sent from, to limit abuse. The source information is kept in your browser under the name fb_utm until you close the tab (see the cookie policy).
WhatsApp, Viber and email
If you message us, we receive your phone number or email address, your profile name and photo if they are visible, and the content of your messages and any files you send.
When you click a WhatsApp or Viber button on the site, our server logs the click with a short reference code, the messenger type, the page and the source information described above, plus your Google Analytics client ID if you accepted analytics cookies. The same code is added to the pre-filled WhatsApp text and to the email subject when you write from a link on the site (for example "Ref A7K2M"). The first letter of the code shows how you found us: a search engine, an AI assistant, an ad, social media, a link from another site, or directly. This lets us connect the conversation to its source.
Checklist download
When you request the checklist, your email address and the source information are sent through the Web3Forms service to the team's inbox. The PDF opens straight away in your browser. We use your email to give you the checklist and to reply if you write to us about it. We only send useful materials by email if you have given separate consent to that.
Client data
When you hire us, we process the data the service requires: details from your ID document (including a copy), your Bulgarian personal number (EGN) or foreigner's number (LNCh), address, details of partners, managers and beneficial owners, company documents, the data in the qualified electronic signature (QES) you sign with, bank details and the company's accounting records. We also collect the information required by the Bulgarian Measures Against Money Laundering Act (ZMIP), such as whether you are a politically exposed person and the source of funds. Some data we check in public registers, such as the Commercial Register and the BULSTAT register.
When we keep the books or run payroll for your company, we process data about your employees and business partners on the company's behalf and on its instructions. For that data your company is the controller and we act as its processor. The terms are set out in our contract.
Browsing the site
The server keeps logs of the IP address, date and time, requested address, browser and device (user agent) and referrer. The server's protection system uses these logs to temporarily block IP addresses that send suspicious requests. For aggregate statistics we use Ahrefs Web Analytics, which does not use cookies. Google Analytics only loads if you accept analytics cookies.
3. Why we use the data and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Replying to your enquiry, preparing a quote, agreeing a contract | Form data, WhatsApp, Viber and email messages | Steps taken at your request before a contract, Art. 6(1)(b) GDPR |
| Performing the contract (formation, changes, accounting, etc.) | Client data and documents | Performance of a contract, Art. 6(1)(b) GDPR |
| Legal obligations: accounting records under the Accountancy Act, anti-money-laundering checks under ZMIP, tax and social security duties | Identification data, documents, accounting records | Legal obligation, Art. 6(1)(c) GDPR |
| Understanding which channels bring enquiries | fb_utm, reference code, log of messenger clicks | Legitimate interest, Art. 6(1)(f) GDPR |
| Site security and abuse prevention | Server logs, IP address on form submission | Legitimate interest, Art. 6(1)(f) GDPR |
| Cookieless aggregate statistics (Ahrefs Web Analytics) | Technical request data | Legitimate interest, Art. 6(1)(f) GDPR |
| Statistics with Google Analytics | _ga cookies, visit data | Consent, Art. 6(1)(a) GDPR and Art. 4a of the Bulgarian Electronic Communications Act |
| Useful materials by email | Email address | Consent, Art. 6(1)(a) GDPR |
| Establishing, exercising or defending legal claims | Data relevant to the dispute | Legitimate interest, Art. 6(1)(f) GDPR |
Where we rely on legitimate interest, we have weighed it against your rights: the data is limited, we do not use it for advertising or sell it, and you can object at any time (section 9).
We need your name, email and phone number to answer your enquiry and cannot process it without them. The information required by ZMIP is mandatory by law, and without it we cannot provide the service.
4. Internal scoring of enquiries
The questionnaire calculates a points score from your answers, for example how soon you want to start and which services you need. It helps us decide which enquiries to answer first. The score is used only for internal prioritisation: we do not refuse a service or set prices on the basis of it, and a person reviews every enquiry. We do not make decisions based solely on automated processing that have legal effects on you or similarly significantly affect you (Art. 22 GDPR).
5. Who we share data with
We do not sell personal data. We share it only with the providers the site and our work depend on, and only as far as needed.
| Recipient | What for |
|---|---|
| DigitalOcean | Hosting of the site and of the server that receives the forms, keeps a copy of enquiries and the server logs. Data centre in Frankfurt, Germany. |
| NetHunt CRM | The system where we manage enquiries and clients. |
| Slack | Internal notification to the team about a new enquiry. |
| Google (Google Workspace and Google Analytics) | The team's mailbox; visit statistics, only if you consent. |
| Forward Email | Forwards mail sent to office@firmabulgaria.com to the team's mailbox. |
| Web3Forms | Delivers checklist requests to our inbox, and the contact form if your browser does not run JavaScript. |
| Ahrefs | Cookieless aggregate visit statistics. |
| WhatsApp (Meta) and Viber (Rakuten Viber) | Only if you message us there. These services also process your data as independent controllers under their own terms and policies. |
| Public authorities and registers | The Commercial Register at the Registry Agency, the National Revenue Agency, the National Social Security Institute, the BULSTAT register and other authorities, when the service requires it or the law demands it, including reports under ZMIP. |
| Notaries, banks, auditors and other professionals | Only when they take part in the service you ordered, as far as needed, and after we tell you. |
6. Transfers outside the EU
Some providers are US companies or process data outside the European Economic Area, for example Google, Slack, Meta and DigitalOcean. Where a provider is certified under the EU-U.S. Data Privacy Framework, the transfer relies on the European Commission's adequacy decision of 10 July 2023. We require a data processing agreement from our providers where one is offered, and for transfers outside the EEA we use Standard Contractual Clauses (Implementing Decision (EU) 2021/914) or another safeguard provided for in the GDPR. DigitalOcean is a US company: our server is in Frankfurt, but the provider can access data from the US, so these safeguards apply to it too.
Ahrefs is based in Singapore. For Ahrefs and NetHunt CRM we rely on the Standard Contractual Clauses in the provider's terms or on another appropriate safeguard under Art. 46 GDPR. You can ask for details of the safeguards at office@firmabulgaria.com.
Web3Forms (Web3Creative, India; servers in the USA) is used for the checklist download form, and for the contact form only if your browser does not run JavaScript. The provider does not offer a data processing agreement or Standard Contractual Clauses, so if you do not want your data to be transferred there, you can ask for the checklist at office@firmabulgaria.com.
7. How long we keep data
There is no single period. We keep data according to its purpose:
- enquiries and the related correspondence are kept for as long as we need them to reply and follow up, or until you ask us to delete them, unless we have a legal ground to keep them, for example to defend a claim;
- client documents and accounting records are kept for the periods required by the Accountancy Act and ZMIP;
- source information and messenger click logs are kept while they serve to analyse channels and the related enquiry;
- server logs are kept while they are needed for site security and incident investigation;
- data processed on the basis of consent is kept until you withdraw it;
- Google Analytics cookies stay in your browser for the period listed in the cookie policy or until you delete them.
8. How we protect data
The site runs over HTTPS only. Enquiries and client documents are accessible only to the team members working on them. The server is protected by a firewall and automatic blocking of suspicious requests. We require a data processing agreement from providers that process data for us where one is offered.
9. Your rights
At any time you have the right to:
- access your data and get a copy (Art. 15 GDPR);
- have inaccurate data corrected (Art. 16);
- have data erased where there is no ground to keep it (Art. 17);
- restrict processing (Art. 18);
- receive the data you gave us in a machine-readable format and pass it to someone else (Art. 20);
- object to processing based on legitimate interest (Art. 21). We stop unless we have compelling legitimate grounds or need the data for a legal claim. You can object to emails with useful materials at any time and we will stop unconditionally;
- withdraw consent at any time, as easily as you gave it (Art. 7(3)). For analytics cookies, use the "Cookie settings" link at the bottom of every page; for emails, write to us. Withdrawal does not affect processing carried out before it.
Send your request to office@firmabulgaria.com. We may ask you to confirm your identity before disclosing or changing data. We reply without undue delay and within one month of receipt at the latest. For complex or numerous requests this can be extended by two further months, and we will tell you so within the first month. Exercising your rights is free unless a request is manifestly unfounded or excessive.
If you believe we process your data unlawfully, you can complain to the Bulgarian Commission for Personal Data Protection (CPDP): 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg. You can also turn to the supervisory authority in the EU country where you live or work, or go to court.
10. Minors
The site and our services are intended for adults. A parent or guardian who believes we have received a minor's data can write to us at office@firmabulgaria.com.
11. Changes to this policy
When we change the way we process data, we will update this page and the date at the top. We will also email our clients about significant changes that affect them.
12. Contact
For any question or request about your data, write to office@firmabulgaria.com. See also the cookie policy and the terms and conditions.