Privacy
Privacy Policy
What personal data we collect through this website, why we use it, how long we keep it and the rights you have under the EU General Data Protection Regulation (GDPR).
Last updated
Who we are
The controller of your personal data is Invest Bulgaria Group Ltd, which publishes the InvestBulgaria website and business directory.
- Privacy contact
- veselin@investbulgaria.com
For any question about this policy or your data, contact us at veselin@investbulgaria.com or through the contact form.
Data we collect
When you send us a message
The contact form asks for:
- your name and email address;
- optionally, your company and country;
- the topic you choose and the message you write.
Please do not include sensitive information, such as health data or identity documents, in your message.
When you create an account
We ask for your name, email address and a password. We store the password only in scrambled (hashed) form, so nobody at InvestBulgaria can read it.
When you contact a company through the directory
The enquiry form asks for your name, email address, optionally your country, and your message.
When you ask to manage a listing or report one
We record your role at the company and anything you tell us to show you represent it. A report can include your email address if you would like a reply.
When you subscribe to The Bulgaria Briefing
We ask only for your email address.
When you visit the website
Like any website, our server processes technical data needed to deliver pages and keep the site secure: your IP address, browser type, the pages requested and the time of the request. We use your IP address to limit repeated form submissions and protect against abuse.
We do not use analytics, advertising or social media tracking. Fonts and images are served from our own website, so loading a page does not send your data to third-party font or content providers.
Why we use it
- Replying to your message, for example about a directory listing, a membership or advertising. The legal basis is your consent, given when you submit the form (GDPR Article 6(1)(a)), and, where you ask about our paid services, taking steps at your request before entering into a contract (Article 6(1)(b)).
- Sending The Bulgaria Briefing, if you subscribe. The legal basis is your consent (Article 6(1)(a)).
- Running and securing the website, including preventing spam and abuse. The legal basis is our legitimate interest in operating a secure website (Article 6(1)(f)).
- Meeting legal obligations, for example keeping records if your enquiry leads to a contract (Article 6(1)(c)).
We do not sell your personal data, and we do not use it for automated decision-making or profiling.
The Bulgaria Briefing
If you subscribe, we use your email address only to send The Bulgaria Briefing, a weekly email with news and data for investors. You can unsubscribe at any time by replying to any issue or through the contact form, and we will stop sending it and delete your address from the list.
Member accounts
Companies create a free account to add or update their directory listing and publish investment offers. We use your account details to sign you in, to email you about your listings (for example when a change is approved) and to reset your password. The legal basis is the contract for the free listing service (Article 6(1)(b)). You can change your details in your account settings, or ask us to close the account.
The business directory
The directory shows information about companies: their name, description, address, phone number, website and, where the company provides it, the name of its managing director. We do not publish email addresses or the names of contact people.
Enquiries. When you use the form on a company's page, we email your name, email address, country and message to that company, so it can reply to you directly. We keep a record of the enquiry for 24 months to deal with abuse. The legal basis is your consent, which you give by ticking the box on the form.
Managing a listing. To confirm you represent a company, we either email a link to the address on its listing, or our team checks the details you give us. We keep a record of the request and the decision.
Listings from the earlier InvestBulgaria site. The directory includes companies listed on investbulgaria.com since 2004. We moved the company details only. Passwords and other personal data held by the old site were not carried over. Business contact details, such as a company phone number or the name of a contact person, may still relate to a person; we keep them to run the directory, based on our legitimate interest in maintaining an accurate business directory (Article 6(1)(f)). If you are named in a listing, you can ask us to correct or remove your details at any time.
Who receives it
- Our team, who read and answer messages.
- Service providers who host the website and deliver email for us, acting on our instructions under data processing agreements.
- Directory companies, such as lawyers or accountants, but only when you send them an enquiry through the directory or ask us to pass on your message.
- Public authorities, only where the law requires it.
If any of your data is transferred outside the European Economic Area, we make sure appropriate safeguards are in place, such as an adequacy decision of the European Commission or standard contractual clauses.
How long we keep it
- Messages: up to 24 months after our last contact with you, unless the message leads to a contract, in which case we keep the records required by Bulgarian accounting and tax law.
- Briefing subscriptions: until you unsubscribe.
- Accounts: until you ask us to close the account, or after three years without signing in, when we email you first.
- Directory enquiries and reports: up to 24 months.
- Requests to manage a listing: for as long as you manage the listing, and up to 24 months after a request is declined.
- Server and security logs: only as long as needed to operate and protect the website.
- Session cookies: deleted automatically, as described below.
Cookies
We only use cookies that are strictly necessary for the website to work. They do not track you across other sites, and because they are essential, they do not require consent.
| Cookie | Purpose | Duration |
|---|---|---|
| investbulgaria-session | Keeps your session, for example to keep you signed in, show form errors or confirm a message has been sent. | 2 hours |
| remember_web_… | Only if you tick “Keep me signed in”. Keeps you signed in to your account. | Until you sign out |
| XSRF-TOKEN | Protects forms against cross-site request forgery. | 2 hours |
You can delete or block cookies in your browser settings, but the forms on this site may not work without them.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected or incomplete data completed;
- have your data erased, for example when it is no longer needed;
- restrict how we use your data in certain circumstances;
- receive the data you gave us in a portable format;
- object to processing based on our legitimate interests;
- withdraw your consent at any time, without affecting processing that took place before you withdrew it.
To exercise any of these rights, contact us as described in Who we are. We will reply within one month, and may ask you to confirm your identity first.
Complaints
If you believe we have not handled your data properly, please tell us first so we can put it right. You also have the right to complain to a data protection authority, in particular in the EU country where you live or work. In Bulgaria this is the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, kzld@cpdp.bg.
Changes to this policy
We may update this policy when our services or the law change. The date at the top of this page shows when it was last revised.
