Legal information

Privacy policy

How Bubspa Konsult EOOD processes the personal data of website visitors and of people who send us an enquiry.

01Data controller

This policy applies to the website bubspa-consult.com and has been prepared in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and the Bulgarian Personal Data Protection Act.

The controller of your personal data is Bubspa Konsult EOOD, UIC 208685184, with its registered office and address of management at 1-3 Cherni Vrah Blvd., 1421 Sofia, Bulgaria.

You can contact us by email at office@bubspa.org or by phone on +359 887 711 076.

02What personal data we process

Data from the enquiry form: full name, property or organisation, email, phone, property type, the services you are interested in and the text of your message.
Data you send us by email or give us over the phone.
Technical data: IP address, browser and device type. Our hosting provider processes them to keep the website secure and to protect it against spam.
Visit data, only if you accept cookies: pages viewed, where you came from, approximate location (country and city), device and browser type, clicks, scrolling and mouse movements. We collect it through Google Analytics and Microsoft Clarity. What you type into the form fields is not recorded.

We do not collect special categories of personal data. Please do not include them in your message.

03Purposes and legal bases

Replying to an enquiry and preparing an offer: Article 6(1)(b) GDPR, taking steps at your request before entering into a contract.
Performing a contract we have concluded: Article 6(1)(b) GDPR.
Website security and protection against abuse and spam: Article 6(1)(f) GDPR, our legitimate interest in running the website securely.
Visitor statistics and analysis (Google Analytics and Microsoft Clarity): Article 6(1)(a) GDPR, your consent. You can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
Compliance with legal obligations, such as accounting and tax obligations: Article 6(1)(c) GDPR.

Providing your data is voluntary. However, we cannot reply to your enquiry without your name and email address.

04Retention period

Enquiries that do not lead to a contract: up to 12 months from the last correspondence.
Data related to a contract: for the term of the contract and afterwards for the periods required by the Bulgarian Accountancy Act and tax legislation.
Technical security data: for as long as needed to protect the website, under the terms of our hosting provider.
Google Analytics data: up to 14 months, after which Google deletes it automatically.
Microsoft Clarity data: session recordings are kept for 30 days and aggregated data (heatmaps) for up to 13 months.
Your cookie choice: stored in your browser for 12 months. After that, we ask you again.

When these periods expire, we delete the data or anonymise it.

05Recipients of the data

We do not sell your personal data and do not share it for advertising. The following have access to it:

Cloudflare, Inc., processor: website hosting, delivery of enquiries from the form to our mailbox and spam protection (Cloudflare Turnstile).
SuperHosting.BG, processor: the email service through which we receive and store enquiries.
Google Ireland Limited, processor: visitor statistics through Google Analytics, only with your consent. Google Analytics 4 does not log or store IP addresses.
Microsoft Ireland Operations Limited, controller: analysis of visitor behaviour through Microsoft Clarity, only with your consent. Microsoft processes the data under the Microsoft Privacy Statement.
Deploee, processor: development and technical support of the website, where support requires access to data.
Public authorities, where the law requires us to provide data to them.

Our processors act on our instructions and under a contract in accordance with Article 28 GDPR.

06Transfers of personal data to third countries

Cloudflare, Google and Microsoft may process data outside the European Union, including in the United States. Cloudflare, Inc., Google LLC and Microsoft Corporation are certified under the EU-U.S. Data Privacy Framework, and such transfers are based on Commission Implementing Decision (EU) 2023/1795 on the adequate level of protection of personal data under that framework. Where that decision does not apply, transfers are based on standard contractual clauses approved by the European Commission.

07Cookies

The website sets cookies for statistics and analysis only if you accept them in the banner shown on your first visit. If you decline, no such cookies are set and Google Analytics and Microsoft Clarity are not loaded. We do not use cookies for advertising.

Cloudflare may set strictly necessary cookies for website security. These do not require consent.

Cookies we set only with your consent:

_ga (Google Analytics): distinguishes individual visitors. Expires after 13 months.
_ga_2NFVZ8YX1D (Google Analytics): keeps the state of the current visit. Expires after 13 months.
_clck (Microsoft Clarity): keeps the pseudonymous visitor ID and preferences. Expires after 1 year.
_clsk (Microsoft Clarity): links the pages viewed into a single visit. Expires after 1 day.

We store your choice in your browser's local storage (bc-consent), not in a cookie. You can change it at any time with the button below or the "Cookie settings" link in the footer of every page. When you withdraw consent, we delete the Google Analytics and Microsoft Clarity cookies. You can also delete cookies in your browser settings.

08Your rights

Right of access to your personal data (Article 15 GDPR).
Right to rectification (Article 16 GDPR).
Right to erasure (Article 17 GDPR).
Right to restriction of processing (Article 18 GDPR).
Right to data portability (Article 20 GDPR).
Right to object to processing based on legitimate interests (Article 21 GDPR).
Right to withdraw your consent at any time (Article 7(3) GDPR).

To exercise your rights, write to us at office@bubspa.org. We reply without undue delay and in any event within one month of receiving your request. For complex or numerous requests, this period may be extended by two further months, and we will let you know if so. We may ask for information to confirm your identity.

09Right to lodge a complaint

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, www.cpdp.bg.

10Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

11Security

We apply technical and organisational measures to protect your data: an encrypted connection (HTTPS), restricted access to enquiries and protection of the website against abuse.

In the event of a personal data breach, we notify the Commission for Personal Data Protection and, where the law requires it, the affected individuals without undue delay.

12Changes to this policy

We may update this policy. The current version is published on this page.

Last updated: 5 October 2026