Data Protection & GDPR

1. Controller & roles

1. Controller, DPO and roles

Controller: Bulgarian.LLC — the Bulgarian entity operating www.bulgarian.llc [registered legal-entity name, EIK/UIC and registered address to be completed]. Contact: [email protected], +359 897 077 220.

Data Protection Officer / contact: Bulgarian.LLC has assessed the Article 37 criteria. A formal DPO is [appointed / not mandatory but a designated privacy contact is maintained]. The designated contact handles data-subject requests and supervisory-authority communication.

Roles: Bulgarian.LLC acts as controller for website visitors, enquirers and Calculator users. It acts as processor only where it processes client data strictly on a client’s documented instructions as part of an accounting or tax engagement; those engagements are governed by a separate Article 28 data-processing agreement.

2. Scope & systems

2. Systems in scope

• WordPress website on managed hosting, behind Cloudflare (CDN, WAF, APO);
• the three Calculators: Tax Calculators, Company Setup & Readiness Assessment, Accounting/Tax & Compliance Assessment;
• contact and enquiry forms and the consultation-booking module;
• analytics and tag management (Google Analytics 4, Google Tag Manager) and a referral-source signal;
• transactional email (result and notification emails);
• any e-commerce / account components enabled on the site.

3. Records of processing (Art. 30)

3. Records of Processing Activities

4. Data minimisation

4. Minimisation & special categories

We collect only data adequate, relevant and limited to each purpose (Art. 5(1)(c)). We do not request special-category data (Art. 9) or unnecessary national identification numbers. The Calculators avoid collecting full IP addresses by default (a truncated one-way hash is used for abuse control), and they do not upload documents in their current version. Users are warned not to submit sensitive personal data through free-text fields.

5. Processors & transfers

5. Processors and international transfers

Each third party that processes personal data on our behalf does so under an Article 28 agreement. Principal processors are: the website hosting/infrastructure provider; Cloudflare (CDN, security); Google (Analytics 4 and Tag Manager); and the email-delivery mechanism. Where a processor transfers data outside the EEA, we rely on an EU adequacy decision or on Standard Contractual Clauses with supplementary measures (Chapter V GDPR). A current processor register and the corresponding DPAs are maintained by the controller.

6. Security measures (Art. 32)

6. Technical & organisational measures

• encryption in transit (HTTPS/TLS) across the site and Calculators;
• access control and least-privilege access to the WordPress admin and databases;
• prepared SQL statements, input sanitisation and output escaping to prevent injection/XSS;
• anti-abuse controls: honeypot, time-trap, IP-hash rate-limiting and optional CAPTCHA (Turnstile);
• no secret keys exposed to the browser; no public access to stored submissions;
• IP-address minimisation (hashing) and configurable, off-by-default IP logging;
• Cloudflare WAF and CDN; managed hosting with backups;
• data anonymisation and deletion tooling for retention and erasure requests;
• staff confidentiality and need-to-know handling.

7. Data-subject rights procedure

7. Handling data-subject requests

Requests to exercise rights under Articles 15–22 GDPR are received at [email protected], logged, and verified as to the requester’s identity. We respond within one month (extendable by two months for complex requests, with notice). We provide access exports, correct or erase data, restrict or port data, and honour objections and consent withdrawals, subject to the GDPR’s exceptions (e.g. legal-retention obligations). The Accounting/Tax Assessment tool provides built-in per-record export, anonymisation and deletion to support these rights.

8. Breach procedure

8. Personal-data breach response

On detecting a suspected breach we contain and assess it, record it in our breach log, and — where it is likely to result in a risk to individuals — notify the CPDP (КЗЛД) without undue delay and, where feasible, within 72 hours (Art. 33). Where the breach is likely to result in a high risk, we also inform affected individuals without undue delay (Art. 34).

9. Retention schedule

9. Retention

• Assessment submissions: default 24 months, then deletion or anonymisation (configurable; longer only for a live engagement).
• Enquiries and booking data: for the duration of handling plus a limited follow-up window.
• Accounting and tax records: retained for the periods required by Bulgarian law.
• Analytics: per the analytics provider’s configured retention.
• Marketing data: until the individual unsubscribes.

10. Cookies inventory

10. Cookies and local storage

11. Automated processing & DPIA

11. Automated decisions and DPIA

The Calculators apply deterministic, administrator-configured rules to produce indicative results. They do not carry out solely automated decision-making producing legal or similarly significant effects (Art. 22), and any actual engagement or advice involves human assessment. Because processing is limited, transparent and low-risk, a full Data Protection Impact Assessment (Art. 35) is not currently triggered; the controller reviews this position if processing changes (e.g. if document upload or large-scale profiling is introduced).

12. Governing law & authority

12. Governing law and supervisory authority

Processing is governed by the GDPR (Regulation (EU) 2016/679) and the Bulgarian Personal Data Protection Act (ZZLD). The competent supervisory authority is the Commission for Personal Data Protection (Комисия за защита на личните данни, CPDP/КЗЛД), 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592 — www.cpdp.bg.