Privacy Policy

Who is responsible for your data?

The controller is the operator of setupinbulgaria.com. Every data-protection question, request or complaint goes to one address, [email protected]. There is no separate data-protection officer and no other contact channel.

What does the request form collect?

Only your name is compulsory, plus one way to reach you. Everything else is optional, and you decide how much to tell us:

• your citizenship and the country you are asking about;
• the service you need — a company, a residence permit, a property purchase — with your budget and timeline;
• your name;
• an email address, a phone number or a messenger handle (at least one of the three);
• a free-text message;
• your tick in the consent box, which the form will not submit without.

Along with the fields, the server records the page you sent the form from, the page that brought you to the site, the time, your browser’s user-agent string and a hashed form of your IP address. The IP itself is never written down: it is combined with a secret salt and turned into a short one-way hash, which lets us spot repeated spam without knowing who sent it. Anything typed into a field the form does not have is discarded on arrival.

Why do we need it, and on what legal basis?

We use your request for one purpose: to work out what your case involves and send you a quote. The legal basis is your consent under Article 6(1)(a) GDPR, given by ticking the box before you send the form. If you then hire us, the data needed to do the work — registering a company, preparing a permit file — is processed because it is necessary for that contract (Article 6(1)(b)).

We do not sell requests, add them to mailing lists or pass them to other firms. Setup Bulgaria does the work itself, so there is nobody to forward your request to.

Where does a request go after you press send?

• First, it is saved to a file on the server that runs this site. Only after the save does the form report success.
• Next, a notification with the same fields is sent to the operator through a private Telegram bot, so the request is seen quickly. Telegram is an outside service with its own privacy terms, and its servers may be outside the EU.
• If the server cannot save the request, the full request is sent in that Telegram message instead, so it is not lost. If neither works, the form shows an error and nothing is kept.

Nobody else receives the request. Apart from Telegram, no email marketing tool, CRM or advertising platform is involved.

How long do we keep a request?

730 days from the day it arrives. Older records are removed automatically: when a new request is saved, the server checks, at most once a day, for entries past the limit and deletes them. You do not have to wait that long — ask us to delete yours at any point. Telegram notifications are removed from the operator’s chat on the same request.

If you become a client, the documents of the engagement are kept for as long as Bulgarian accounting and tax law require. That period is set by law, not by us, and a deletion request cannot shorten it.

Do we track you across the site?

We count visits ourselves, with first-party cookies set by setupinbulgaria.com. The site has no Facebook pixel, no advertising tags and no third-party analytics scripts. Nothing is loaded in your browser for tracking: the counting happens on our server.

• A random visitor ID in a cookie that lasts about a year, so a returning visitor is not counted twice.
• A session cookie of under an hour that remembers how you arrived — from search, a link or directly.
• For visits that start from a Google search, the server logs the page path, the referring address, the browser’s user-agent and the visitor ID. The IP is passed on for hashing and is not stored in raw form.

Counting starts on your first page view. Choosing “Necessary only” in the cookie banner stops it: from then on no visitor ID is set and no visit is logged. Search-engine crawlers are never counted. The Cookie Policy lists each cookie and how long it lasts.

What rights do you have over your data?

Under the GDPR you can ask us to:

• show you a copy of everything we hold about you (Article 15);
• correct a wrong detail (Article 16);
• delete your request (Article 17);
• stop using it while a dispute is sorted out (Article 18);
• send it to you in a machine-readable file (Article 20).

You can also withdraw consent at any time. This does not affect what was done before you withdrew it, but we stop using your request from that point. Write to [email protected] from the email or phone number you used in the form, so we can match the request to you without asking for identity documents. The GDPR gives us one month to reply.

Where can you complain?

In Bulgaria the supervisory authority is the Commission for Personal Data Protection. You can also complain to the data-protection authority of the EU country where you live or work. We would still like to hear from you first, since most problems can be solved with one email.

How will you know if this policy changes?

A change in what we collect — a new form field, a new cookie, a different notification channel — is reflected here before it goes live. Requests already stored stay under the rules that applied when you sent them, unless the new rules protect you better.