Privacy Policy
Last updated: July 2026
1. Data Controller
The controller of your personal data is PLENTY TRADE EOOD (ПЛЕНТИ ТРЕЙД ЕООД), a company registered under Bulgarian law with Unified Identification Code (EIK) 208530593, with registered office in Sofia, Bulgaria ("we", "us", or "the Company").
For any data-protection inquiries, please contact us at: info@nedvijimo.bg
2. Personal Data We Collect
We collect and process the following categories of personal data:
- Identity data: full name, username, profile picture.
- Contact data: email address, phone number, postal address.
- Account data: login credentials (password is stored in hashed form only).
- Usage data: pages visited, search queries, properties viewed, favorites saved, time spent on site.
- Technical data: IP address, browser type and version, operating system, device identifiers, referral URLs.
- Communication data: content of messages sent via our contact form, chat widget, or bug-report form.
- Cookie data: preferences, session identifiers, and analytics cookies (see Section 5).
3. Purposes and Legal Basis for Processing
We process your personal data on the following legal bases under Article 6 of the General Data Protection Regulation (GDPR):
- Performance of a contract (Art. 6(1)(b)): to create and manage your account, provide property search and listing services, and respond to your inquiries.
- Legitimate interest (Art. 6(1)(f)): to improve our platform, conduct analytics, prevent fraud, ensure website security, and send relevant property recommendations.
- Consent (Art. 6(1)(a)): for newsletter subscriptions, non-essential cookies, and marketing communications. You may withdraw consent at any time.
- Legal obligation (Art. 6(1)(c)): to comply with applicable Bulgarian and EU legislation, tax requirements, or requests from competent authorities.
4. Data Sharing with Third Parties
We do not sell your personal data. We may share your data with the following categories of recipients only as necessary:
- Hosting & infrastructure providers (Vercel, Cloudflare) for website delivery and security.
- Email service providers for transactional and marketing emails.
- Analytics providers (Google Analytics) for aggregated usage insights.
- Real estate partners & agents when you express interest in a listed property.
- Regulatory bodies & law enforcement when required by law.
5. Cookies and Tracking Technologies
Our website uses the following types of cookies:
- Strictly necessary cookies: required for the website to function (e.g., session cookies, language preference). These cannot be disabled.
- Analytics cookies: help us understand how visitors interact with our website. These are set only with your consent.
- Functional cookies: remember your preferences such as language selection and saved properties.
You can manage cookie preferences through our cookie banner or your browser settings.
6. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes described above:
- Account data: until you delete your account, plus up to 30 days for backup removal.
- Contact form submissions: up to 12 months from receipt.
- Analytics data: aggregated and anonymised within 26 months.
- Legal/tax records: as required by Bulgarian law (typically 5–10 years).
7. Your Rights Under GDPR
As a data subject under the GDPR, you have the following rights:
- Right of access (Art. 15) — obtain a copy of your personal data.
- Right to rectification (Art. 16) — correct inaccurate or incomplete data.
- Right to erasure (Art. 17) — request deletion of your data ("right to be forgotten").
- Right to restriction of processing (Art. 18) — limit how we use your data.
- Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
- Right to object (Art. 21) — object to processing based on legitimate interest or direct marketing.
- Right to withdraw consent — at any time, without affecting the lawfulness of prior processing.
To exercise any of these rights, please email info@nedvijimo.bg. We will respond within 30 days.
8. International Data Transfers
Some of our service providers (e.g., hosting and analytics) operate outside the European Economic Area (EEA). Where data is transferred to countries without an adequacy decision by the European Commission, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:
- TLS/SSL encryption for all data in transit.
- Hashed and salted password storage.
- Access controls and role-based permissions.
- Regular security audits and vulnerability assessments.
10. Right to Lodge a Complaint
If you believe that your data-protection rights have been violated, you have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP):
- Address: 2, Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
- Website: www.cpdp.bg
- Email: kzld@cpdp.bg
11. Changes to This Policy
We may update this Privacy Policy from time to time. Any material changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.
12. Contact Us
For any questions or concerns regarding this Privacy Policy or our data practices, please contact: