This Privacy Policy explains how CFO Services Ltd. collects, uses, stores and protects personal data when you visit and use https://cfoservices.bg (the “Website”) or contact us in relation to our services.
The Policy is prepared in accordance with Regulation (EU) 2016/679 (the “General Data Protection Regulation” or “GDPR”), the Bulgarian Personal Data Protection Act and other applicable Bulgarian and European legislation.
1. Who is the data controller
Data controller
Company: „СФО Сървисес“ ЕООД (CFO Services Ltd.), UIC 207570478
Registered address: 26 Yoakim Gruev St., fl. 1, ap. 1, Central District, 4000 Plovdiv, Bulgaria
Website: https://cfoservices.bg
Email for personal data enquiries: avelkov@cfoservices.bg
When this Policy uses “we”, “us” or “our”, it refers to CFO Services Ltd.. We determine the purposes and means of the processing described below.
2. Who this Policy applies to
This Policy applies to Website visitors, persons submitting an enquiry through the contact form or contacting us by email or telephone, and representatives or employees of current or prospective clients and business partners.
3. Personal data we may process
3.1. Technical data generated when you visit the Website
Depending on the Website configuration and your cookie choices, we may process your IP address, date and time of access, requested pages and files, referring address, browser type and version, operating system, device type, approximate location, cookie identifiers and technical security logs.
3.2. Data provided when you make an enquiry
When you use the contact form or contact us by email or telephone, we may process:
- first and last name;
- company and job title, where provided;
- email address and telephone number;
- the content of your enquiry, message and any attachments;
- other information you voluntarily choose to provide.
3.3. Business correspondence
We may retain and process personal data contained in business correspondence and communication records where this is necessary to manage relationships with prospective or current clients, partners and their representatives.
3.4. Cookies and analytics data
The Website may use strictly necessary cookies and, only with your consent, functional, analytics or marketing technologies. Further details are available in the Cookie Policy and the Website’s “Cookie Settings” panel.
3.5. Special categories of personal data
We do not request or intend to collect special categories of personal data through the Website, such as health, biometric, political opinion, religious belief or trade union membership data. Please do not send such data unless it is necessary and expressly agreed in advance.
4. Purposes and legal bases
| Purpose | Data categories | Legal basis |
|---|---|---|
| Operation, maintenance, diagnostics and security of the Website | Technical data and logs | Legitimate interests – Article 6(1)(f) GDPR: security, prevention of misuse and reliable Website operation. |
| Responding to enquiries and preparing a proposal or contract | Identity, contact and enquiry data | Article 6(1)(b) GDPR – steps prior to or performance of a contract; for representatives of legal entities – legitimate interests under Article 6(1)(f) GDPR. |
| Managing business relationships and correspondence | Contact data and correspondence | Legitimate interests – Article 6(1)(f) GDPR. |
| Compliance with legal and regulatory obligations | Data required by law | Legal obligation – Article 6(1)(c) GDPR. |
| Establishment, exercise or defence of legal claims | Relevant data and correspondence | Legitimate interests – Article 6(1)(f) GDPR. |
| Optional analytics, personalisation or marketing technologies, if enabled | Online identifiers and usage data | Consent – Articles 6(1)(a) and 7 GDPR, in conjunction with Article 4a of the Bulgarian Electronic Commerce Act. |
Where we rely on legitimate interests, we balance those interests against your rights and reasonable expectations and implement appropriate safeguards.
5. Is providing personal data mandatory
You may visit the Website without completing the contact form. Fields marked as mandatory are required so that we can review and respond to your enquiry. If you do not provide the necessary data, we may be unable to respond or take the requested pre-contractual steps.
6. Recipients of personal data
To the extent necessary for the purposes described above, we may disclose personal data to:
- authorised employees and advisers of CFO Services Ltd.;
- hosting, email, IT support, Website development and maintenance providers;
- analytics, communication or other online tool providers, only where lawfully enabled and, where required, after your consent;
- professional advisers, including lawyers, accountants and auditors;
- competent public authorities, courts or other persons where disclosure is required by law or necessary to protect legal rights.
Where a service provider processes data on our behalf, we require contractual commitments concerning confidentiality, security and processing only on our instructions.
7. Transfers outside the European Economic Area
We seek to use providers that process data within the European Economic Area (“EEA”). Where a provider involves a transfer outside the EEA, we will use a lawful GDPR mechanism, such as an adequacy decision, European Commission Standard Contractual Clauses or other appropriate safeguards. Information about the applicable safeguard may be requested from us.
8. Retention periods
We retain personal data only for as long as necessary for the relevant purpose, unless a longer period is required by law. We generally apply the following criteria:
- technical and security logs – up to 12 months, unless needed to investigate an incident or protect legal rights;
- enquiries that do not lead to an engagement – up to 3 years after the last substantive communication;
- data relating to a contractual or client relationship – for the duration of the relationship and thereafter for applicable statutory and limitation periods;
- accounting, tax and other statutory records – for the periods required by applicable law;
- cookie and consent data – for the periods stated in the Cookie Settings panel and Cookie Policy.
After expiry of the relevant period, data is deleted or anonymised, unless restricted retention is necessary to establish, exercise or defend legal claims.
9. How we protect personal data
We implement technical and organisational measures appropriate to the nature of the data and the relevant risks, including access controls, restriction of privileges, protection of communications, backups, system updates and incident response procedures. No internet-based system can, however, guarantee absolute security.
10. Your rights
Subject to the conditions of the GDPR, you may:
- obtain information and access to your personal data;
- request correction of inaccurate or incomplete data;
- request erasure where the legal conditions are met;
- request restriction of processing;
- receive data you provided in a structured, commonly used and machine-readable format and, where applicable, request its transfer;
- object to processing based on legitimate interests for reasons relating to your particular situation;
- withdraw consent at any time, without affecting processing carried out before withdrawal;
- object at any time to processing for direct marketing purposes, if such processing is carried out.
To exercise a right, contact us at avelkov@cfoservices.bg. We may request additional information to verify your identity. We will normally respond within one month; this period may be extended in accordance with the GDPR where a request is complex or numerous.
11. Right to lodge a complaint
You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, through its official website at www.cpdp.bg. We encourage you to contact us first so that we can attempt to resolve the matter.
12. Automated decision-making
We do not use the Website to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
13. Links to third-party websites
The Website may contain links to third-party websites or services, such as LinkedIn. We do not control their privacy practices. Please review the relevant third-party policies before providing personal data to them.
14. Children’s data
The Website and our services are intended for business users and are not directed at children. We do not knowingly collect personal data from persons under 18 through the Website.
15. Changes to this Policy
We may update this Policy to reflect changes in law, our activities or Website technologies. The current version and the date of the latest update will be published on this page.
16. Contact
For questions, requests or objections concerning personal data processing, contact us at avelkov@cfoservices.bg