Privacy policy | BulPays

1. Data controller

The data controller is BulPays Ltd., with its registered office at 21 Aleksandrovska Str., Burgas 8000, Bulgaria, company/VAT number BG000000000.

For any question about the processing of personal data, write to [email protected].

2. What data we collect

We collect only the data necessary for the purposes set out below.

Enquiry form data: name, company, email, phone, website, sector, expected volume and the text of your message.
Technical data: IP address, browser type, submitting page and request time, for abuse protection.
KYC data when entering into a contract: identity documents, company documents and bank details.
Cookie data, where you have consented to analytics cookies.

3. Purposes and legal basis

We process personal data on the following grounds:

Answering an enquiry and preparing a quote: steps taken at the data subject's request prior to entering into a contract (Art. 6(1)(b) GDPR).
Performance of a payment services contract (Art. 6(1)(b) GDPR).
Compliance with legal obligations, including anti-money-laundering rules (Art. 6(1)(c) GDPR).
Legitimate interest: site security and abuse prevention (Art. 6(1)(f) GDPR).

4. Retention period

Enquiries that do not lead to a contract are kept for up to 12 months. Data relating to a concluded contract is kept for the term of the contract and thereafter in line with applicable accounting and AML requirements, up to 5 years after termination.

5. Recipients of the data

Personal data may be shared with our payment partner for approval and payment processing purposes, with our hosting provider, and with competent authorities where required by law.

We do not sell personal data and we do not provide it to third parties for marketing purposes.

6. Transfers outside the EU

Data is processed on servers within the European Union. Should a transfer outside the EU become necessary, it will take place only under an adequacy decision or standard contractual clauses.

7. Your rights

As a data subject you have the following rights:

Access to the personal data we process about you.
Rectification of inaccurate or incomplete data.
Erasure where there is no legal ground for continued storage.
Restriction of, and objection to, processing.
Data portability in a machine-readable format.
Lodging a complaint with the Bulgarian Commission for Personal Data Protection.

8. Security

We use an encrypted connection (TLS), restricted database access and regular backups. Only staff who need it for their work have access to enquiries.

9. Changes to this policy

We may update this policy. The current version is always published on this page with the date of the last change.

Your rights and how to exercise them

Under the GDPR you have the right of access to your data, to rectification, to erasure, to restriction of processing, to portability and to object to processing based on legitimate interest.

To exercise any of them, write to the email address given. We will confirm receipt and respond within one month. If the request is complex the period may be extended, but we will tell you why.

We will not ask you to justify a request for erasure, except where we have a legal duty to retain the data. In that case we will tell you which duty applies and until when.

If you believe we are processing your data unlawfully, you have the right to complain to the supervisory authority.

What we collect and why

The full list in one place, with the basis and the period for each.

Data	Purpose	Legal basis	Retention
Name, email, phone from the form	Answering the enquiry and preparing a quote	Steps at the data subject's request before a contract	Up to 12 months from last contact
Company, site, sector, turnover	Assessing whether and on what terms we can work together	Steps at the data subject's request before a contract	Up to 12 months from last contact
IP address, browser type, request time	Protecting the form against automated requests	Legitimate interest	Up to 90 days
Message content	Understanding the enquiry	Steps at the data subject's request before a contract	Up to 12 months from last contact
Merchant data once a contract is in place	Performing the contract and meeting legal duties	Contract and legal obligation	Up to 5 years after termination

Your customers' card data is not collected or stored by us through this form. It is processed in a certified PCI DSS Level 1 environment.