Privacy Policy

1. Who processes your data

The controller of personal data within the meaning of Art. 4(7) GDPR is:

The company is not required to designate a data protection officer under Art. 37 GDPR: its core activities consist neither of large-scale systematic monitoring nor of large-scale processing of special categories of data. All questions regarding this policy should be sent to the address or e-mail above and are handled by the manager.

2. When we are a controller and when we are a processor

This distinction determines who your requests should go to, which is why it comes before everything else.

2.1. We are a controller for:

• visitors to the website — cookies, enquiries through the form and the chat;
• contact persons and representatives of our clients and suppliers;
• users of the client portal — their accounts, logins and audit trail;
• job applicants and our own staff.

2.2. We are a processor for:

the data of employees, partners and counterparties of our clients that reaches us in the course of accounting and payroll services — payrolls, employment contracts, sick-leave notes, invoices. For that data the controller is the client (the employer), and we act solely on their documented instructions, under a contract pursuant to Art. 28(3) GDPR.

If you are an employee of a client of ours and wish to access, rectify or erase your data, the request must be addressed to your employer, not to us. We will refer you to them and notify the client of the request received, but we have no right to dispose of that data on our own.

3. What data we collect, for what purpose and on what legal basis

This section answers all four questions the GDPR requires at once: what, why, on what legal basis and for how long.

3.1. Enquiry through the contact form and the chat

Data: name, e-mail, phone (optional) and the content of your message. Purpose: to answer your enquiry. Legal basis: Art. 6(1)(b) — steps taken at the request of the data subject prior to entering into a contract; where the enquiry does not lead to a contract — Art. 6(1)(f) (our legitimate interest in answering questions addressed to us). Retention: 12 months from the last correspondence.

The chat bot on the site searches by keyword among pre-entered questions and answers. It is not an external service, it does not send data to any third party and it does not take decisions — where uncertain it passes the question on to the firm.

3.2. Ordering a service and invoicing details

Data: company name, UIC, address, responsible person, e-mail, phone, selected package and amount. Purpose: conclusion and performance of the contract and issuing a tax document. Legal basis: Art. 6(1)(b) (contract) and Art. 6(1)(c) (legal obligation under the Accountancy Act and the VAT Act). Retention: 10 years from the beginning of the year following the year in which the document was issued — Art. 12(1)(3) of the Accountancy Act.

3.3. Client portal

Data: username, e-mail, role, hashed password, two-factor authentication device, date and time of login and logout, IP address, failed login attempts. Purpose: individual and secure access and the ability to establish who did what. Legal basis: Art. 6(1)(b) (performance of the contract) and Art. 6(1)(f) (legitimate interest in the security of the system). Retention: until access is terminated; the audit trail — 12 months.

Passwords are stored only as an irreversible hash and no one at the firm can see them.

3.4. Document exchange

Data: the documents you upload and the data in them, file name, date, version, status, as well as a record of who uploaded, opened or downloaded them and when. Purpose: performance of the accounting service and traceability. Legal basis: Art. 6(1)(b) and Art. 6(1)(c), and for the trail itself — Art. 6(1)(f). Retention: 10 years under Art. 12 of the Accountancy Act and Art. 38 of the Tax and Social Insurance Procedure Code; payrolls — 50 years under Art. 12(1)(1) of the Accountancy Act.

Files are stored encrypted, outside the publicly accessible part of the server, and are reachable only through the application, which checks your permissions and records every action.

3.5. Sending documents by e-mail

When you send documents to the dedicated intake address, the system reads the message, saves the attachments as documents and records the message identifier, the sender and the subject so that the same message is not processed twice. Legal basis and retention: as under 3.4.

3.6. Deadline reminders and consultation booking

Data: name, e-mail, phone (for SMS or Viber), selected time slot. Purpose: to remind you of a statutory deadline and to confirm a consultation appointment. Legal basis: Art. 6(1)(b) for clients under contract; for persons who are not our clients — Art. 6(1)(a) (consent), which may be withdrawn at any time. Retention: 24 months from the event.

3.7. Cookies and website statistics

The details are in the separate Cookie Policy. In short: necessary cookies operate on the basis of Art. 6(1)(f) GDPR and Art. 4a(2) of the Bulgarian Electronic Commerce Act; analytics cookies — only after your consent under Art. 6(1)(a).

4. Data we did not obtain from you

Sometimes we process data of people who did not provide it to us themselves — for example when a client sends us a payroll listing their employees, or an invoice containing the details of one of their counterparties. In those cases, under Art. 14 GDPR:

• the source of the data is our client, who is your employer or counterparty;
• the categories of data are those necessary for accounting and payroll services — names, personal identification number, address, position, remuneration, bank account;
• for this data we are a processor and the controller is the client — see section 2.

5. Who we share data with

We do not sell or rent personal data. We do not provide it for third-party marketing purposes. Access is granted only to the following categories of recipients, each bound by contract and by a confidentiality requirement:

Where a recipient processes data outside the European Economic Area, this is done on the basis of a European Commission adequacy decision or standard contractual clauses under Art. 46(2) GDPR. You may request a copy of the applicable safeguards at the address given above.

Website statistics are kept on our own server and are not shared with any third party.

6. How long we keep data

Once the period expires, data is deleted or irreversibly anonymised. Where proceedings or a dispute have begun, the period is extended until they are finally concluded.

7. Your rights

Under Chapter III of the GDPR you have the right to:

• access — obtain confirmation whether we process your data and a copy of it (Art. 15);
• rectification — request correction of inaccurate data or completion of incomplete data (Art. 16);
• erasure — the “right to be forgotten”, to the extent we are not required by law to keep the data (Art. 17);
• restriction of processing — for example while the accuracy of the data is being verified (Art. 18);
• portability — receive your data in a structured, machine-readable format (Art. 20);
• object — to processing based on legitimate interest (Art. 21);
• withdraw consent — at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3)).

Requests should be sent to info@evropc.net or to the address of management. We respond within one month; where the matter is complex the period may be extended by two months, of which we will notify you. The service is free of charge; for manifestly unfounded or excessive requests a reasonable fee may be charged.

To protect your data, where there is doubt as to the identity of the person making the request, we may ask for additional information to establish it.

8. Right to lodge a complaint

If you believe we process your data unlawfully, you have the right to lodge a complaint with the supervisory authority:

A complaint may be filed in person, by post, electronically with a qualified electronic signature, or through the egov.bg portal. You also have the right to a judicial remedy.

We would be glad if you came to us first — most questions are resolved within days.

9. How we protect data

• the connection to the site is encrypted (HTTPS/TLS);
• uploaded documents are stored encrypted and outside the publicly accessible part of the server;
• access is role-based: everyone sees only what concerns them;
• portal login can be protected with a second factor, and the administration panel requires it;
• repeated failed login attempts lead to a temporary lockout;
• every upload, opening, download and denied access leaves an audit record;
• uploaded files are checked for active content (macros and embedded objects) and refused if any is found;
• passwords are stored only as an irreversible hash.

Audit records do NOT include document contents, passwords or payment card details.

In the event of a security breach likely to result in a risk to your rights, we notify the CPDP within 72 hours and, where the risk is high, you as well, without undue delay.

10. Automated decisions and profiling

We do not take decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR. We do not carry out profiling.

The system recognises the type of a submitted document and suggests data from it, but this is an auxiliary step: every suggestion is checked by an accountant before it produces any result.

The price calculator computes an amount from the parameters you select. It does not assess individuals and does not refuse service.

11. Children

Our services are aimed at legal entities and at persons practising a liberal profession. We do not knowingly collect data of persons under 18. If we identify such data, we delete it.

12. Changes to this policy

This policy may be amended when our activities or the legal framework change. The current version is always published at this address, stating the version number and the effective date.

In the event of a material change we will notify portal users by e-mail at least 14 days in advance.

Version 2.0 · effective 17.08.2026 · replaces version 1.0 of 21.07.2026