Privacy policy
Updated: 12 September 2026
This policy explains how Bulsoft 99 EOOD processes personal data in connection with this company website and inquiries sent to us.
Who is responsible
The controller is Булсофт 99 ЕООД (Bulsoft 99 EOOD), UIC 206399985, Voivodinovo, Plovdiv 4135, Bulgaria, represented by Georgi Cholakov. For privacy questions and rights requests: privacy@bulsoft99.com.
Visiting the website
This site has no analytics tools, advertising pixels, tracking cookies or remotely loaded fonts. The page address determines the language. Animations respect your device’s reduced-motion preference. We do not create user profiles or make automated decisions about you.
Contact and inquiries
The form sends your name, phone number or email, the chosen website type and your message to a function we run on Google Cloud (Firebase), which forwards them as an email to hello@bulsoft99.com. Nothing is written to a database; to prevent abuse, the function briefly keeps a count of requests per IP address in memory (up to one hour). If sending fails, the form offers to send the same text from your own email application instead. We use the information to reply, discuss your project and, where appropriate, prepare a proposal. Please do not include sensitive personal data or confidential information in an initial inquiry.
Legal bases
For steps you request before entering into a contract and for fulfilling a contract, we rely on GDPR Article 6(1)(b). For general business correspondence and website security, we rely on legitimate interests under Article 6(1)(f), taking your rights into account. For mandatory accounting and other legal duties, we rely on Article 6(1)(c). Visiting this site or making an inquiry does not constitute consent to marketing.
Hosting and service providers
The public website is served through Google Firebase Hosting. When serving the site, the provider may process IP addresses and request metadata to deliver content and prevent abuse. Firebase states that Hosting retains IP data for a few months. Our email provider also processes correspondence. Access is limited to people and providers who need it for the relevant service, and competent authorities where required by law. We do not sell personal data.
International processing
Google operates global infrastructure and may process data outside the EEA. Applicable transfer mechanisms are governed by the provider’s data processing terms and GDPR requirements, including standard contractual clauses where required. You can request information about the applicable safeguards using our contact email.
Retention
Inquiry correspondence is retained for up to 24 months after the last contact unless a project begins or longer retention is necessary for a legal obligation or dispute. Contract and accounting records are retained for the legally applicable periods. Data is deleted when the reason for retaining it ends. Infrastructure data retention also depends on the relevant provider.
Your rights
Subject to the GDPR, you may request access, correction, deletion, restriction and portability, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting previous lawful processing. Contact privacy@bulsoft99.com. We normally respond within one month. Complexity or the number of requests may justify an extension of up to two further months; we will explain this within the first month.
Complaints and changes
You can complain to the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, or to a supervisory authority where you habitually live, work or where an alleged infringement occurred. We update this page and its date when practices change. Using the site is not a substitute for consent where consent is required.
Questions? Get in touch.
privacy@bulsoft99.com