Personal data
Privacy
policy
Your data. Your rights. Clear information.
Updated on 14 October 202601Data controller and contact
This policy describes personal data processing through vinitsaforest.bg and communications about the Vinitsa Forest project. Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act apply.
Data controller: „ВИНИЦА ФОРЕСТ“ ООД
Company registration number (EIK): 206566644
Registered office and address: 22 Bacho Kiro St., Varna, Bulgaria
Contact for personal data enquiries and requests: cargonbg@gmail.com, +359 889 776 543.
02What data we process
When you contact us by phone or email, we process the contact details you provide, the content of your enquiry and related correspondence. Please do not send personal identification numbers, copies of identity documents or sensitive data through a general enquiry.
Consultation and purchase enquiry forms process your name, phone number, email, message, selected apartment and parking space, if added. The data is used to respond and communicate with you. When email delivery is enabled, the enquiry is sent to the team and a confirmation is sent to the visitor. An enquiry is not a contract, payment or guaranteed reservation.
Visits may involve processing your IP address, request time and URL, browser, operating system and technical request outcome to provide and protect the website. The application does not store form content in its own permanent log. To limit repeated submissions, it temporarily uses an email hash and request identifier within a 10-minute window; expired entries are cleared on subsequent requests or a process restart.
03Purposes and legal bases
We use the data to respond to enquiries, arrange a conversation and provide requested information about apartments. Where an enquiry concerns a possible purchase, the legal basis is taking steps at your request before entering into a contract — Article 6(1)(b) GDPR.
General correspondence and technical protection rely on the legitimate interest in answering received messages, preventing abuse and maintaining security under GDPR Article 6(1)(f). Processing to meet applicable legal obligations relies on Article 6(1)(c). We process only necessary data and respect your right to object.
Sending an enquiry does not constitute consent to a marketing newsletter. If consent-based marketing is introduced, it will have a separate opt-in and a way to withdraw consent.
04Recipients and service providers
Access is provided only as needed to authorised persons and hosting, email and technical support providers. Data may also be disclosed to competent authorities where legally required.
The technical infrastructure is designed for Vercel to host and run the website, Resend to deliver enquiries and confirmations when email delivery is enabled, and Google/Gmail to receive and handle correspondence at cargonbg@gmail.com. Only data needed for each service is transmitted. Provider terms and policies are available through the links below.
05Transfers outside the EEA
Using international providers may involve processing outside the European Economic Area, including in the United States. Resend states that customer data is stored in the US. Vercel and Google also describe international processing. Published provider terms provide for applicable safeguards such as Standard Contractual Clauses and, where applicable, adequacy decisions. Documents are linked below; you may request information about safeguards for your data using the contact email.
06Retention periods
Enquiries and related correspondence are retained for up to 12 months after the last contact when no contract is concluded. After that period they are to be deleted or anonymised. If a contract is concluded, necessary documents are retained for applicable statutory periods. In a dispute or legal claim, relevant data may be retained until the matter and applicable limitation periods end; this does not justify retaining unrelated data.
Operational technical records for website execution and enquiry delivery are limited to 30 days, with any shorter retention period of the selected plan taking precedence. Resend specifies 30 days for emails and logs on its standard plans. Vercel publishes different runtime-log periods by plan, up to 30 days with extended observability. The website does not maintain a separate permanent archive of form content.
07Your rights
Subject to applicable legal conditions, you may request access, rectification, erasure, restriction or portability of your data. You may object to processing based on legitimate interests and withdraw consent, without affecting the lawfulness of prior processing.
Send your request to cargonbg@gmail.com. We normally respond within one month; if a permitted extension is needed, we will notify you. Where necessary, we may request proportionate information to confirm your identity.
08Right to lodge a complaint
You may lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) or another competent supervisory authority, without first contacting us.
CPDP: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria. Official information and submission methods: cpdp.bg.
10Providing data and policy changes
Providing enquiry data is voluntary. Without the necessary contact details, we cannot respond. The website is not intended to collect children’s data. The communication described here does not involve automated decisions producing legal or similarly significant effects.
The policy is updated when functionality or processing changes. The current version is published on this page.