EN

Personal data protection

PERSONAL DATA PROTECTION POLICY OF BMC INVEST LTD

1. Introduction
This Personal Data Protection Policy aims to inform all clients, contractors, website visitors and other data subjects what personal data BMC INVEST LTD (hereinafter referred to as the "Company") collects, how it processes it, on what grounds and for what purposes, as well as what your rights are under the applicable national and European legislation on personal data protection - Regulation (EU) 2016/679 ("GDPR") and the Personal Data Protection Act.

2. Data about the administrator
Personal data administrator:
BMC INVEST LTD
UIK: 204357902
Head office and management address: city of Burgas, p.k. 8000, Slaveykov residential district, Northern industrial zone, MASTERHAUS hypermarket
Email: office@bmc-invest.com
Phone: 0876 55 00 50
Website: www.bmc-invest.com

3. Categories of data subjects
This policy applies to Buyers and sellers of real estate; Representatives of legal entities - clients and partners; Visitors to the website and social profiles of the company; Job applicants and employees.

4. Types of personal data we collect
Depending on the specific relationship with you, we may collect the following categories of personal data:

  • Identification data: Name, surname, PIN/LNF (when required by law); ID card data: number, date of issue, validity, issuer;
  • Contact data: Email address, telephone number, permanent or current address;
  • Data regarding real estate transactions: Property preferences, location, area, price, status; Contractual terms (date, term, deposit, payments); Data from notarial deeds or powers of attorney;
  • Financial data: Bank account (IBAN); Payment information, due amounts, invoicing;
  • Online activity data: IP address, device used, cookies, user sessions (when using a website);
  • Sensitive data: We do not collect special categories of personal data (e.g. health, religion), unless required for a specific purpose and with the appropriate basis and consent.

5. Purposes of processing
We process your personal data for the purpose of:

  • Performing intermediary activities in the purchase, sale and/or rental of real estate;
  • Preparing and administering contracts with clients;
  • Fulfilling legal obligations (e.g. under the Law on the Sale and Purchase of Real Estate, the Civil Code, the Civil Code);
  • Issuing invoices, keeping accounts and submitting tax returns;
  • Conducting inspections, consultations and other actions related to a real estate transaction;
  • Marketing communications and sending current offers (only with consent);
  • Protecting the legitimate interests of the Company - including in court, arbitration or administrative disputes.

6. Legal basis for processing
The company processes personal data on one or more of the following legal grounds:

  • Art. 6, para. 1, b. "b" of the GDPR - when the processing is necessary for the performance of a contract or to take steps at the request of the subject prior to entering into a contract;
  • Art. 6, para. 1, b. "c" of the GDPR - in compliance with a legal obligation;
  • Art. 6, para. 1, b. "f" of the GDPR - in the presence of a legitimate interest that does not override the rights and freedoms of the subject;
  • Art. 6, para. 1, b. "a" of the GDPR - based on the explicit consent of the subject.

7. Data storage period
We store your personal data for the following periods:

  • Up to 10 years after the conclusion of a transaction - under the Accounting Act and other regulatory requirements;
  • Up to 5 years - for proving legal grounds and protection from claims;
  • Until withdrawal of consent - when processing based on consent;
  • Up to 6 months - for applying for a job, if no contract has been concluded.

8. Categories of recipients of personal data
We may provide your personal data to the following categories of third parties, when necessary and permissible: Notaries, lawyers and bailiffs; Accounting and auditing firms; State and control authorities (NA, KPKONPI, CPDP, court); Postal and courier companies, hosting and IT service providers; Banks and payment institutions.

Data is not transferred to third countries outside the European Union and the EEA, unless necessary and with adequate guarantees.

9. Automated decision-making and profiling
We do not carry out automated decision-making, including profiling, which would produce legal consequences for you.

10. Your rights
You have the following rights under the GDPR:

  • Right of access to your personal data
  • Right to rectification of inaccurate or incomplete data
  • Right to erasure ("to be forgotten") - under certain conditions
  • Right to restriction of processing
  • Right to data portability
  • Right to object to processing based on legitimate interest
  • Right to withdraw your consent at any time (if we rely on it)

To exercise your rights, please contact us via office@bmc-invest.com or by letter to the company address.

11. Data Security
We implement appropriate technical and organizational measures to protect personal data from accidental or unlawful destruction, loss, unauthorized access, modification or dissemination (access control, staff training, contracts with personal data processors).

12. Complaints to a supervisory authority
If you believe that we are violating your rights, you can file a complaint with:
Personal Data Protection Commission
Sofia, bul. "Prof. Tsvetan Lazarov" № 2
website: https://www.cpdp.bg
phone: 02 915 35 18
email: kzld@cpdp.bg

13. Policy changes
The company reserves the right to update this policy in the event of changes in legislation or internal processes. Changes will be announced via our website or in another appropriate manner.

Last update date: 01.07.2025