Privacy Policy
Effective from: 14 October 2026
This Privacy Policy describes how "BulGhar Homes" collects, uses, stores and protects the personal data of visitors to bulgharhomes.com, users of the client portal, and clients of the agency. The policy is drafted in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR) and the Bulgarian Personal Data Protection Act.
1. Data Controller
The controller of personal data is:
"BulGhar Homes"
Registered address: Varna, 20 Chataldzha Str., entr. A, apt. 7
Manager: Raffy Nikoghosyan
Email: r.nikoghosyan@bulgharhomes.com
Phone: +359 879 333 822
The company is not registered under the Bulgarian VAT Act.
2. What Personal Data We Collect
Depending on how you interact with us, we process the following categories of data:
a) Inquiry data. When you contact us through the contact form, by email or by phone, we collect your name, email address, phone number and the content of your inquiry.
b) Client portal data. For clients with a portal account, we process name, email, phone, deal status, deal-related documents, messages exchanged through the portal, and information about scheduled viewings.
c) Property transaction data. When entering into a brokerage agreement and when preparing property transactions, we process identification data, including national ID number (EGN) and identity-document data, where required by law (for example, for identification purposes under the Anti-Money Laundering Measures Act or for preparing transaction documents).
d) Technical data and cookies. When you visit the site, our analytics tools collect technical data such as IP address, device and browser type, pages visited, and approximate location. Details are described in Section 8.
e) Newsletter. If you subscribe to the newsletter on prices by district in Varna, we process your email address, the page you subscribed from, the date and wording of your consent, the date you confirmed and, if you unsubscribe, the date you unsubscribed. The subscription becomes active only after you confirm your address through the link in our email.
f) Client register data. When we communicate with you as a buyer, seller, landlord, tenant or partner, we keep a register with your name, phone, email, your role, the property you are looking for or offering, short notes from our conversations, agreed next steps, the stage of the transaction and the agreed fee. The register does not contain your personal identification number, identity document details or address.
g) Messages through Messenger, Instagram, WhatsApp and TikTok. When you write to us on these channels, we receive your name or username, the text of your messages and any attachments. Details are described in Section 7.
h) Accommodation list in Burgas. When you sign up through the form on the "Eurovision 2027" page, we process: the name we should address you by, your phone number (and a tick showing whether you use WhatsApp), your email address, your country, the language of the page, the answers from the second step of the form (number of people, dates, whether you have a ticket, budget per person per night, preferred area and a short note if you wish), the text of the consent with its version and the time you gave it, and where you came to the form from (the label of the link through which you reached the page). The country is the one you chose with the phone code or, if missing, an approximate location based on your connection, determined by Cloudflare. We do not keep your IP address or your browser data in the list entry. The IP address is used only to limit the number of attempts to the form, as a short-lived technical counter that is cleared automatically. Bot protection (Cloudflare Turnstile) checks your browser when you submit the form. The form does not use cookies. Please do not enter your national ID number (EGN) or identity-document numbers in the note.
3. Purposes and Legal Bases for Processing
We process personal data on the following bases under Art. 6 of the GDPR:
Performance of a contract (Art. 6(1)(b)): to enter into and perform a brokerage agreement for the purchase, sale or lease of real estate, to arrange viewings, communicate about deals and provide access to the client portal, including taking steps at your request prior to entering into a contract.
Legal obligations (Art. 6(1)(c)): real estate agencies are obligated entities under Art. 4 of the Anti-Money Laundering Measures Act and must identify and verify their clients, including collecting identity-document data. We also process data to fulfil accounting and tax obligations under the Accounting Act and the Tax and Social Insurance Procedure Code.
Legitimate interest (Art. 6(1)(f)): to protect legal claims, prevent abuse, ensure the security of the site and portal, and for internal business analysis. We also keep a register of our communication with clients and partners, so that we deliver what we agreed with you and do not miss a promised step.
Consent (Art. 6(1)(a)): to send marketing communications, to use non-essential cookies and analytics tools, and to contact you in connection with the accommodation list in Burgas (point 2(h)). For the list, the purpose is only to contact you with accommodation options in Burgas for 10 to 16 May 2027. Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.
4. Retention Periods
We keep personal data only for as long as necessary for the purposes for which it was collected, or as required by law:
• Documents and data collected for AML purposes: 5 years from termination of the client relationship or from completion of the transaction;
• Accounting documents and records for tax control: up to 10 years under the Tax and Social Insurance Procedure Code and the Accounting Act;
• Data from inquiries that did not lead to a contract: up to 1 year from receipt of the inquiry;
• Inquiries for accommodation of guests in Burgas (waiting list for 10 to 16 May 2027): up to 30 September 2027; you can delete your entry earlier (Section 9); entries marked as filled in automatically by a bot are kept for up to 30 days;
• Newsletter email address: for as long as you are subscribed; an unconfirmed address is deleted after 30 days, and an address is deleted 30 days after you unsubscribe;
• Client register data for persons with whom no contract was concluded: up to 12 months after the last contact; where a contract or transaction was concluded: for the AML or accounting retention period, whichever is longer;
• Client portal data: for the term of the contractual relationship and any applicable statutory periods thereafter.
After the relevant period expires, data is deleted or anonymized.
5. Recipients of Personal Data
We share personal data only when necessary to perform a contract, comply with a legal obligation, or for the purposes stated above, with the following categories of recipients:
• Notaries, when closing real estate transactions;
• Banks, when arranging payments and financing for transactions;
• Accountants servicing the company;
• DocuSign, for electronic signing of documents;
• Cloudflare, as our hosting, site-security and database provider; the client register is stored in the European Union;
• ExchangeRate-API (open.er-api.com), from which the Dubai pages load the dirham exchange rate; the browser connects directly and passes only the technical data of the request, such as the IP address;
• Resend, for sending email notifications from the portal, the newsletter and the confirmation when you sign up to the accommodation list, including storing the subscriber list;
• Google (Google Analytics, Google Ads and Google Workspace), for web analytics, for measuring the performance of our Google ads and for company email;
• Apple (iCloud Drive), for storing and syncing the company's working files;
• Meta (Meta Pixel), for measuring ad performance;
• Microsoft (Clarity), for analyzing on-site user behavior;
• Stripe, for processing payments for requested services;
• A partner brokerage firm in Dubai, when you have requested an offer for a property in Dubai, receiving only the data needed for the offer and the registration;
• Invoice BG (inv.bg), for issuing invoices, including name, address and personal identification number where the invoice is issued to an individual.
We use providers that offer data-processing terms under Art. 28 of the GDPR. Data may also be disclosed to competent state authorities (e.g. the State Agency for National Security, the National Revenue Agency) where required by law.
6. Transfers of Data Outside the EU/EEA
Some of our providers (e.g. Google, Meta, Microsoft, DocuSign, Cloudflare, Resend, Apple) may process data on servers outside the European Union and the European Economic Area, including in the United States. In such cases, transfers take place under appropriate safeguards per Chapter V of the GDPR, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or an adequacy decision (including the EU-US Data Privacy Framework for certified providers). A copy of the applicable safeguards may be requested at the contact email above. When you enquire about a property in Dubai, your data is transferred to the United Arab Emirates, for which there is no adequacy decision. The transfer is based on Article 49(1)(b) GDPR, as it is necessary to carry out what you have requested.
7. Messages through Messenger, Instagram, WhatsApp and TikTok
When you write to us on Messenger or Instagram (the BulGhar Homes page on Facebook and our Instagram profile), on WhatsApp or on TikTok, we process your messages as an inquiry. This section supplements Sections 2 to 6 and 9.
a) What data we receive.
• your profile name or username;
• a phone number, where the channel passes it on (WhatsApp);
• a conversation identifier, a technical number the platform uses to link the messages in one conversation;
• the text of the messages and the attachments you send us (photos, documents, voice messages);
• the time of each message.
b) Why we process it. To reply to your property inquiry and to arrange viewings. The legal bases are taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) and legitimate interest (Article 6(1)(f)): to answer inquiries through the channel you have chosen and to be able to follow the conversation.
c) Where the conversation stays. The messages remain in the systems of Meta (Messenger, Instagram, WhatsApp) and of TikTok, under the terms and privacy policies of the respective platform. We do not sell this data and we do not pass it to third parties for advertising.
d) What we record on our side. In the client register we record only short notes from the conversation (for example, what property you are looking for and the agreed next steps). Your personal identification number, identity document details and address are not recorded, as described in Section 2(f). Please do not send your personal identification number or photos of identity documents through these channels.
e) Automated means. The "BulGhar Homes Publisher" app, which we use with Meta, may notify us of a new message and prepare a draft reply. No reply is sent without approval by a person (Raffy Nikoghosyan). We do not take decisions that have legal effect on you based solely on automated processing.
f) Retention periods. We keep inquiries that did not lead to a contract for up to 1 year from receipt. Exception: we keep inquiries for accommodation of guests in Burgas (waiting list for 10 to 16 May 2027) up to 30 September 2027. We keep client register data for persons with whom no contract was concluded for up to 12 months after the last contact. Where a contract was concluded, the periods in Section 4 apply.
g) Your rights. You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to file a complaint with the Commission for Personal Data Protection (CPDP, Комисия за защита на личните данни). You exercise them as set out in Section 9. How to ask us to delete your data is described on a separate page: How to request deletion of your data.
8. Cookies and Analytics Tools
The site uses cookies and similar technologies. Strictly necessary cookies provide the core functionality of the site and portal. Analytics and marketing tools load based on your consent and include:
| Tool | Provider | Purpose |
|---|---|---|
| Google Analytics 4 | Google Ireland Ltd. | Site traffic statistics: visitor counts, pages viewed, traffic sources. |
| Microsoft Clarity | Microsoft Corp. | Analysis of on-site user behavior (heatmaps, session recordings) to improve the site. |
| Google Ads | Google Ireland Ltd. | Measuring how our Google ads perform: whether a visit came from an ad and whether it led to an enquiry. It loads in consent mode: without your consent no cookies are written and no identifiers are collected, and only anonymous signals reach Google, with nothing that identifies you. |
| Meta Pixel | Meta Platforms Ireland Ltd. | Measuring the performance of Facebook and Instagram ads and showing relevant ads. |
You can manage cookies through your browser settings, including deleting or blocking them. Blocking some cookies may limit the site's functionality.
9. Your Rights
As a data subject, you have the following rights under the GDPR:
• the right to access your personal data and information about its processing;
• the right to rectify inaccurate or incomplete data;
• the right to erasure ("right to be forgotten"), where there is no legal basis for further retention;
• the right to restrict processing;
• the right to data portability, for data you provided and which is processed automatically on the basis of a contract or consent;
• the right to object to processing based on legitimate interest, including direct marketing;
• the right to withdraw your consent at any time.
To exercise your rights, contact us at r.nikoghosyan@bulgharhomes.com. We will respond within one month of receiving your request.
Accommodation list in Burgas. You can also delete your entry yourself, without writing to us: the link "Delete the entry here" in the confirmation you receive by email, if you gave an email address, opens a page with a button that deletes your entry immediately. You can also email us at the address above. You can withdraw your consent in the same way.
If you believe your rights have been violated, you have the right to file a complaint with the Commission for Personal Data Protection (CPDP): 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria; website: www.cpdp.bg.
10. Data Security
We apply appropriate technical and organizational measures to protect personal data, including encryption of the connection to the site and portal (HTTPS/TLS), encryption of stored documents, restricted access to data limited to persons who need it to perform their duties, and regular review of security measures. In the event of a security breach likely to result in a high risk to your rights, we will notify you in accordance with GDPR requirements.
11. Contact and Changes to This Policy
For questions about this policy and the processing of your personal data, you can contact us at r.nikoghosyan@bulgharhomes.com or by phone at +359 879 333 822.
We reserve the right to update this policy in the event of changes to our business or applicable law. The current version is always published on this page, together with its effective date. In the event of material changes, we will notify registered portal users in an appropriate manner.