1. Personal Data Controller
The personal data controller is the legal entity that operates the velesstroy.org website, organises sales for the VELES I project, and determines the purposes and means of personal data processing.
In this Policy, the above-mentioned entity is hereinafter referred to as the “Controller”.
2. Applicable Law
Personal data is processed in accordance with Regulation (EU) 2016/679 (GDPR), the Personal Data Protection Act of the Republic of Bulgaria, and other applicable requirements of European Union and Bulgarian law.
3. Personal Data We Process
Depending on how you interact with the website and the project, we may process:
- phone number;
- first and last name;
- email address;
- selected townhouse, price range of interest, and configuration;
- preferences regarding townhouse customisation, finishing, and additional options;
- preferred time for an online tour, phone call, or meeting;
- the content of correspondence and the history of interactions with the manager;
- data and documents voluntarily provided during reservation, preparation, or completion of a transaction;
- technical data relating to website visits, to the extent described in the Cookies section.
4. Purposes and Legal Bases for Processing
We may use personal data for:
- responding to user enquiries and contacting the user;
- providing information about VELES I, available townhouses, prices, and purchase terms;
- organising online tours of the site and construction progress;
- discussing individual townhouse customisation and finishing options;
- processing reservations and preparing transaction documents;
- providing legal support and arranging the transfer of ownership;
- fulfilling contractual and statutory obligations;
- ensuring website security and protecting the Controller’s legitimate interests.
Legal bases under Article 6 GDPR
- Art. 6(1)(b) — taking steps at the user’s request prior to entering into a contract and performance of a contract;
- Art. 6(1)(c) — compliance with the Controller’s legal obligations;
- Art. 6(1)(f) — the Controller’s legitimate interests, including website security and the protection of legal claims;
- Art. 6(1)(a) — user consent where required, for example for optional analytics or marketing cookies.
5. Contact Forms
When a user voluntarily submits a phone number or other data through a form on velesstroy.org, that data is used to fulfil the user’s request: contacting the user, selecting a townhouse, discussing purchase terms or townhouse customisation, or arranging an online tour.
Refusing optional cookies does not prevent the processing of data that the user voluntarily submits through a form in order to receive requested services or information.
6. Cookies and Technical Data
Technically necessary cookies may be used, and technical information such as IP address, device type, browser, visit time, and technical identifiers may be processed to ensure the proper operation and security of the website.
Optional analytics or marketing cookies are used only where there is an appropriate legal basis and, where required, after the user makes a choice in the website’s cookie banner.
Clicking “Reject” applies to optional cookies and does not disable technically necessary mechanisms required for the website to function.
7. Recipients of Personal Data
Where necessary, personal data may be accessible to:
- employees and authorised representatives of the Controller;
- VELES I project managers;
- lawyers, notaries, translators, and other professionals involved in completing the transaction;
- construction and engineering contractors, where necessary to coordinate individual solutions;
- providers of website, hosting, email, CRM, and technical support services;
- state and municipal authorities where disclosure is required by law.
The website may use the technical infrastructure of third-party providers, including the Tilda platform. Personal data is not sold to third parties.
8. Transfers Outside the European Economic Area
If a digital service provider processes data outside the European Economic Area, the transfer is carried out using a safeguard mechanism provided for under the GDPR, such as an adequacy decision or Standard Contractual Clauses.
9. Retention Period
Personal data is retained only for as long as necessary for the purposes for which it is processed. Data relating to prospective buyers may be retained for the duration of communications and negotiations concerning the project.
If a contract is entered into, data and documents may be retained for the duration of the contractual relationship and thereafter for the periods required under applicable Bulgarian accounting, tax, civil, and other legislation, as well as for the period necessary to establish, exercise, or defend legal claims.
10. User Rights
Where provided for under the GDPR, the user has the right to:
- receive information about the processing of their personal data and access such data;
- request correction of inaccurate data;
- request erasure of personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- receive data in a portable format where the right to data portability applies;
- withdraw consent where processing is based on consent;
- lodge a complaint with the competent supervisory authority.
To exercise these rights, the user may contact the Controller using the contact details specified in Section 1 of this Policy.
11. Personal Data Security
The Controller applies reasonable technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure, or destruction.
12. Changes to This Policy
This Policy may be updated if legislation, the project structure, the services used, or the methods of data processing change. The current version is published on velesstroy.org.
