Customer Representative Data Privacy Notice
Sample text; requires legal review. This text should be reviewed by a lawyer before it is published.
This notice on the processing of personal data of the representatives and employees of real estate agencies, property developers and other corporate customers that enter into a business relationship with XOUNOX (“Imotilist”) has been prepared in accordance with GDPR Art. 13-14 and the ЗЗЛД.
This notice covers customer representatives who open a corporate account or sign a contract with Imotilist, and the representatives acting on their behalf. For individual users, the User Data Privacy Notice applies.
1. Data Controller and Scope
The data controller is XOUNOX. This notice covers natural persons whose information is collected in the capacity of customer representative, authorised signatory, corporate account administrator, invoice contact and system user.
With respect to the data of the office's own customers that the office enters into the CRM, the office is the data controller and Imotilist is the data processor acting on behalf of the office (GDPR Art. 28). This relationship is governed by a separate data processing agreement.
2. Personal Data Processed
The following data may be processed within the scope of the corporate relationship:
- Identity and contact details (first and last name, job title, corporate email, phone)
- Authority and representation documents (Търговски регистър entry, power of attorney / пълномощно)
- Tax and financial information (ЕИК, VAT / ДДС number, invoice and payment records)
- Corporate account usage logs and transaction security information
- Request and correspondence records (email, support, form)
3. Purposes of Processing
Your data is processed for the purposes of managing customer relationships, concluding and performing contracts, opening and authorising corporate accounts, invoicing and collection, verifying authority, providing service notifications and responding to support requests.
4. Collection Method and Legal Bases
Your data is collected through the corporate application form, contract processes, and email and telephone communications. Processing is based on the performance of a contract (GDPR Art. 6(1)(b)), a legal obligation (Art. 6(1)(c): Закон за счетоводството, Закон за данък върху добавената стойност), legitimate interest (Art. 6(1)(f): communication with the legal entity customer and verification of authority) and, where necessary, consent (Art. 6(1)(a)).
5. Transfer of Data
Your data may be transferred to accounting and audit service providers, the payment institution (Stripe), cloud service providers, group companies and legally authorised authorities (Национална агенция за приходите (НАП), courts, etc.). Transfers outside the EEA are made with the safeguards set out in GDPR Art. 44-49.
6. Retention Period and Security
Accounting records and invoices are retained for 10 years under Закон за счетоводството чл. 12 ал. 1 т. 2, and other accounting documents are retained for 3 years under т. 3 (the periods begin on 1 January of the year following the relevant period). Other data is retained after the end of the business relationship for the duration of the limitation period for potential claims. At the end of the period, data is deleted or anonymised. Technical and administrative measures are applied against unauthorised access.
7. Your Rights and How to Apply
Under GDPR Art. 15-22 you have the rights of access, rectification, erasure, restriction, data portability and objection, as well as the right to lodge a complaint (Art. 77) with the Комисия за защита на личните данни (КЗЛД, www.cpdp.bg). Requests are answered within one month.
For any questions, requests or applications relating to this text, you can send an email to [email protected] or use the form on our Contact page.