User Data Privacy Notice

Your personal data is processed by XOUNOX as the data controller. The company's commercial register number (ЕИК) can be found in the Seller Information section of the Pre-Contract Information page. For any requests relating to data protection, you can write to [email protected].

Depending on how you use our services, the following categories of data may be processed:

• Identity data: First name, last name
• Contact data: Email, telephone number, address
• Customer transaction data: Listing, favourite, saved search, messaging and request records
• Transaction security data: IP address, device and browser information, log records
• Marketing data: Cookie records, interests and habits

Your personal data is processed for the purposes of carrying out membership procedures, providing listing and consultant services, responding to your requests, ensuring the security of the Site, fulfilling legal obligations, measuring service quality and, where you have given your consent, carrying out promotional and marketing activities.

The valuation and recommendation features involve automated analysis. However, no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you is made (GDPR Art. 22).

Your data is collected through membership forms, listing and contact forms, cookies, the mobile application and support channels. Legal bases: the conclusion or performance of a contract (GDPR Art. 6(1)(b)), compliance with a legal obligation (Art. 6(1)(c), for example accounting and tax legislation), legitimate interest (Art. 6(1)(f), for example Site security and fraud prevention) and consent (Art. 6(1)(a), for example marketing messages and non-essential cookies).

Your personal data may be transferred to the consultants and real estate offices to which you send a request (these offices are separate data controllers for their own processing), to our hosting, email, SMS, payment (Stripe) and analytics service providers (as data processors under GDPR Art. 28), to our group companies and, where there is a legal obligation, to the competent authorities (for example НАП, courts, КРС). Transfers outside the European Economic Area are made only with the safeguards set out in GDPR Arts. 44-49 (adequacy decision, standard contractual clauses). You can request a copy of the safeguards at [email protected].

Your data is retained for as long as the purpose of processing requires or until the statutory retention period expires, after which it is deleted or anonymised. Examples: account data until the account is closed; invoice and accounting records for 10 years under Article 12 of the Закон за счетоводството; access logs kept for security purposes for a maximum of 12 months. Administrative and technical measures (encryption, access authorisation, network security) are applied to protect your data (GDPR Art. 32).

As a data subject, you have the following rights:

• Access to your personal data and obtaining a copy of it (GDPR Art. 15)
• Requesting the correction of inaccurate or incomplete data (Art. 16)
• Requesting the erasure of your data (Art. 17)
• Requesting the restriction of processing (Art. 18)
• Receiving and transferring your data in a structured, machine-readable format (Art. 20)
• Objecting to processing based on legitimate interest and to direct marketing (Art. 21)
• Not being subject to decisions based solely on automated processing (Art. 22)
• Withdrawing your consent at any time (Art. 7(3))
• Lodging a complaint with the Комисия за защита на личните данни (КЗЛД; бул. „Проф. Цветан Лазаров\" № 2, София 1592; [email protected]; www.cpdp.bg) or with the data protection authority of the EU country in which you reside (Art. 77)

You can submit your requests concerning your rights through the relevant section of your account, by email to [email protected] or in writing. Where we have reasonable doubts about your identity, we may request additional verification. Applications are free of charge and will be answered within one month at the latest. Due to the complexity or number of requests, this period may be extended by a further two months, with notice to you (GDPR Art. 12(3)).

For any questions, requests and applications relating to this text, you can send an email to [email protected] or use the form on our Contact page.