Last updated: 25 August 2026
Plan Bulgaria is committed to protecting your privacy and handling personal data transparently, securely and in accordance with applicable data protection law, including Regulation (EU) 2016/679 (the General Data Protection Regulation — GDPR) and applicable Bulgarian data protection legislation.
This Privacy Policy explains how we collect, use, disclose, retain and protect personal data when you visit our website, contact us, schedule a meeting, enquire about our services or become a client.
1. Who we are
The data controller is:
Plan Bulgaria, operated by Plan Bulgaria EOOD
UIC/EIK: 207049151
Registered office: Stara Stena Street 1, fl. 5, ap. 14, 1164 Bulgaria
Website: planbulgaria.com
Email: [email protected]
Telephone: +359 878 842 662
For privacy-related questions or requests, please contact us at [email protected] with “Privacy Request” in the subject line.
2. Scope of this Policy
This Policy applies to personal data processed in connection with:
- visits to planbulgaria.com;
- enquiries submitted through our contact forms;
- telephone, email and other communications with us;
- meetings scheduled through our online booking system;
- consultations and prospective client discussions;
- client onboarding and delivery of professional services;
- business relationships with suppliers, partners and professional advisers; and
- other interactions with Plan Bulgaria where we determine the purposes and means of processing personal data.
Where a specific engagement requires different or additional processing, we may provide a separate privacy notice, contractual provision or data-processing agreement.
3. Personal data we may collect
Website and technical information
When you visit our website, technical information may be processed automatically, including your IP address, browser type, device type, operating system, referring pages, pages visited, date and time of access, security information and similar technical data.
We use this information to operate, secure, maintain and improve the website.
Contact enquiries
If you submit our contact form or otherwise contact us, we may collect:
- your name;
- email address;
- telephone number;
- subject of your enquiry;
- information included in your message; and
- subsequent correspondence with you.
Please do not submit sensitive personal information through the general contact form unless it is necessary for your enquiry.
Meeting bookings
If you schedule an introductory call or other meeting, we may process information such as:
- name;
- email address;
- telephone number, where provided;
- time zone;
- selected date and time;
- answers to booking questions;
- meeting notes provided by you;
- calendar and meeting information; and
- technical information required to arrange the meeting.
Our scheduling functionality is currently provided through Cal.com. Where you book a meeting through our Cal.com booking interface, Plan Bulgaria determines the purpose of processing the booking information and Cal.com generally processes the booking information on our behalf in accordance with its applicable data-processing terms.
Meetings may be scheduled through services such as Google Calendar and conducted through Google Meet.
Prospective clients and clients
Because Plan Bulgaria provides corporate, market-entry, legal, investment, real-estate, accounting, administrative and related advisory support, the information required for a particular engagement may be more extensive.
Depending on the requested service, this may include:
- identification and contact details;
- passport or identity-document information;
- nationality and residency information;
- employment or professional information;
- company and corporate ownership information;
- shareholder, director and beneficial-owner information;
- business plans and commercial information;
- financial, banking, accounting or tax information;
- property and transaction information;
- contracts and supporting documentation;
- correspondence with authorities or third parties;
- information required for compliance, due diligence or KYC purposes; and
- other information necessary to evaluate or perform the requested engagement.
We seek to collect only information that is reasonably necessary for the relevant purpose.
If special-category personal data or other particularly sensitive information becomes necessary for a specific engagement, we will process it only where an appropriate legal basis exists and with additional safeguards where required.
4. How we obtain personal data
We primarily obtain personal data directly from you.
Where relevant to an engagement, we may also obtain information from:
- companies or representatives acting on your behalf;
- business partners and professional advisers;
- public registers and official databases;
- governmental and regulatory authorities;
- publicly available sources;
- banks, accountants, lawyers, notaries or other professional service providers; or
- another person who refers or introduces you to us.
Where required by law, we will provide the additional information required under Article 14 GDPR when personal data is obtained from another source.
5. Why we process personal data
We process personal data only where we have a lawful basis.
Enquiries and pre-contractual discussions
We process information to answer your enquiry, understand your requirements, arrange consultations, prepare proposals and take steps requested by you before entering into an agreement.
Legal basis: Article 6(1)(b) GDPR — steps taken at your request before entering into a contract; and, where appropriate, Article 6(1)(f) — our legitimate interest in responding to business enquiries.
Client services
We process personal data to enter into, administer and perform agreements and provide the services requested from Plan Bulgaria.
Legal basis: Article 6(1)(b) GDPR.
Legal and regulatory compliance
We may process personal data where necessary to comply with applicable legal obligations, including accounting, tax, corporate, regulatory, record-keeping, court, sanctions or compliance obligations.
Legal basis: Article 6(1)(c) GDPR.
Business administration and protection
We may process information for invoicing, accounting, internal administration, cybersecurity, fraud prevention, maintaining records, establishing or defending legal claims, managing suppliers and protecting our business.
Legal basis: Article 6(1)(f) GDPR — our legitimate interests in operating and protecting our business, provided those interests are not overridden by your rights and freedoms.
Scheduling and communications
We process contact and scheduling information to arrange meetings, communicate with you and manage our professional relationship.
Legal basis: Article 6(1)(b) and/or Article 6(1)(f) GDPR.
Marketing communications
Where we send optional marketing communications that require consent, we will do so only after obtaining appropriate consent.
You may withdraw marketing consent at any time.
Legal basis: Article 6(1)(a) GDPR where consent is required.
Cookies and similar technologies
Where cookies or similar technologies require consent, we process information on the basis of your consent.
Further information is available in our Cookie Policy.
6. When providing information is required
Certain information may be necessary for us to:
- answer your request;
- schedule a meeting;
- prepare a proposal;
- enter into or perform a contract;
- comply with legal requirements; or
- provide a particular service.
Where information is required and you choose not to provide it, we may be unable to provide the relevant service or proceed with an engagement.
7. Who we may share personal data with
We do not sell personal data.
We may disclose personal data only where reasonably necessary to:
- hosting, IT, cybersecurity and website service providers;
- scheduling providers, including Cal.com;
- email, calendar and videoconferencing providers, including Google services;
- accountants, auditors, lawyers, notaries and other professional advisers;
- banks and financial institutions;
- translation, administrative and corporate-service providers;
- government bodies, courts, regulators, registries or authorities;
- contractors and specialist consultants assisting with an engagement;
- counterparties where disclosure is necessary to perform an authorised transaction;
- potential successors in connection with a legitimate corporate transaction; or
- other recipients where you instruct or authorise us to make the disclosure.
Recipients receive only the information reasonably necessary for their role.
Where a provider processes personal data on our behalf, we seek to ensure that appropriate contractual and data-protection arrangements are in place.
8. Cal.com and meeting scheduling
Our website may contain an embedded booking interface provided by Cal.com, Inc.
When you schedule a meeting, the information necessary to process the booking is transmitted to Cal.com. For bookings created through our account, Plan Bulgaria generally acts as controller for attendee information and Cal.com acts as a processor on our behalf.
Cal.com is a United States-based service provider and may process information in the United States and through approved subprocessors.
You should avoid entering unnecessary confidential or sensitive information into booking fields.
9. Google services
We may use Google Workspace services for professional communications and administration, including Gmail, Google Calendar and Google Meet.
Information included in correspondence, calendar events and meeting invitations may therefore be processed through Google services.
10. Website chat and external platforms
Our website may provide links or tools that allow you to contact us through external communication platforms, including WhatsApp.
If you choose to use such a service, the relevant platform may process personal data independently under its own privacy terms.
Using an external platform is optional. You may always contact us directly by email instead.
11. International transfers
Some technology providers used by Plan Bulgaria operate outside the European Economic Area, including in the United States.
Where personal data is transferred to a country outside the EEA, we seek to ensure that an appropriate transfer mechanism is used where required, such as:
- a European Commission adequacy decision;
- the EU–US Data Privacy Framework where applicable to the recipient;
- Standard Contractual Clauses approved by the European Commission; or
- another lawful transfer mechanism under Chapter V GDPR.
You may contact us for further information regarding safeguards relevant to a particular transfer.
12. How long we keep personal data
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to satisfy applicable legal, contractual, accounting and regulatory requirements.
As a general framework:
General enquiries and prospective-client communications: ordinarily up to 24 months after the last meaningful interaction, unless there is a reason to retain them longer.
Booking and meeting information: ordinarily up to 24 months after the meeting, unless it becomes part of a client file or is required for another legitimate purpose.
Client engagement files: for the duration of the engagement and an appropriate period afterwards, taking into account contractual, professional, limitation and regulatory requirements.
Accounting records and relevant financial documentation: retained for the period required by applicable Bulgarian accounting and tax legislation.
Legal claims and disputes: retained for as long as reasonably necessary to establish, exercise or defend legal claims.
When personal data is no longer required, we delete, anonymise or securely archive it as appropriate.
13. Security
We take reasonable technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, misuse or destruction.
Measures may include access restrictions, authentication controls, secure hosting, encrypted communications where appropriate, backups, security updates, vendor controls and internal confidentiality requirements.
No method of transmission or storage can provide absolute security. We therefore continually review our measures in light of the nature of the data and relevant risks.
14. Your GDPR rights
Subject to the conditions and limitations established by law, you may have the right to:
- obtain confirmation whether we process your personal data;
- request access to your personal data;
- request correction of inaccurate or incomplete information;
- request deletion of personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- receive certain personal data in a structured, commonly used and machine-readable format and request portability;
- withdraw consent at any time where processing is based on consent; and
- lodge a complaint with a competent supervisory authority.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
To exercise a right, contact [email protected].
We may request reasonable information to confirm your identity before responding.
15. Right to object
Where we process personal data on the basis of legitimate interests under Article 6(1)(f) GDPR, you have the right to object to that processing on grounds relating to your particular situation.
Where personal data is processed for direct marketing, you may object at any time. If you object to direct marketing, we will stop using your personal data for that purpose.
16. Automated decision-making
Plan Bulgaria does not currently make decisions about website visitors or clients based solely on automated processing that produce legal effects or similarly significant effects within the meaning of Article 22 GDPR.
If this changes, we will update this Policy and provide the information required by law.
17. Children
Our website and professional services are intended primarily for businesses, investors, entrepreneurs and adults.
We do not knowingly use the website to solicit personal information directly from children.
18. Complaints
We encourage you to contact us first if you have any concern about how we process personal data.
You also have the right to lodge a complaint with the Bulgarian supervisory authority:
Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd.
Sofia 1592
Bulgaria
Email: [email protected]
You may also have the right to complain to another competent supervisory authority in the EU/EEA, particularly in the Member State of your habitual residence, place of work or the alleged infringement.
19. Third-party websites
Our website may link to third-party websites or services.
Plan Bulgaria is not responsible for the privacy practices of independent third parties. We recommend reviewing the privacy information provided by a third-party service before providing personal information to it.
20. Changes to this Policy
We may update this Privacy Policy when our services, technology, legal obligations or processing activities change.
The latest version will be published on this page with an updated “Last updated” date.
Material changes may also be communicated through additional means where appropriate.
21. Contact
For privacy questions, requests or complaints:
Plan Bulgaria
Email: [email protected]
Telephone: +359 878 842 662
Website: planbulgaria.com
Data controller: Plan Bulgaria EOOD, UIC 207049151