Privacy (GDPR)

This is an English translation for convenience; the Bulgarian text prevails.

In force from 16.10.2026

This policy describes how DOBG Ltd., UIC 148050836, Varna — the controller of the personal data (hereinafter “OOD.bg”), processes the personal data of the users of ood.bg in accordance with Regulation (EU) 2016/679 (GDPR) and the Personal Data Protection Act.

What data we process

• profile — name, e-mail, phone (optional), photo (optional), password hash, interface settings;
• companies and documents — the data of the companies, partners, goods and documents that you enter;
• security — date and time of sign-in, IP address and browser of the active sessions, log of the actions in the company;
• communication — the messages you send us through the feedback form;
• demo — the e-mail address with which you request a link to the demo, and whether you have agreed that we may write to you after it. The data you enter in the demo itself are not saved: they are kept only in the server’s memory and are deleted after 60 minutes.

Purposes and legal basis

• creating, storing and sending documents and performance of the contract with the user (Article 6(1)(b) GDPR);
• security of the accounts and prevention of abuse (legitimate interest, Article 6(1)(f));
• informing you about new products and services of OOD.bg — only with your consent (Article 6(1)(a)), which you can withdraw at any time in Profile → Notifications.

Demo: we send you only the link you requested (legitimate interest). Only if you tick the consent box do we send you one e-mail after the demo, asking for your opinion and inviting you to register (Article 6(1)(a)). You can unsubscribe using the link in the e-mail. Without consent, the e-mail address is deleted after 30 days; with consent, after 12 months or when you unsubscribe.

We do not take decisions based solely on automated processing which produce legal effects concerning you.

Retention period

Personal data are kept for up to 5 years after the last use of the account, unless a law (for example, the Accountancy Act) requires a longer retention period for the documents.

Recipients

We do not provide your personal data to third parties for advertising without your consent. The data are stored and processed on our own servers in the European Union — we do not use an external hosting provider. The documents you send reach the recipients you specify.

Your rights

You have the right to:

• information about and access to your personal data;
• rectification of inaccurate data;
• erasure (“the right to be forgotten”) where the data are no longer necessary, you withdraw your consent or the processing is unlawful;
• restriction of processing where you contest the accuracy of the data or the processing is unlawful;
• portability — to receive your data in a structured, machine-readable format or to have them transferred to another controller;
• object to the processing, including at any time to direct marketing;
• lodge a complaint with the Commission for Personal Data Protection or apply to the court.

You can exercise many of these rights yourself in Profile (correction, downloading your data, request for erasure). For anything else, write to us at [email protected]. We reply within one month.

Security

We apply appropriate technical and organisational measures: an encrypted connection (SSL), encryption of sensitive data, password hashing, two-factor authentication, isolation of the data of each company, an action log, regular backups and reviews of the measures. In the event of a security breach, we notify the supervisory authority and the affected persons in accordance with the GDPR.

Supervisory authorities

Disputes

You can use the European Online Dispute Resolution platform (ec.europa.eu/odr). The body competent for alternative resolution of disputes with OOD.bg is the General Conciliation Commission based in Varna (for the districts of Varna, Dobrich and Silistra).