General Data Protection Regulation (GDPR) Notice

This notice explains the legal bases we rely on, the safeguards we apply, and the GDPR rights you can exercise in relation to your personal data.

Legal bases for processing

  • Contractual necessity – to prepare and execute brokerage, management, or consultancy agreements.
  • Legal obligation – to meet requirements under property, tax, accounting, and anti-money-laundering laws.
  • Legitimate interest – to maintain business continuity, protect our services, and ensure accurate records.
  • Consent – to send marketing communication or share information with partners when you explicitly agree.

The data controller is BORDCOM Real Estate, company ID (EIK) 201174066, 72 Dimitar Petkov St, Centre, 1309 Sofia, Bulgaria. Data protection enquiries: dpo@bordcom.bg.

The “Buy with us” and “Sell with us” forms collect your name, phone, email and what you told us about the property – city, neighbourhoods, budget, size, type, timing. The basis is taking steps at your request before entering into a contract: without this we cannot call you back, prepare a valuation or make a selection.

Contact details are recorded at the start of the form rather than at the end. That means an enquiry is kept even when you did not finish it, so that we can get back to you about it. If you would rather we did not, write to us and it is deleted at once.

A completed enquiry is kept for 18 months from submission. An unfinished one, 6 months. After that the record is deleted automatically rather than archived. Data we are required to keep under accounting, tax or AML law follows its own periods.

If you reached us through a Google ad, the click identifier (gclid) is stored with the enquiry so we know which ad brought it. It contains no name and does not identify your device outside our own system.

We keep data for defined periods rather than “as long as needed”. Enquiries from the forms follow the periods below; other data is kept while it is necessary for the purpose it was collected for, or while the law requires it, and is then deleted or anonymised.

We share information only with partners and suppliers who assist our operations and are contractually bound to uphold strong data protection standards.

Your GDPR rights

  • Right of access – receive confirmation and a copy of your personal data.
  • Right to rectification – correct inaccurate or incomplete data.
  • Right to erasure – request deletion when data is no longer needed or processing is unlawful.
  • Right to data portability – obtain your data in a structured format or transfer it to another controller.
  • Right to withdraw consent – where we process on the basis of consent, you may withdraw it at any time, without affecting the lawfulness of processing before then.
  • Right to object – to processing based on legitimate interest, including to direct marketing.
  • Right to complain – to the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, Bulgaria, cpdp.bg.

You can exercise your rights by sending us a written request. We respond within one month and may request additional information to confirm your identity.

How to reach us

Send GDPR enquiries to dpo@bordcom.bg or to 72 Dimitar Petkov St, Centre, 1309 Sofia, Bulgaria. We reply within one month.