Privacy Policy

This Privacy Policy of the website pactumbg.com (“the Policy”) concerns the processing of personal data of data subjects who are located in Bulgaria or outside the country’s territory and who use the website or enter into relations with “PACTUM” EOOD, a company incorporated and existing in accordance with the legislation of the Republic of Bulgaria, entered into the Commercial Register and the Register of Non-Profit Legal Entities with Unified Identification Code: 203608593, with registered office and management address: city of Sofia, post code 1000, “Tsar Osvoboditel” Blvd., No. 14, floor 6 (“PACTUM” EOOD, “the Company” or “We/Us”), which maintains and operates the website accessible at the address pactumbg.com (“the Website”).
The Company performs, as a profession, intermediation in real estate transactions. In its capacity as a personal data controller, the Company processes personal data provided by visitors and users of the Website, as well as by its customers and counterparties, in full compliance with the applicable legal provisions relating to the protection and processing of personal data, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (the “General Data Protection Regulation” or “GDPR”) and the Personal Data Protection Act (“PDPA”).

We recommend you to carefully read this Policy in order to learn more about the methods by which we process your personal data, as well as what your rights are.

1. What personal data we process

“PACTUM” collects your personal data, as a rule, directly from you. Depending on the method that you interact with us, we process the following categories of data:

• when sending an inquiry or request for making an on-site viewing inspection via the Website, by email or by phone: names, phone number, email address, as well as the information that you voluntarily include in your inquiry (such as, for example, a real estate property that is of interest to you, budget, preferences);
• when subscribing to a newsletter (when such functionality is available): email address;
• when entering into pre-contractual relations or when concluding an intermediation contract: identification data (names, Personal Identification Number, data according to personal identity document, address), contact details, data about the real estate property – subject of the transaction, financial parameters of the transaction, bank account in the case of payments;
• in connection with our legal obligations as an entity under Art. 4, item 18 of the Measures Against Money Laundering Act (“MAMLA”): data collected during a due diligence check of the customer, including data from a personal identity document (and a copy thereof in the cases provided for by the law), data on the beneficial owners of customers –legal entities, data on the origin of funds, information on whether the person is a politically exposed person, as well as other information required by MAMLA and the regulation on its implementation. Detailed information is contained in a separate Privacy Notice in connection with the measures against money laundering, which is provided to you upon entering into a business relationship with us;
• automatically when visiting the Website: traffic and device data, described in item 2.2 below;

We do not collect or process sensitive data from the special categories of personal data under Art. 9 of GDPR through the Website. The Website is not intended for persons under 18 years of age and we do not knowingly collect personal data of such persons through the Website. In case you have information that such data has reached us, please contact us at the contact details listed below.

When we require the filling in of certain data in order to respond to your inquiry or to provide you with a service, we will mark the relevant fields as mandatory. If you decide not to provide us with such data, we may not be able to process your inquiry or provide you with the relevant service, and in the cases provided for by MAMLA we are obliged to refuse to enter into a business relationship or perform the transaction.

To the extent that you provide us with your personal data yourself, you guarantee that they are true and accurate. As a rule, you only provide us with your own personal data. When you provide us with personal data of third parties (for example, a co-owner of a real estate property or another participant in the transaction), you guarantee that you have notified them of the purposes and method of processing their data and that there is basis for such data to be provided to us.

2. How we collect personal data and on what basis we process them

The personal data, which are subject to processing, are collected by the following methods: through the Website contact forms; through correspondence by email, telephone or on-site at our office; during the preparation and conclusion of an intermediation contract; as well as automatically when you browse the Website (such as, for example, through cookies and navigation data).

2.1. Data provided by you

When you send an inquiry or a request for an on-site viewing inspection

We process your contact details and the contents of your inquiry in order to reply you, arrange an on-site viewing inspection and offer you suitable real estate properties or services. The basis for the processing is taking steps under your request prior to entering into a contract (Article 6, paragraph 1, point (b) of GDPR), while with regard to the accompanying communication – our legitimate interest in responding to inquiries addressed to us (Article 6, paragraph 1, point (f) of GDPR). We will store these data until the final completion of the communication on the raised issue, but no longer than 1 (one) year after the last contact, unless a contractual relationship arises between us or the applicable law requires a longer period.

When you enter into an intermediation contract with us or when you participate in a transaction in which we are an intermediary

We process the identification data, contact data and transaction data specified in item 1 for the purposes of concluding and performing the intermediation contract, including for organizing on-site viewing inspections, conducting negotiations, preparing preliminary and final contracts and communicating with the other party to the transaction, notaries and other participants. The basis is the performance of a contract to which you are a party or taking steps at your request prior to entering into a contract (Article 6, paragraph 1, point (b) of GDPR), while with regard to the data of other participants in the transaction – our legitimate interest in fulfilling our obligations under the intermediation contract (Article 6, paragraph 1, point (f) of GDPR).

We will store these data for a period of 5 (five) years from the date of termination of the contractual relationships, respectively for the longer periods stipulated in the applicable legislation – the accounting registers and financial statements, including the documents for tax and social security control – in accordance with Art. 12 of the Accountancy Act and Art. 38 of the Tax and Social Security Procedure Code, while for the documents and data collected under the procedure of MAMLA – for the time period under item 2.1a below.

When we process data in fulfilment of our obligations under MAMLA (item 2.1a)

As an entity that performs, as a profession, intermediation in real estate transactions, the Company is an obliged entity under Art. 4, item 18 of MAMLA and applies the measures for due diligence checks of customers, identification of beneficial owners, clarification of the origin of funds and collection of related documents and declarations. The basis for this processing is the fulfilment of legal obligations that we are subject to (Article 6, paragraph 1, point (c) of GDPR, in connection with MAMLA, the regulation on its implementation and the Measures against the Financing of Terrorism Act).

The data and documents collected on that basis are stored for a period of 5 (five) years, which for our customers commences from the beginning of the calendar year following the year of termination of the relationship, and in other cases – from the completion of the respective transaction or operation, and this period may be extended in the cases provided for by the law on instruction from the competent authorities. If a legal basis exists, we may disclose these data to the “Financial Intelligence” Directorate of the State Agency for National Security (SANS) and to other competent authorities, and in the cases provided for by MAMLA we do not have the right to notify you of such disclosure.

In cases where you request a subscription to newsletters that may also contain commercial communications

This processing is optional. If such functionality is available on the Website, we will process your email address in order to manage the sending of newsletters about new offers, current news and commercial communications from us. Subscription is based on your consent (Article 6, paragraph 1, point (a) of GDPR), given by checking the relevant field. Consent can be withdrawn at any time by following the instructions in each sent message or by contacting us. Your data will be stored until the moment of consent withdrawal, while we reserve the right to maintain a special list of withdrawn consents in order to ensure that we do not send you commercial communications in the future.

When you contact us through any means of communication

You can contact us by using the contact details provided on the Website (email address, telephone number, postal address or other provided means). In connection with this, we will process your contact details, as well as any other information that you decide to provide to us voluntarily. We process these data based on our legitimate interest in responding to your inquiries and requests (Article 6, paragraph 1, point (f) of GDPR). We will store these data until the final resolution of the raised issue or until you request their erasure (to the extent that the right to erasure applies).

2.2. Data collected while you browse the Website

When you visit the Website, certain information is automatically collected and stored in log files. This may include IP addresses, the main region or location from which your device accesses the Internet, browser type, operating system, as well as other usage information, including the history of pages visited on the Website. We use this information to maintain, develop and improve the Website, to monitor for server problems and to ensure the security of the Website, on the basis of our legitimate interest (Article 6, paragraph 1, point (f) of GDPR). These data may be stored for a maximum period of 1 (one) year, after which they are deleted.

The Website uses cookies and other similar technologies. The use of cookies that are not strictly necessary is only performed after your prior consent has been given. Detailed information can be found in our Cookie Policy published on the Website.

3. Whom we may disclose your personal data to?

We may disclose your personal data only for the purposes and to the persons described below, by taking all appropriate technical and organizational measures for the lawful processing, protection and transfer of your personal data.

3.1. Disclosure to third parties is possible in the following situations:

• to entities that provide products and services to the Company, such as information technology providers (hosting, information system support, email services, archiving and cybersecurity), providers of analytical web services, as well as Internet platforms for real estate listings, when the publication of a listing is necessary for the performance of the contract with you;
• to other participants in the transaction and the persons servicing it – the counterparty and its representative, notaries, banks (including when the buyer receives a credit), judges in charge of entries, appraisers – to the extent that this is necessary for preparation and notarial execution of the transaction;
• to accountants, auditors, attorneys and other external consultants, when it is necessary for them to acquaint themselves with these data in order to provide their services to us;
• to competent public authorities – the “Financial Intelligence” Directorate of SANS, the National Revenue Agency (NRA), the Commission for Personal Data Protection (CPDP), the courts and others – when disclosure is required by law or according to an official request.

3.2. It is possible that we may also disclose your personal data to third parties in the following cases:

a) if you request it or agree to it; b) to persons who identify themselves as having a legal right to do so or who act on your behalf on valid legal grounds; c) when the disclosure is necessary to protect our legitimate interests in order to manage and develop our business activity; d) when we are obliged to disclose your personal data in order to comply with our legal obligation.

The third parties to which we may disclose your personal data are restricted (by law or by contract) in the way that they can use such information – only for the purposes that we have expressly specified. Before disclosure, we ensure that the third parties with whom we share personal data have undertaken appropriate obligations to comply with the data protection rules. This rule may not apply when the disclosure is not performed on the basis of our voluntary decision, but is dictated by compliance with a legal obligation or an official request from a public body.

4. Transfer of data outside the European Union

In case that we use providers established outside the European Economic Area who have access to your personal data in order to provide their services to the Company, we ensure that the transfer is performed in compliance with the requirements of Chapter V of GDPR – on the basis of a decision of the European Commission on the adequate level of protection, standard contractual clauses or other appropriate guarantees, and by also introducing the necessary additional technical and organizational measures in order to protect your personal information.

5. What are your rights in connection with personal data protection?

In your capacity as a data subject, you possess certain rights established in the applicable law regarding the way we process your data. We respect these rights and we will promptly respond to your inquiries and requests.

a) Right to withdraw your consent: In case that you have provided your consent to the processing of your data, you may withdraw it at any time without affecting the lawfulness of the processing performed before the withdrawal.

b) Right to rectification or completion: You may request rectification or completion of your personal data if they are inaccurate or incomplete.

c) Right to restriction of processing: You may request that we restrict the processing of your personal data where: you contest the accuracy of your personal data – for the period necessary for verification; you consider the processing as unlawful but you want restriction instead of erasure; we no longer need your personal data but you require them for the establishment, exercise or defence of legal claims; or you have objected to the processing – while we verify whether our legitimate grounds prevail.

d) Right of access and information: You may request information about what personal data we store about you, for what purposes we use them, for what period we process them and to which third parties they have been disclosed, as well as to receive a copy of your data. If you request additional copies, we may charge a reasonable fee justified by our administrative expenses.

e) Right to erasure (the right “to be forgotten”): You have the right to request the erasure of your personal data that we store about you, except where processing is necessary for compliance with a legal obligation that we are subject to (such as, for example, pursuant to the Personal Data Protection Act or the tax and accounting legislation) or for the establishment, exercise or defence of legal claims. In such a case, we will provide you with information on the reason for not fulfilling your request.

f) Right to data portability: When we process your data on the basis of consent or a contract and the processing is performed by automated means, you have the right to receive the data that you have provided us with in a structured, commonly used and machine-readable format, and to request their transfer to another data controller, when this is technically feasible.

g) Right to object: When we process your personal data on the basis of our legitimate interest, you have the right to object to such processing on grounds relating to your particular situation. You also have the right to object at any time to the processing of your personal data for the purposes of direct marketing, in which case we will cease the processing for such purposes.

h) Right to a legal or administrative defence, in the event that your rights have been violated.

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affecting you. The Company does not perform such automated decision-making.

Please take into consideration that exercising some of the above rights may be restricted by law – for example, the right of access and the right to erasure do not apply to information and documents that we are obliged to store pursuant to MAMLA, and in the cases stipulated by MAMLA we cannot disclose to you whether a report has been submitted to the competent authorities.

In case that you have any complaints regarding the processing of your personal data, we advise you to first contact us so that we can try to promptly resolve the situation. If this approach does not bring the results that you expect, you can contact the competent national supervisory authority:

Name: Commission for Personal Data Protection

Registered office and management address: city of Sofia 1592, “Tsvetan Lazarov” Blvd., No. 2.

Correspondence address: city of Sofia 1592, “Tsvetan Lazarov” Blvd., No. 2.

Phone number: 02 915 3 518

E-mail address: kzld@government.bg, kzld@cpdp.bg

Website: www.cpdp.bg

You can also lodge a complaint with the supervisory authority in the Member State of your habitual residence or place of work, as well as seek protection under the judicial procedure.

Important information in connection with the exercise of your rights:

• Time-limit for response: We will aim to resolve your request within a period of one month, which may be extended by up to two months if the complexity or number of requests requires that. If we extend the time-limit, we will inform you of the duration and the reasons for the delay.
• Impossible identification: In some cases, we may not be able to locate your personal data based on the provided identifiers. In cases where we are unable to identify you as a data subject, we will not be able to fulfil your request unless you provide us with additional information allowing your identification, of which we will notify you.
• Method of exercising your rights: In case that you want to exercise any of the above rights, please contact us in writing (including by electronic means) by using the contact information specified below.

Please send your questions and requests regarding the protection of your personal data through the contact section of the Website or directly to the following email address: office@pactumbg.com.

6. Amendments to the Policy

This Policy may be periodically updated and amended. In case of such an amendment, we will publish the current version of the Policy on the Website. Subject to applicable law, amendments shall be effective from the moment of publishing the amended Policy on the Website, but where we have already collected information about you and/or when this is required by law, we may take additional steps in order to inform you of any material changes, including by sending a message to your email address.

The relevant rules of applicable law shall apply to all matters that have not been expressly regulated by this Policy.