PRIVACY AND PERSONAL DATA PROTECTION POLICY
Last updated: 22 October 2026
1. Introduction
The protection of personal data and the confidentiality of information are an important part of RPV Partners’ professional principles.
As a company providing accounting, tax and business consulting services, we understand the importance of processing information responsibly and lawfully.
This Privacy Policy describes how we collect, use, store and protect the personal data of visitors to https://rpvpartners.com/, people who make enquiries, and representatives of our potential and current clients.
This Policy has been prepared with regard to Regulation (EU) 2016/679 (the General Data Protection Regulation — GDPR), the Bulgarian Personal Data Protection Act and other applicable legislation.
2. Who is responsible for processing personal data?
The controller of personal data processed for the purposes of operating the Website and communicating through it is:
“АР ПИ ВИ ПАРТНЪРС” ООД (RPV Partners, a Bulgarian limited liability company)
Unified Identification Code (UIC): 201774997
VAT number: BG201774997
Registered office and management address: 163A Letostruy Street, Hristo Botev residential area, Slatina District, Sofia 1517, Bulgaria
Contact email: office@rpvpartners.com
Telephone: +359 2 468 72 58
Website: https://rpvpartners.com/
For questions relating to personal data processing or the exercise of your rights, you may use the email address above.
3. What personal data may we process?
Depending on how you interact with us, we may process the following categories of data:
3.1. Data provided when contacting us
- First and last name;
- Email address;
- Telephone number;
- Name of the organisation you represent;
- Position or professional role, if provided;
- Content of the enquiry sent;
- Other information you voluntarily provide in communications.
3.2. Data relating to professional communications
When communicating with representatives of legal entities, we may process business contact details, information about authority to represent, professional position and correspondence necessary to consider enquiries and prepare proposals.
3.3. Technical data
When you visit the Website, the following may be processed automatically:
- IP address;
- Browser type and version;
- Operating system and device type;
- Date and time of the visit;
- Pages requested and technical events;
- Data necessary for the security and proper functioning of the Website.
3.4. Data through cookies
Depending on the technologies used and your settings, cookie identifiers, language preferences, consent settings and other technical data may be processed.
Details are provided in the Cookie Policy.
4. For what purposes and on what legal basis do we process data?
4.1. Responding to enquiries
We process the data provided to answer questions, provide information about our services and carry out communications you have requested.
Legal basis: Article 6(1)(b) of the GDPR, where processing is necessary to take steps at a data subject’s request prior to entering into a contract, or Article 6(1)(f) — a legitimate interest in conducting professional communications.
4.2. Preparing proposals and establishing business relationships
When you express an interest in our services, we may use the necessary information to prepare a tailored proposal and discuss the terms of cooperation.
Legal basis: taking steps prior to entering into a contract or legitimate interest, depending on the specific circumstances.
4.3. Compliance with legal obligations
In certain cases, we may process or retain information when necessary to comply with applicable legal obligations.
Legal basis: Article 6(1)(c) of the GDPR.
4.4. Website security and protection
Technical data may be used to prevent misuse, identify technical problems, protect against unauthorised access and maintain security.
Legal basis: Article 6(1)(f) of the GDPR — a legitimate interest in ensuring a reliable and secure online environment.
4.5. Analysis and improvement of the Website
If we use optional analytics technologies that require consent, the associated personal data will be processed after that consent has been given.
Legal basis: Article 6(1)(a) of the GDPR.
4.6. Protection of legitimate interests and rights
Where necessary, we may process relevant data to establish, exercise or defend legal claims.
Legal basis: legitimate interest or another applicable legal basis, depending on the specific case.
5. Is providing personal data mandatory?
As a rule, providing personal data through the Website is voluntary.
However, certain contact details may be necessary for us to respond to your enquiry or prepare a proposal you have requested.
If you do not provide the necessary information, we may be unable to process the particular request.
We recommend that you do not send sensitive information, identity documents, financial statements, employee data or other confidential documentation through general contact forms unless this is expressly necessary and an appropriate secure exchange channel has been agreed.
6. To whom may personal data be disclosed?
Where there is a legal basis and to the extent necessary, data may be accessible to:
- Authorised employees and representatives of the Company;
- Web hosting and technical support providers;
- Email and communications service providers;
- Providers of information systems used for the relevant activities;
- Professional consultants, where necessary and lawful;
- Competent state and supervisory authorities where there is a legal obligation.
Where third parties process personal data on our behalf, we apply the requirements of Article 28 of the GDPR, including entering into data processing agreements where necessary.
We do not sell Website visitors’ personal data.
7. Transfers of data outside the European Economic Area
The possibility of transferring personal data outside the European Economic Area depends on the technical providers and specific services used.
Where such a transfer takes place, it must be based on an applicable mechanism under Chapter V of the GDPR, such as an adequacy decision or appropriate safeguards, including standard contractual clauses where applicable.
Information about specific recipients and applicable safeguards may be requested using the contact details provided.
8. How long do we retain personal data?
Personal data is retained only for the period necessary for the relevant purpose, unless the law provides for another period or there is a basis for longer retention.
When determining retention periods, we take into account:
- The duration and nature of the communication;
- The need for follow-up on an enquiry;
- The existence of contractual or legal obligations;
- Applicable limitation periods;
- The need to protect legitimate rights and interests.
Once the grounds for retention no longer apply, data is deleted, anonymised or otherwise processed lawfully.
Specific retention periods for individual categories of data are determined in accordance with internal information-retention rules and applicable legislation.
9. How do we protect personal data?
We implement appropriate technical and organisational measures to protect personal data, taking into account the nature of the processing and the risks involved.
Depending on the specific system and the need, these measures should include:
- Access controls for information;
- Restricting access to authorised persons;
- Secure communication channels;
- Measures against unauthorised access;
- Maintenance and updating of the systems used;
- Incident response procedures;
- Appropriate organisational confidentiality rules.
No information system can guarantee absolute protection against all possible risks, but we take measures to achieve a level of security consistent with applicable requirements.
10. Your rights
Subject to the conditions of the GDPR, you have the following rights:
Right to information and access — to obtain information about whether we process your personal data and, where the legal conditions are met, a copy of it.
Right to rectification — to request the correction of inaccurate data or completion of incomplete data.
Right to erasure — to request erasure where the grounds provided for by law exist.
Right to restriction of processing — to request temporary restriction of processing in certain cases.
Right to data portability — where the applicable conditions are met, to receive the data you have provided in a structured, commonly used and machine-readable format.
Right to object — to object to processing based on legitimate interest, subject to Article 21 of the GDPR.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
Rights relating to automated decision-making — where applicable, you have the rights under Article 22 of the GDPR.
These rights are not absolute and may be restricted in the cases provided for by law.
11. How can you exercise your rights?
You may send a request to:
Please describe clearly enough the right you wish to exercise.
Where necessary, we may request additional information to confirm your identity if we have reasonable doubts about the identity of the requester.
We will respond without undue delay and, as a rule, within one month of receiving the request. Under the conditions of the GDPR, this period may be extended by up to two additional months; you will be informed of the reasons.
12. Right to lodge a complaint
If you believe that your personal data is being processed in breach of applicable law, you have the right to lodge a complaint with the competent supervisory authority:
Commission for Personal Data Protection (CPDP)
Address: 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592
Website: https://www.cpdp.bg/
You also have the right to judicial protection under the conditions of applicable law.
13. Cookies and similar technologies
The Website may use cookies and similar technologies to ensure its technical functionality, save settings and serve other purposes described in the Cookie Policy.
Where the law requires prior consent for a particular technology, it should be activated only after valid consent has been obtained.
14. External websites
Our Website may contain links to other websites.
We do not independently determine the rules governing the processing of personal data by the independent controllers of those external websites.
We recommend that you read their privacy policies.
15. Processing of data in connection with accounting services
When providing accounting and consulting services, the Company may process information provided by clients, including data relating to their employees, representatives, suppliers and counterparties.
Depending on the specific service and the factual circumstances, the Company may act as an independent controller or as a processor of personal data on behalf of a client.
The roles, responsibilities, purposes and conditions of processing are determined in accordance with the GDPR and the applicable contractual relationships.
When the Company acts as a processor of personal data, its relationship with the relevant controller is governed in accordance with Article 28 of the GDPR.
This Policy relates primarily to the Website and communications through it and does not replace the contracts and privacy notices applicable to specific accounting services.
16. Changes to the Policy
We reserve the right to update this Policy in response to changes in legislation, the technologies used or personal data processing activities.
The current version is published on the Website with the date of the latest update.
Where legislation requires additional notice or new consent, we will take the necessary steps.
17. Contact
For questions about this Policy:
“АР ПИ ВИ ПАРТНЪРС” ООД (RPV Partners, a Bulgarian limited liability company)
Email: office@rpvpartners.com
Telephone: +359 2 468 72 58
Website: https://rpvpartners.com/