Who we are
AFC EOOD („ЕЙ ЕФ СИ“ ЕООД), UIC/EIK 123673786, registered in Bulgaria, is the data controller for personal data processed through this website and in the course of its business communication. Registered-office details are published on the Legal Notice page.
For any question about this policy or about your personal data, write to office@afc-bg.com.
What data we collect
We keep collection to what is necessary. Depending on how you interact with AFC, we may process:
| Enquiry data | Name, work email, company name and the description you send through the contact form or by email. |
| Correspondence | Messages, meeting notes and documents exchanged while discussing or delivering a project. |
| Contract & billing data | Company details, contact person, invoicing information — where an engagement is agreed. |
| Technical data | IP address, browser type, requested pages and timestamps, recorded in standard server logs. |
We do not knowingly collect special categories of personal data, and we ask you not to include sensitive information or confidential client data in an initial enquiry.
Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Responding to your enquiry and preparing an offer | Legitimate interest, and steps preparatory to a contract (Art. 6(1)(f) and 6(1)(b) GDPR). |
| Delivering and administering an agreed engagement | Performance of a contract (Art. 6(1)(b) GDPR). |
| Accounting, invoicing and statutory record-keeping | Legal obligation under Bulgarian law (Art. 6(1)(c) GDPR). |
| Website security, availability and abuse prevention | Legitimate interest in operating the site securely (Art. 6(1)(f) GDPR). |
| Non-essential analytics, if enabled | Your consent, given through the cookie banner and withdrawable at any time (Art. 6(1)(a) GDPR). |
How long we keep it
Enquiries that do not lead to an engagement are kept for up to 12 months, so that we can recognise a returning conversation, and then deleted. Contract, invoicing and accounting records are kept for the periods required by Bulgarian accounting and tax legislation. Server logs are kept for a short technical period and then rotated.
Who else may process your data
AFC works with a small number of service providers acting as processors on our behalf: website hosting, business email, and — where relevant to an engagement — cloud infrastructure and accounting services. Processors act under written instructions and may not use the data for their own purposes.
We do not sell personal data and we do not share it for advertising purposes. Where a provider processes data outside the European Economic Area, we rely on an adequacy decision or on Standard Contractual Clauses.
AI systems and your data
Important. Personal data submitted through this website is not used to train AI models. In client projects, any use of AI services is agreed in the engagement contract, with defined data boundaries, retention and — where required — on-premise or private deployment.
Your rights
Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where processing is based on consent.
- Requests are handled free of charge, normally within one month.
- Send requests to office@afc-bg.com.
- You may also lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) or with the supervisory authority of your country of residence.
Security
Access to personal data is limited to the founder and, where strictly necessary, to a named collaborator under confidentiality obligations. Data in transit is encrypted, access to systems is protected by strong authentication, and data minimisation is applied by default.
Changes to this policy
If this policy changes materially, the version number and effective date will be updated. Previous versions are available on request.