Contemporary residential architecture representing Project ONE real estate advisory in Sofia

Privacy Policy

EN/BG

Menu

Privacy Policy

Effective date: 25.07.2026

1) Who we are (Controller)

Project ONE OOD (Bulgarian: „Проджект 1“ ООД)

UIC (EIK): 205322886 • VAT: BG205322886

Registered office: ul. Vitoshka Zornitsa 3, Building 2, Apt. 9, Dragalevtsi, 1415 Sofia, Bulgaria

Website: projectone.co

Email for privacy matters: office@projectone.co

Data Protection Officer: Not appointed.

Supervisory authority (Bulgaria): Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, kzld@cpdp.bg, cpdp.bg.

Applicable laws: EU GDPR and the Bulgarian Personal Data Protection Act; sectoral rules incl. Bulgarian accounting rules and AML/KYC legislation.

2) Scope

This notice covers how we process personal data when you visit our website, make an enquiry, book/view a property, become a client/supplier, or otherwise interact with us (online or at our sales office/show homes).

3) What we collect and why (purposes & legal bases)

We only process what’s necessary:

A. Website visitors & security

  • Data: IP address, device and browser data, pages visited, timestamps, basic geolocation derived from IP, error logs.

  • Basis: Legitimate interests (operate a secure, reliable site).

B. Enquiries, viewing bookings & property interest

  • Data: name, email/phone, preferred properties, budget range, timing, notes (incl. call/meeting notes).

  • Basis: Pre-contractual steps / Contract; Legitimate interests (sales workflow and customer service).

C. Client onboarding, offers, reservations, contracts, and handover

  • Data: identity and contact details; correspondence; contract data; purchase/lease terms; payment and invoicing data; handover and snagging documentation.

  • Basis: Contract; Legal obligation (accounting/tax); Legitimate interests (project administration and claim defense).

D. AML/KYC (where required by law for real estate transactions)

  • Data: identity documents (ID/passport copy/number, nationality, birth date), address/utility bill, UBO/PEP status, sanctions screening results, source-of-funds/wealth confirmations, company register extracts.

  • Basis: Legal obligation (anti-money-laundering and counter-terrorist-financing rules).

E. Marketing & events

  • Data: name, email, preferences, engagement with emails; event RSVPs and attendance; photos/videos from our events or show homes (only with appropriate notices/consent where required).

  • Basis: Consent for email marketing and optional cookies; Legitimate interests for business communications to corporate contacts (where permitted); Consent for identifiable image use.

F. Recruitment (if you apply)

  • Data: CV/cover letter, contact details, interview notes, references (where provided).

  • Basis: Pre-contractual steps; Consent where applicable.

Children: For online services in Bulgaria, parental/guardian consent is required where the child is under 14. We do not knowingly target children.

4) Where the data comes from

  • Directly from you (forms, email, phone, in person).

  • Your device/browser (see Cookie Policy).

  • Lawful third-party sources: public registers (e.g., Commercial Register/BRRA, Property Register, Cadastre), credit/AML databases, professional referrers and portals (e.g., real estate listing platforms), and counterparties (e.g., your bank or lawyer) where appropriate.

5) Who we share data with (categories of recipients)

  • Processors (service providers): hosting and cloud services, email/SMS providers, CRM and deal-flow tools, e-signature platforms, appointment scheduling tools, analytics/measurement (only if you consent to non-essential cookies), customer support/chat tools, IT/security providers. All are bound by data-processing agreements and confidentiality.

  • Professional counterparties (usually independent controllers): notaries, banks/financing institutions, appraisers, surveyors, lawyers, insurers, developers and co-brokers, property managers, and public authorities/registries as legally required.

  • Corporate transactions: if we reorganise, merge, or transfer business, data may be disclosed as part of the process under appropriate safeguards.

We do not sell personal data.

6) International transfers

When using providers outside the EEA, we rely on appropriate safeguards, such as an EU adequacy decision (e.g., EU–US Data Privacy Framework for certified US organisations) and/or the European Commission’s Standard Contractual Clauses, plus supplementary measures where needed.

7) Retention

We keep data only as long as needed or as required by law:

  • Website/security logs: typically up to 12 months, unless needed longer for incident review.

  • Enquiries & viewing records: up to 24 months after last interaction (or earlier upon objection/withdrawal).

  • Marketing lists: until you withdraw consent or after inactivity clean-ups.

  • Client/property files (offers, contracts, snagging, handover): generally 5 years after closing/end of relationship (for claim limitation), unless longer is necessary for legal claims or warranties.

  • Accounting & invoicing: 10 years from 1 January of the year following the reporting period (statutory rule).

  • AML/KYC records: 5 years after the end of the business relationship or the occasional transaction, extendable if required by law.

8) Your rights

Subject to law, you may:

  • Access, rectify, or erase your data;

  • Restrict processing or object to processing based on legitimate interests (including direct marketing);

  • Withdraw consent at any time (this won’t affect past lawful processing);

  • Request data portability.

To exercise rights, email office@projectone.co. You can also lodge a complaint with CPDP (details above).

9) Cookies & similar technologies

See our Cookie Policy for details on categories used, your choices (Accept all / Reject all / Customize), and how to change or withdraw consent any time via the Cookie settings link in the site footer.

10) Security

We use administrative, technical, and physical safeguards (TLS, access controls, least-privilege, logging, vendor due diligence). No method is 100% secure, but we work continuously to protect your data.

11) Automated decision-making

We do not use automated decision-making that produces legal or similarly significant effects about you.

12) Changes

We may update this notice from time to time. The latest version will always be available here with an updated Effective date.

Scroll to Top