Last updated: 2 October 2026
This policy explains how your personal data is processed when you use the bulgaristanvatandas.com website and request our consultancy services, under the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Turkish Personal Data Protection Law No. 6698 (KVKK).
1. Data controller
BulgaristanVatandas.com
Head office: Kurtuluş Mah. Arka Sok. No:80/14, 39750 Lüleburgaz / Kırklareli, Turkey
Email: info@bulgaristanvatandas.com - Phone: +90 (288) 606 09 69
Our offices in Bulgaria (Kardzhali, Shumen) and Romania (Bucharest) provide the same services, and applications in the European Union are also handled through them. For any data protection request, please write to the email address above.
2. What data we process, why and on what legal basis
Request and contact forms
Through the “We’ll call you”, contact and service page forms we collect your name, phone number, email address and message, in order to answer your request and offer you the right service. Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
Document review and insurance forms
In the document review form we receive the documents you upload, such as your civil registry record, name equivalence certificate, emigrant certificate and nationality declaration; in the travel health insurance form, your date of birth, address and a copy of your passport. Given the nature of citizenship applications, these documents may contain information about your ethnic origin. We process this information only to carry out the review or service you request, based on the explicit consent you give when uploading the documents (Art. 6(1)(a) and Art. 9(2)(a) GDPR; Art. 6 KVKK).
Partnership application
The partnership form collects your company name, job title, website, address, country, city and postcode, so that we can assess your application (Art. 6(1)(b) GDPR).
Online appointments
The appointment calendar is provided by Cal.com. The details you enter when booking (name, email, phone, notes) and the payment of the appointment fee by credit card are handled by Cal.com and its payment provider; your card details never reach us. We use the booking details to hold the meeting (Art. 6(1)(b) GDPR).
When you visit the website
The website is hosted on Cloudflare’s infrastructure. To keep it secure and available, technical data such as your IP address, browser information and the time of the request is processed for a short period (legitimate interest, Art. 6(1)(f) GDPR). A hidden field in our forms filters out automated spam without processing any personal data.
Advertising measurement (only with your consent)
If you consent, we use Google Ads / Google Analytics and the Meta Pixel (Facebook, Instagram) to measure the effectiveness of our advertising. These tools record the pages you visit and whether you submit a form, call us, message us on WhatsApp or book an appointment, as conversions. If you do not consent, the Meta Pixel sends no data at all, and Google receives only limited, cookieless signals that do not identify you (Google Consent Mode). Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with the button below.
The map on the contact page
The map on the contact page uses OpenStreetMap tiles. When the map comes into view, your browser requests the map images from the OpenStreetMap Foundation’s servers, which receive your IP address.
If you click a WhatsApp link, the conversation takes place on WhatsApp (Meta) and is subject to WhatsApp’s privacy policy.
3. Cookies and data stored in your browser
- Strictly necessary: your theme preference (light/dark) and your cookie choice are kept in your browser’s local storage (
localStorage). When a form takes you to the thank-you page, a temporary entry is kept in session storage (sessionStorage) so that the conversion is counted only once, and it is deleted immediately. - Measurement and advertising (consent required): Google cookies (e.g.
_gcl_au,_ga) and Meta cookies (_fbp) are set only if you consent. Their lifetime is set by these providers’ policies (usually 3 to 13 months).
4. Who we share your data with
We never sell your data. The following service providers process your data only on our behalf and under our instructions:
- Cloudflare (hosting, security and form delivery)
- Our customer management system (CRM): your form requests are stored in our system at
crm.bulgaristanvatandas.com - Cal.com (online appointments and payment)
- Google and Meta (advertising measurement, only if you consent)
In addition, at your request and under your power of attorney, we pass the information needed to carry out your application to official authorities in Bulgaria and Romania (e.g. citizenship and migration authorities, consulates), to notaries and to sworn translators. We share data with competent authorities where the law requires it.
5. International transfers
Our offices are in Turkey, Bulgaria and Romania, and your data is transferred between these countries to carry out your application. For transfers to Turkey we rely on the European Commission’s standard contractual clauses or on transfers necessary for the performance of the service (Art. 49(1)(b) GDPR). Cloudflare, Google, Meta and Cal.com may process data in the United States; these companies participate in the EU-US Data Privacy Framework or apply standard contractual clauses.
6. Retention periods
- Requests that do not lead to a service: 2 years from the last contact
- Documents uploaded for review: deleted within 6 months at the latest if no service begins
- Client files: for the duration of the service and then for the legally required retention periods (tax, accounting)
- Technical logs: a short period, for security purposes
When the period ends, your data is deleted or anonymised.
7. Your rights
Under the GDPR and the KVKK you have the right to access your data, to have it rectified or erased, to restrict its processing, to receive it in a portable format, to object to processing based on legitimate interest, and to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
You can send your requests to info@bulgaristanvatandas.com; we reply within 30 days at the latest. You also have the right to lodge a complaint with a supervisory authority:
- Bulgaria: Commission for Personal Data Protection - cpdp.bg
- Romania: National Supervisory Authority for Personal Data Processing (ANSPDCP) - dataprotection.ro
- Turkey: Personal Data Protection Authority - kvkk.gov.tr
8. Security
The website works only over an encrypted connection (HTTPS). Access to your data is limited to the staff who need it for their work.
9. Children
Our services are intended for adults. Procedures concerning children (e.g. obtaining a passport for a child) are requested by a parent or legal guardian.
10. Automated decision-making
We do not take decisions about you based solely on automated processing that produce legal effects, and we do not create profiles.
11. Changes
We may update this policy when necessary. The current version is always published on this page with its last updated date.