--- title: "Privacy Policy" url: https://yeniversiyon.pages.dev/en/privacy-policy/ lang: en updated: 2026-10-02 description: "BulgaristanVatandas.com GDPR and KVKK privacy policy: what personal data we process and why, who we share it with, retention periods and your rights." source: BulgaristanVatandas.com (https://bulgaristanvatandas.com) --- # Privacy Policy *Last updated: 2 October 2026* This policy explains how your personal data is processed when you use the **bulgaristanvatandas.com** website and request our consultancy services, under the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Turkish Personal Data Protection Law No. 6698 (KVKK). ## 1. Data controller **BulgaristanVatandas.com**\ Head office: Kurtuluş Mah. Arka Sok. No:80/14, 39750 Lüleburgaz / Kırklareli, Turkey\ Email: [info@bulgaristanvatandas.com](mailto:info@bulgaristanvatandas.com) - Phone: +90 (288) 606 09 69 Our offices in Bulgaria (Kardzhali, Shumen) and Romania (Bucharest) provide the same services, and applications in the European Union are also handled through them. For any data protection request, please write to the email address above. ## 2. What data we process, why and on what legal basis ### Request and contact forms Through the "We'll call you", contact and service page forms we collect your **name, phone number, email address and message**, in order to answer your request and offer you the right service. Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). ### Document review and insurance forms In the document review form we receive the documents you upload, such as your **civil registry record, name equivalence certificate, emigrant certificate and nationality declaration**; in the travel health insurance form, your **date of birth, address and a copy of your passport**. Given the nature of citizenship applications, these documents may contain information about your **ethnic origin**. We process this information only to carry out the review or service you request, based on the **explicit consent** you give when uploading the documents (Art. 6(1)(a) and Art. 9(2)(a) GDPR; Art. 6 KVKK). ### Partnership application The partnership form collects your **company name, job title, website, address, country, city and postcode**, so that we can assess your application (Art. 6(1)(b) GDPR). ### Online appointments The appointment calendar is provided by **Cal.com**. The details you enter when booking (name, email, phone, notes) and the payment of the appointment fee by credit card are handled by Cal.com and its payment provider; your card details never reach us. We use the booking details to hold the meeting (Art. 6(1)(b) GDPR). ### When you visit the website The website is hosted on Cloudflare's infrastructure. To keep it secure and available, technical data such as your IP address, browser information and the time of the request is processed for a short period (legitimate interest, Art. 6(1)(f) GDPR). A hidden field in our forms filters out automated spam without processing any personal data. ### Advertising measurement (only with your consent) If you consent, we use **Google Ads / Google Analytics** and the **Meta Pixel** (Facebook, Instagram) to measure the effectiveness of our advertising. These tools record the pages you visit and whether you submit a form, call us, message us on WhatsApp or book an appointment, as **conversions**. If you do not consent, the Meta Pixel sends no data at all, and Google receives only limited, cookieless signals that do not identify you (Google Consent Mode). Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with the button below. ### The map on the contact page The map on the contact page uses OpenStreetMap tiles. When the map comes into view, your browser requests the map images from the OpenStreetMap Foundation's servers, which receive your IP address. ### WhatsApp If you click a WhatsApp link, the conversation takes place on WhatsApp (Meta) and is subject to WhatsApp's privacy policy. ## 3. Cookies and data stored in your browser - **Strictly necessary:** your theme preference (light/dark) and your cookie choice are kept in your browser's local storage (`localStorage`). When a form takes you to the thank-you page, a temporary entry is kept in session storage (`sessionStorage`) so that the conversion is counted only once, and it is deleted immediately. - **Measurement and advertising (consent required):** Google cookies (e.g. `_gcl_au`, `_ga`) and Meta cookies (`_fbp`) are set only if you consent. Their lifetime is set by these providers' policies (usually 3 to 13 months). ## 4. Who we share your data with We never sell your data. The following service providers process your data only on our behalf and under our instructions: - **Cloudflare** (hosting, security and form delivery) - **Our customer management system (CRM)**: your form requests are stored in our system at `crm.bulgaristanvatandas.com` - **Cal.com** (online appointments and payment) - **Google** and **Meta** (advertising measurement, only if you consent) In addition, at your request and under your power of attorney, we pass the information needed to carry out your application to **official authorities in Bulgaria and Romania** (e.g. citizenship and migration authorities, consulates), to **notaries** and to **sworn translators**. We share data with competent authorities where the law requires it. ## 5. International transfers Our offices are in Turkey, Bulgaria and Romania, and your data is transferred between these countries to carry out your application. For transfers to Turkey we rely on the European Commission's standard contractual clauses or on transfers necessary for the performance of the service (Art. 49(1)(b) GDPR). Cloudflare, Google, Meta and Cal.com may process data in the United States; these companies participate in the EU-US Data Privacy Framework or apply standard contractual clauses. ## 6. Retention periods - Requests that do not lead to a service: **2 years** from the last contact - Documents uploaded for review: deleted within **6 months** at the latest if no service begins - Client files: for the duration of the service and then for the legally required retention periods (tax, accounting) - Technical logs: a short period, for security purposes When the period ends, your data is deleted or anonymised. ## 7. Your rights Under the GDPR and the KVKK you have the right to **access** your data, to have it **rectified** or **erased**, to **restrict** its processing, to receive it in a **portable** format, to **object** to processing based on legitimate interest, and to **withdraw your consent** at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. You can send your requests to [info@bulgaristanvatandas.com](mailto:info@bulgaristanvatandas.com); we reply within **30 days** at the latest. You also have the right to lodge a complaint with a supervisory authority: - Bulgaria: Commission for Personal Data Protection - [cpdp.bg](https://www.cpdp.bg/) - Romania: National Supervisory Authority for Personal Data Processing (ANSPDCP) - [dataprotection.ro](https://www.dataprotection.ro/) - Turkey: Personal Data Protection Authority - [kvkk.gov.tr](https://www.kvkk.gov.tr/) ## 8. Security The website works only over an encrypted connection (HTTPS). Access to your data is limited to the staff who need it for their work. ## 9. Children Our services are intended for adults. Procedures concerning children (e.g. obtaining a passport for a child) are requested by a parent or legal guardian. ## 10. Automated decision-making We do not take decisions about you based solely on automated processing that produce legal effects, and we do not create profiles. ## 11. Changes We may update this policy when necessary. The current version is always published on this page with its last updated date.