Privacy Policy

Privacy policy

Effective Date: 25.08.2026

1. Who We Are

ConsulTax OOD (КОНСУЛТАКС ООД) is the controller of the personal data described in this policy. We are a limited liability company entered in the Commercial Register of the Republic of Bulgaria under UIC (EIK) 207959611, with our registered seat and address of management at 27 Plovdiv Street, Varna 9000, Bulgaria.

You can reach us about anything in this policy at contact@consultax-varna.com or +359 88 255 7335.

We have not appointed a Data Protection Officer, and are not required to. Data protection questions go to the contact details above.

This policy explains how we handle personal data when you visit consultax-varna.com or contact us through it.

2. Information We Collect

Information you give us. If you write to us through the contact form on this website, we receive the name, email address and message you enter, and the subject line if you fill one in. Giving us these details is entirely voluntary and no law requires it — but we cannot reply without an email address, and you are free to contact us by phone instead. Beyond that form and the sign-up described next, nothing on this website asks you for personal data: there is no registration, no login and no user account for visitors, and no payment is taken through this website.

Information you give us for our updates. If you sign up for our email updates, we record the email address you enter, the language you signed up in, the page you signed up from, the time of your sign-up, the time you confirmed it by opening the link we email you, and the version of the consent wording you saw. We keep this so that we can show you asked for the updates, and so that we can stop them the moment you tell us to. Nothing is ever sent to an address that has not opened the confirmation link.

Information our server records. Like any web server, ours writes ordinary access logs — your IP address, the page requested, the time, and the browser and operating system your device reports. These logs exist to keep the site running and secure. We do not use them to build a profile of you, and we run no advertising software on this website. The only measurement that runs without asking you is the counting described in section 5 — it involves no cookies and keeps no data about you; Google Analytics runs only if you have agreed to it there.

Information you give us as a client. If you go on to engage us, we process the personal data needed to do the work — your own details and, where the engagement requires it, those of your employees, partners or counterparties. What we handle in that role is set out in our engagement documents; this policy covers the website.

3. How We Use Your Information, and On What Legal Basis

We only process personal data where the GDPR gives us a basis to do so:

To answer your enquiry and prepare a quote or engagement. Basis: steps taken at your request before entering a contract (Art. 6(1)(b)), and our legitimate interest in responding to people who contact us (Art. 6(1)(f)).
To provide the accounting, tax and company services you engage us for. Basis: performance of our contract with you (Art. 6(1)(b)).
To meet our own statutory duties under Bulgarian accounting, tax and anti-money-laundering law. Basis: compliance with a legal obligation (Art. 6(1)(c)).
To keep this website available and secure, and to investigate faults or abuse. Basis: our legitimate interest in running a secure site (Art. 6(1)(f)).
To send you updates, if and only if you have asked us to. Basis: your consent (Art. 6(1)(a)), which you may withdraw at any time.

We do not sell, rent or share your details for anyone else's marketing, and we do not make any decision about you by automated means or build profiles of you.

4. Sharing Your Information

We do not sell or rent your personal data. We share it only with:

The provider that hosts this website — a server operated by netcup GmbH in Germany.
Google Ireland Limited — only if you have agreed to analytics (section 5), as our processor for measuring visits; without your consent Google receives nothing from these pages.
The provider that carries our email — ALL-INKL.COM (Neue Medien Münnich) in Germany, which delivers messages sent through the contact form.
Public authorities, where the law requires us to, and our professional advisers where necessary.

Each of these acts on our instructions and only so far as the service requires. All of them are located within the European Economic Area, so your data is not transferred outside the EEA.

5. Cookies and Tracking Technologies

By default this website sets no cookies and uses no tracking. There is no advertising or social-media tracking pixel and no third-party embed on these pages: fonts, images and the map on our contact page are all served from our own domain. The one exception is Google Analytics, and it stays off until you switch it on — see "Google Analytics, only if you agree" below.

What we count. Our own server counts how often each page is viewed and which website, if any, a visitor arrived from. That is the whole of it: the counter runs on our server, sends nothing to anyone else, sets no cookie, stores nothing on your device, and keeps no record of you — not your IP address, not your browser, not any identifier — so the counts cannot be traced back to any visitor, and we could not single you out in them if we tried. We use them only to see which of our pages are useful.

Google Analytics, only if you agree. When you first visit, a small banner asks whether we may also measure visits with Google Analytics. Until you agree, nothing is requested from Google and no analytics cookie exists — the banner itself loads nothing. If you agree, your browser loads Google's measurement script and Google sets its own cookies (names beginning "_ga"); Google Ireland Limited then processes information about your visit — the pages you view, your approximate location derived from a shortened IP address, and your device's characteristics — as our processor, and may transfer some of it to Google LLC in the United States under the EU–US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR). You can change your mind at any moment through the "Analytics choice" link at the foot of every page: withdrawing removes the Google cookies our pages can reach and stops the measurement from the next page you open. If you decline, we remember only the fact that you declined, and we do not ask again. If your browser sends a Do Not Track or Global Privacy Control signal, we treat it as a no and do not even show the banner.

The map deserves a word, because most websites do this differently. It is a picture we generated ourselves from OpenStreetMap data and host here, not an embedded Google map. An embedded map would quietly hand your IP address to Google and let it place cookies in your browser the moment the page opened, whether or not you cared about the map. Ours cannot: it is an image, so nothing is requested from anyone but us. If you click it, you go to our listing on Google Maps — at that point you are on Google's website, under Google's privacy policy, because you chose to go there.

Beyond that, this website places two small notes on your device, and neither is a cookie: if you close the newsletter invitation or sign up through it, your browser keeps a note of that so we do not show you the invitation again; and when you answer the analytics question, your browser keeps your answer so we do not ask again. Both live in what browsers call local storage, never leave your browser, and exist only to respect a choice you made — which is why the law does not require consent for them. You can remove them at any time by clearing your browser's site data for consultax-varna.com.

Unless you have said yes to analytics, nothing is loaded from anyone else and nothing non-essential is placed on your device — the analytics question is the one thing we ask, the site works identically whichever answer you give, and declining is one click. The only cookie our software can set is a sign-in cookie in the private area our own staff use to edit the site; it is strictly necessary for that sign-in and is never set when you browse these pages.

If we ever introduce tracking that stores anything on your device or keeps data about you — anything beyond the anonymous counting described above — we will ask for your consent before it happens and update this policy first.

6. How Long We Keep It

Enquiries that do not become engagements: 12 months from your last message to us, then deleted.
Client records: for as long as the engagement lasts and afterwards for the periods required by Bulgarian accounting, tax and anti-money-laundering legislation, which are longer than we would otherwise keep them and are not ours to shorten.
Server access logs: only as long as they are useful for security and diagnosing faults, and they are never used to identify individual visitors.
Sign-ups for our updates that you did not confirm: deleted after 7 days.
Consent-based updates: until you withdraw your consent. When you do, we keep only the address itself, marked as opted out, so that it is never mailed again by mistake.

7. Data Security

We implement appropriate technical and organisational measures to protect your data from unauthorised access, loss or misuse. This website is served over an encrypted connection, and access to the systems holding client data is restricted to the people who need it.

8. Your Rights

Under the GDPR you have the right to:

Access the personal data we hold about you, and receive a copy of it.
Rectify it if it is inaccurate or incomplete.
Erase it, where there is no overriding legal reason for us to keep it.
Restrict how we use it while a question about it is resolved.
Object to processing we carry out on the basis of our legitimate interests, and to direct marketing at any time.
Portability — receive data you gave us in a structured, commonly used, machine-readable format.
Withdraw consent at any time, where our processing rests on it. This does not affect anything done before you withdrew it.

Write to us at contact@consultax-varna.com to exercise any of these. We will respond within one month.

If you are unhappy with how we have handled your data, you can complain to the supervisory authority. In Bulgaria that is the Commission for Personal Data Protection (Комисия за защита на личните данни): 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, email kzld@cpdp.bg, www.cpdp.bg. If you live in another EU country, you may complain to your own national supervisory authority instead.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date, and where a change materially affects how we use your data we will say so here rather than leave you to spot it.

This notice explains what we do with your personal data and what rights you have. It is not a contract, and nothing in it asks you to give up anything: your rights under the GDPR apply whether or not you have read this page.