Privacy and Personal Data Protection Policy

1. Introduction

At Computantis, we respect the right to privacy and the protection of personal data. We process information provided to us lawfully, fairly and transparently, for specific, predetermined purposes.

This Privacy Policy explains how we collect, use, retain and protect the personal data of visitors to computantis.eu, including its global, Bulgarian and Czech versions.

It applies to people who visit the website, submit enquiries, request quotations, book consultations or otherwise communicate with us.

Personal data is processed in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, or GDPR), applicable Bulgarian and Czech legislation and other relevant legal requirements.

2. Data controllers

Computantis is a brand under which accounting, payroll, financial and related advisory services are provided for Bulgaria and the Czech Republic.

Depending on the nature of the enquiry, the contractual relationship and the market concerned, the data controller is:

For Bulgaria
Компутантис ЕООД (Computantis EOOD)
Unified Identification Code (EIK): 104639402

For the Czech Republic
Ing. Rumyana Peneva-Valacheva
Self-employed person (OSVČ)
Business Identification Number (IČO): 23196351

The website is managed, both technically and organisationally, by Ing. Rumyana Peneva-Valacheva and the owner of the Bulgarian company.

Enquiries submitted through the website are received and reviewed by Ing. Rumyana Peneva-Valacheva, who is the main contact person for personal data protection matters.

Where the two businesses jointly determine the purposes and means of a particular processing activity, their respective responsibilities are governed by Article 26 GDPR.

Contact for personal data matters
Ing. Rumyana Peneva-Valacheva
Email: info@bgcz.cz

3. What personal data do we process?

Depending on the website features used, we may process the following categories of personal data:

• First and last name.
• Email address and telephone number.
• Company name, job title and professional information.
• Country in which business activities are carried out or planned.
• Information about the accounting, payroll, financial or advisory services requested.
• Content of enquiries, messages and correspondence.
• Information needed to arrange consultations.
• Technical information relating to website access, operation and security.

Technical information may include an IP address, the date and time of a request, browser type, operating system and system logs, insofar as these are processed by the infrastructure in use.

We do not request special categories of personal data, identity documents, health information or detailed employee personal data through our public forms.

Please do not send such information through public contact forms unless it is expressly necessary and an appropriate secure transmission method has been agreed in advance.

4. Purposes and legal bases for processing

We process personal data only where an applicable legal basis exists under Article 6 GDPR.

4.1. Responding to enquiries and preparing quotations

We use the information provided to review your enquiry, clarify the services required, prepare a tailored quotation and conduct related follow-up communications.

Legal basis: Article 6(1)(b) GDPR where steps are taken at the request of an individual before entering into a contract; or Article 6(1)(f) GDPR, legitimate interests in conducting professional correspondence, where the enquiry is made by a representative of a legal entity.

4.2. Arranging and conducting consultations

We process the information needed to book, confirm, organise and conduct consultations.

Legal basis: taking steps prior to entering into a contract or legitimate interests, depending on the nature of the communication.

4.3. Providing contracted services

Where a contractual relationship is established, we process the information necessary to provide the agreed services.

Depending on the processing activity, Computantis may act as a data controller or as a data processor on behalf of a client acting as controller.

Where we act as a processor, processing is governed by the contractual provisions required under Article 28 GDPR.

4.4. Compliance with legal obligations

We process and retain personal data where required by applicable accounting, tax or other legislation.

Legal basis: Article 6(1)(c) GDPR.

4.5. Security and technical operation

We may process limited technical information to protect the website, prevent misuse, identify technical issues and ensure reliable operation of our systems.

Legal basis: Article 6(1)(f) GDPR - legitimate interests in maintaining a secure information environment.

5. Contact and enquiry forms

When you submit an enquiry through computantis.eu, the information provided is recorded in the system used to process the forms.

Ing. Rumyana Peneva-Valacheva reviews this information to prepare a response or quotation or to conduct further correspondence.

Mandatory fields are limited to the information needed to process the relevant enquiry. Providing additional information is voluntary.

Submitting an enquiry does not automatically constitute consent to receive marketing communications.

6. Online accounting platforms and our own cloud infrastructure

Computantis offers remote accounting and payroll services using specialist online platforms and its own cloud infrastructure.

Depending on the services provided and the client's preferences, the following may be used:

• Nula.bg - a specialist online accounting platform for Bulgaria.
• Evala.cz - a specialist online accounting platform for the Czech Republic.
• Computantis's own cloud infrastructure - for secure storage, exchange and management of accounting, payroll and other documents related to the services provided.

Computantis's own cloud infrastructure is hosted on servers located in Member States of the European Union.

Access to information is provided in accordance with the agreed services, assigned user permissions and applicable information security measures.

Use of the external online platforms is optional. The client pays the costs of using them separately from the agreed fees for Computantis services.

Personal data processed through our own cloud infrastructure and external platforms is handled in accordance with the GDPR, applicable national legislation and the relevant data protection arrangements.

Simply visiting computantis.eu does not automatically result in personal data being disclosed to the external accounting platforms mentioned above.

7. Hosting and technical infrastructure

The computantis.eu website uses hosting infrastructure located within the European Union.

The website's hosting is configured for deployment within the European Union.

In providing technical services, the hosting provider may process limited technical data necessary for the operation, security and diagnostics of the service.

Using infrastructure located in the EU does not rule out certain technical operations or services provided by subcontractors involving international processing of data. In such cases, the relevant GDPR requirements and safeguards apply.

8. Recipients of personal data

Personal data may be disclosed or made accessible to a limited range of recipients where necessary for a specific purpose. These may include:

• Hosting and technical support providers.
• Email and communications service providers.
• Consultation scheduling service providers.
• Accounting and payroll platform providers, where their use has been agreed.
• Authorised professional advisers.
• Competent public authorities and supervisory bodies where disclosure is legally required.

Access to personal data is limited to what is necessary for the relevant functions.

Computantis does not sell personal data to third parties.

9. International transfers of personal data

The website's main hosting infrastructure and Computantis's own cloud infrastructure are located in the European Union.

If certain technical or communications services involve transferring personal data outside the European Economic Area, such transfers are carried out in accordance with Chapter V GDPR.

Depending on the circumstances, appropriate legal mechanisms apply, including adequacy decisions or Standard Contractual Clauses, where applicable.

Further information about a particular international transfer and the safeguards used may be requested using the contact details provided.

10. Personal data retention periods

We retain personal data only for as long as necessary for the purposes for which it was collected and to comply with applicable legal obligations.

Enquiry data

Where an enquiry does not lead to a contractual relationship, the data is retained for up to 12 months after the last related communication, unless a justified need or legal basis requires longer retention.

Data relating to contractual relationships

This is retained for the duration of the contractual relationship and afterwards for the periods necessary to comply with legal obligations or to establish, exercise or defend legal claims.

Accounting, tax and payroll documents

These are retained for the periods prescribed by applicable Bulgarian or Czech legislation, depending on the type of document and the nature of the processing.

Technical data

This is retained for the period necessary for website security and operation, in accordance with the settings and retention policies of the systems used.

Once the relevant basis for retention ceases to apply, the data is deleted or anonymised, unless otherwise required by law.

11. Cookies and analytics technologies

As at the date of this Policy, Computantis does not use independently implemented visitor behaviour analytics or advertising tracking tools.

The website may use strictly necessary cookies or similar technologies related to its operation, security and user preferences.

If analytics, advertising or other non-essential technologies are introduced in future, this Policy will be updated.

Where applicable law requires prior consent, the relevant technologies will be activated only after such consent has been obtained.

Visitors will be able to manage and withdraw any consent they have given.

12. Personal data security

Computantis implements appropriate technical and organisational measures to protect personal data against unauthorised access, misuse, loss, alteration or disclosure.

Depending on the risks and systems involved, these measures include:

• Access controls.
• Restrictions on user permissions.
• Protection of electronic communications.
• Appropriate user authentication mechanisms.
• Backups and data recovery measures.
• Restricting access to people with a legitimate work-related need.

The measures are updated as necessary in light of technological developments and identified risks.

13. Your rights

Under the GDPR and subject to its conditions, you have the right:

• To receive information about the processing of your personal data.
• To request access to the personal data we process about you.
• To request rectification of inaccurate or incomplete data.
• To request erasure of personal data where the legal conditions are met.
• To request restriction of processing.
• To object to processing based on legitimate interests.
• To receive your data in a structured, commonly used and machine-readable format and transmit it to another controller where the right to data portability applies.
• To withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• To lodge a complaint with a competent supervisory authority.

To exercise your rights, please email info@bgcz.cz.

We will consider your request without undue delay and, as a rule, within one month of receipt. The period may be extended in the circumstances provided for by the GDPR, in which case you will be informed.

Where necessary, we may request additional information to verify the identity of the person making the request.

14. Automated decision-making

When reviewing enquiries and preparing quotations, Computantis may use technical tools to organise and process the information provided.

At present, the public website does not carry out solely automated decision-making that produces legal effects concerning visitors or similarly significantly affects them within the meaning of Article 22 GDPR.

Individual service proposals are subject to professional review before being finalised.

15. External websites and services

Computantis.eu may contain links to external websites, professional organisations, online platforms and social networks.

These services may have their own privacy policies and terms governing personal data processing.

We recommend reviewing those policies when visiting the relevant external websites.

16. Supervisory authorities

If you believe that the processing of your personal data infringes applicable law, you have the right to lodge a complaint with a competent supervisory authority.

Bulgaria
Commission for Personal Data Protection (CPDP)
cpdp.bg

Czech Republic
Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ)
uoou.gov.cz

You may also lodge a complaint with the competent supervisory authority in the Member State of your habitual residence, place of work or the place of the alleged infringement.

17. Updates to this Policy

Computantis may update this Privacy Policy to reflect changes in legislation, services, technologies or the organisation of personal data processing.

The current version will be published on computantis.eu, stating the date of its latest update.

18. Contact

For questions about this Policy, personal data processing or the exercise of your rights, please contact:

Computantis
Contact person: Ing. Rumyana Peneva-Valacheva
Email: info@bgcz.cz
Website: computantis.eu