1. General Provisions
This Policy describes how EXBIT Ltd. processes personal data of visitors to the website exbit.bg. It has been prepared in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and the Personal Data Protection Act (“PDPA”).
The website is informative in nature. No goods or services are sold, and no payments are processed through it. Registration is not required to browse the website.
2. Data Controller
|
|
| Company Name |
EXBIT Ltd. |
| UIC (BULSTAT) |
123028262 |
| VAT No. |
BG123028262 |
| Registered Office & Registered Address |
99 Bratya Zhekovi Str., Stara Zagora 6000, Bulgaria |
| Phone |
+359 42 601 265; +359 42 644 170 |
| Email |
office@exbit.bg |
| Represented by |
Eng. Evgeniy Hristov and Dr. Rumyana Kazandzhieva, Managers |
For all matters concerning your personal data, you can write to us at office@exbit.bg or by mail at the specified address. EXBIT Ltd. is not required to appoint a Data Protection Officer.
3. What Personal Data We Process
We process only the data necessary for the specific purpose.
- Contact form data: name, phone number, email address, and the content of your message. The name and email fields are mandatory, while the phone field is optional.
- Email correspondence data: when you write to us directly at any of the provided email addresses, we process your address, name, and everything included in your email.
- Job applicant data: CV, cover letter, and the details contained within them when applying for a position listed in the “Careers” section.
- Newsletter subscriber data: email address and optionally name, as well as data on whether you opened the message and which links you clicked.
- Technical data: IP address, browser type and version, operating system, date and time of visit, and files downloaded from the website (such as demo versions and documents). These are processed automatically by the server and by the services described in Section 6.
- Cookies and analytics tools data: pages viewed, duration of visit, traffic source, approximate location (country/city), device type. Analytical and marketing cookies are used only with your consent (Section 8).
Downloading documents and demo versions from the website does not require providing personal data.
We do not collect sensitive data (such as health, religion, or political opinions). Please do not include such details in your messages.
4. Purposes and Legal Grounds
We do not use your data for automated decision-making with legal effects for you, nor do we sell it to third parties.
| Purpose |
Data |
Legal Ground (GDPR) |
| Responding to your inquiry and providing a requested quote or information |
Name, phone, email, message |
Art. 6(1)(b) – steps prior to entering into a contract at your request; for general inquiries – Art. 6(1)(f) – legitimate interest to respond to inquiries |
| Concluding and performing a contract with you or the entity you represent |
Contact details of the contact person |
Art. 6(1)(b) and (f) |
| Compliance with legal obligations (accounting, tax) |
Data in invoices and contracts |
Art. 6(1)(c) |
| Recruitment |
Application data |
Art. 6(1)(b) – steps prior to entering into an employment contract |
| Website operation and protection against spam, bots, and attacks |
IP address, technical data |
Art. 6(1)(f) – legitimate interest in security |
| Traffic statistics and website improvement |
Analytical cookies data |
Art. 6(1)(a) – your consent |
| Advertising campaigns and measuring their effectiveness (remarketing) |
Marketing cookies data |
Art. 6(1)(a) – your consent |
| Sending a newsletter with news and offers |
Email, name |
Art. 6(1)(a) – your consent |
| Protection in legal disputes |
Data related to the dispute |
Art. 6(1)(f) |
Where processing is based on a legitimate interest, you may object to it. Where it is based on consent, you may withdraw it at any time (Section 10).
5. Retention Period
We store data within the timeframes established by law, and where no statutory period is defined, only for as long as necessary for the purpose for which it was collected (Art. 5(1)(e) GDPR).
| Data |
Period |
Ground |
| Accounting documents (invoices, contracts, etc.) |
10 years |
Art. 12 of the Accountancy Act |
| Data related to a concluded contract |
For the duration of the contract and 5 years after its termination |
General limitation period under Art. 110 of the Obligations and Contracts Act |
| Job applications |
Up to 6 months after completion of recruitment, unless consent is given for a longer period |
Art. 25k of the PDPA |
| Inquiries that did not lead to a contract |
As long as necessary to answer the inquiry, after which they are deleted |
Art. 5(1)(e) GDPR |
| Technical data and server logs |
As long as necessary for security and website operation |
Art. 5(1)(e) GDPR |
| Data from analytical and marketing cookies |
Until consent is withdrawn or until the expiration of the respective cookie |
Your consent |
| Newsletter subscriber data |
Until unsubscribed from the newsletter |
Your consent |
Upon expiration of the period, data is deleted or anonymized.
6. Data Recipients
Access to your data is granted only to employees of EXBIT Ltd. who require it for their work. We also use external providers (processors) who process data only according to our instructions, under a contract pursuant to Art. 28 GDPR and with appropriate security measures.
| Recipient Category |
Service |
What Data |
| Hosting service provider |
Hosting of the website and database |
Form data, technical data |
| Email service provider |
Receiving and storing email correspondence |
Content of correspondence |
| Technical support provider |
Maintenance, updates, and website security |
Access to website data only when maintenance is required |
| Cloudflare, Inc. (Turnstile) |
Contact form protection against bots and spam |
IP address, browser and device data |
| Google Ireland Ltd. (Google Maps) |
Embedded map on the “Contacts” page |
IP address, browser data |
| Google Ireland Ltd. (Google Fonts) |
Loading website fonts |
IP address, browser data |
| Google Ireland Ltd. (Google Analytics, Google Ads) |
Traffic statistics, advertising, and campaign measurement |
Cookie data, IP address, device data |
| Meta Platforms Ireland Ltd. (Meta Pixel) |
Advertising on Facebook and Instagram and campaign measurement |
Cookie data, IP address, device data |
| Email marketing provider |
Sending newsletters |
Email, name, message opening data |
| Cookie management tool provider (CookieYes) |
Recording your cookie preferences |
Anonymized IP address, date, and consent choices |
The services of Google Analytics, Google Ads, Meta Pixel, and the newsletter are used only if activated on the website and only after your consent.
We may disclose data to state authorities (e.g., NRA, court, prosecution) when required by law.
7. Data Transfer Outside the EU
Some of the providers in Section 6 (e.g., Google, Meta, and Cloudflare) or their subcontractors may process data outside the European Economic Area, including in the USA.
In these cases, transfers take place only in compliance with the safeguards under Chapter V of the GDPR:
- European Commission adequacy decision, including the EU-U.S. Data Privacy Framework for certified entities; or
- Standard Contractual Clauses approved by the European Commission.
You may request more information about applicable safeguards at office@exbit.bg.
8. Cookies
Cookies are small text files stored by the website in your browser. Upon your first visit, the cookie banner allows you to accept, reject, or select which categories to allow. Without your consent, only strictly necessary cookies are loaded.
| Category |
Purpose |
Examples |
Consent Required |
| Strictly Necessary |
Technical operation and security of the website, form protection, storing cookie preferences |
cookieyes-consent (1 year) |
No |
| Functional |
Embedded third-party content, e.g., Google Maps |
NID (6 months), set by Google |
Yes |
| Analytical |
Anonymous statistics on website visitor count and pages viewed |
_ga, _ga_[ID] (up to 2 years), Google Analytics |
Yes |
| Marketing |
Displaying ads and measuring ad campaigns on Google, Facebook, and Instagram |
_gcl_au (3 months), Google Ads; _fbp (3 months), Meta Pixel |
Yes |
The full and current list of cookies, their providers, and expiration periods is available in the banner via the “Cookie Settings” button.
You may change or withdraw your consent at any time using the same button, as well as delete cookies through your browser settings. Blocking strictly necessary cookies may prevent contact form submission.
Legal basis: consent under Art. 4a of the Electronic Communications Act and Art. 6(1)(a) GDPR; consent is not required for strictly necessary cookies.
9. Job Applicants
Applications submitted under the “Careers” section are sent by email to the addresses listed on the “Contacts” page. We use the data provided solely for recruitment for the relevant or a similar position.
Pursuant to Art. 25k of the PDPA, we store applicant data for up to 6 months after completion of recruitment. If you wish for us to retain your application for a longer period for future positions, we will request your explicit consent. Original documents provided by you will be returned upon request.
Please do not include your Uniform Civil Number (EGN), a copy of your ID card, or other unnecessary data in your CV.
10. Your Rights
Under the GDPR, you have the right to:
- access personal data processed about you;
- request rectification of inaccurate or incomplete data;
- request erasure of data (“right to be forgotten”) when there is no legal basis to retain it;
- request restriction of processing;
- data portability – receive your data in a structured, machine-readable format;
- object to processing based on a legitimate interest;
- withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing prior to withdrawal.
To exercise your rights, write to office@exbit.bg or send a letter to the address in Section 2. We will respond within 1 month. We may ask you to confirm your identity before providing data.
Cookie consent can be withdrawn via the “Cookie Settings” button, and newsletter unsubscription is available via the link at the end of each email.
Right to lodge a complaint. If you believe your rights have been violated, you can file a complaint with the Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592,
www.cpdp.bg.
11. Security, Minors, and Changes
Security. We implement technical and organizational measures to protect data: encrypted connection (HTTPS), protection of forms against automated attacks, restricted access limited to authorized personnel, and regular updates of website software.
Minors. The website is intended for business clients and is not directed at persons under 16 years of age. We do not knowingly collect data from minors.
Changes. We may update this Policy in case of changes in how we process data or in relevant legislation. The current version is always published on this page with the date of the last update.
Last updated: October 19, 2026
