Privacy notice

1. Controller

KADIVEL EOOD, UIC 208282493, 9zh Boris Rumenov St., entrance B, floor 4, apartment 10, Sofia 1407, Bulgaria, is the controller of personal data for Mesto.

For questions or to exercise a right, email legal@mesto.bg. We have not appointed a data protection officer because no statutory requirement has been identified for the current processing; this address is the dedicated privacy contact.

2. Data, purposes, and legal bases

Website use and security

We process IP address and technical data in server logs, short-lived rate-limiting keys, and necessary cookies. The purposes are site delivery, security, diagnostics, and preventing excessive automated requests. The basis is our legitimate interest under Article 6(1)(f) GDPR in maintaining a reliable and secure service.

Property check and personal journey

We process the entered address or cadastral identifier, selected property characteristics, generated report, technical report identifier and, if you use My Mesto, the selected stage, tasks, and financial scenarios. These data ordinarily do not directly identify a person but may become personal data when linked to you through a device, order, or correspondence. For free features the basis is taking steps at your request and our legitimate interest in providing the requested functionality; for a paid report it is contract performance under Article 6(1)(b) GDPR.

Orders and communications

For an order we process email, product, price, currency, payment status and reference, and the time and version of accepted terms and immediate-delivery consent. We do not store full card details. The bases are contract performance, evidence of consumer consent, and statutory accounting and tax duties under Article 6(1)(b) and (c) GDPR.

Public sources

Some official records may include the name and UIC of a trader, legal representative, or legal entity holding a right, as well as addresses and descriptions in administrative acts. We do not import natural-person rows from cadastral rights archives. We process only fields necessary to relate a property to a professional or corporate role. The basis is our legitimate interest under Article 6(1)(f) GDPR in providing verifiable property information, following a necessity and balancing assessment.

3. Where the data comes from

• directly from you: entered criteria, email, requests, and correspondence;
• automatically from the browser and infrastructure: IP address, requested URL, date, technical errors, and necessary identifiers;
• from official public sources listed with links, method, and status on the sources page.

For people whose data comes from public sources, this page is the general Article 14 GDPR notice. Where individual notice is impossible or would involve disproportionate effort, we rely on Article 14(5)(b) only after a documented assessment and appropriate safeguards: we minimise fields, do not index natural persons from cadastral rights, and provide this public notice and an accessible objection channel.

4. Recipients and third-party services

Access is limited to authorised staff and providers necessary for hosting, database, object storage, email, security and, when enabled, payment. Processors are engaged under Article 28 GDPR agreements. Data may be disclosed to a public authority only where a valid legal obligation applies.

When the site loads, the browser may currently connect directly to Google Fonts, jsDelivr, and OpenFreeMap for fonts, a software library, and map tiles. Those providers receive at least the IP address and technical request data. Before production launch we plan to serve fonts and the library locally; OpenFreeMap remains necessary for maps and is described in the cookie notice.

If a provider processes data outside the EEA, we will use an applicable Chapter V GDPR mechanism (such as an adequacy decision or standard contractual clauses) and document the assessment before activation.

5. Retention

• anonymous identifier, personal journey, and saved financial scenarios: up to 180 days after last activity unless deleted sooner;
• unpaid checks and technical events: for the period needed for delivery, security, and troubleshooting, after which they are deleted or irreversibly aggregated under the internal schedule;
• paid reports and contract evidence: while access is needed and until applicable contractual limitation periods expire;
• accounting and tax records: for the statutory period, ordinarily 10 years for accounting information;
• source archives: only where the licence permits and as needed for reproducibility, audit, and legal claims; candidate archives are purged after 2 days and rollback copies after 14 days.

Where an exact period cannot yet be fixed, we apply necessity, source currency, contractual expectations, statutory limitation periods, and pending disputes as criteria. The internal retention schedule must be finally approved before production launch.

6. Your rights

Subject to applicable conditions, you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests. You may withdraw consent prospectively where processing relies on consent. Mesto does not make decisions producing legal or similarly significant effects solely by automated means.

Email legal@mesto.bg and describe the request and the information that lets us locate the record. We may request proportionate identity verification. We respond without undue delay and ordinarily within one month.

You have the right to complain to the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, cpdp.bg, kzld@cpdp.bg, or to the competent authority in your habitual residence.

7. Required data and changes

An address or cadastral identifier is required for the relevant check, and email plus evidence of acceptance are required for a paid order. Without them we cannot provide the requested function or form the contract. Calculator fields are voluntary; if not saved, they remain only in the browser session.

If this notice changes materially, we will publish a new version and, where required, notify affected users appropriately.