Privacy Policy

1. Who we are (personal data controller)

The controller of the personal data processed under this Policy is „НЕВО СОФТ“ EOOD, UIC 208871527, with its registered office and management address at: Sofia 1233, Serdika District, 49 General Stoletov Blvd, second level /floor 1/, office (‘we’, ‘us’).

Contact for privacy questions: contact@firmlocator.com

Postal address: same as stated above

2. Scope

This Privacy Policy applies to Firmlocator and to our websites and services on firmlocator.com, including related subdomains (the “Service”).

3. Data we collect

We do not store full bank card details. Card data is processed by Stripe.

• Account data: email, password hash, name, if provided
• Business profile or listing data: business information, location, contacts, links and images
• Billing data: legal name, VAT number / UIC, billing address and email address, invoices (amounts, dates, currency, taxes), payment status and identifiers in Stripe
• Bank transfers: payer name and payment reference, as well as limited transaction metadata, if available, solely for payment recognition and fraud prevention
• Usage and aggregated metrics: impressions, clicks and portal usage
• Logs and technical metadata: IP address, user agent, timestamps and events
• Records, email verification tokens and statuses
• Cookies and similar technologies: __Host-fl_portal, fl_cookie_consent and localStorage for a temporary registration draft when you use the registration form
• Marketing preferences, consent records and unsubscribe records
• Data from abuse-prevention features and external components: Cloudflare Turnstile and Google Maps / Places may process IP address, browser and device metadata, and request data when you use the relevant features
• Data processed by AI features: content that you provide or that is necessary for the selected feature, for example company profile data, enquiry or project text, name and contact details, review, email subject and content, and correspondence context

4. Why we process your data (purposes and legal bases)

• Provision of the service (accounts, listings, support and billing) — performance of a contract (Art. 6(1)(b))
• Billing, payments and legal compliance — legal obligation (Art. 6(1)(c)) and performance of a contract (Art. 6(1)(b))
• Security and prevention of abuse — legitimate interest (Art. 6(1)(f))
• Analytics and service improvements — legitimate interest (Art. 6(1)(f)) or consent, where required
• Transactional messages (verification, invoices and notifications) — performance of a contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f))
• Marketing messages (reminders and plan upgrade offers) — consent (Art. 6(1)(a)). You can unsubscribe via the link in the message or from your profile settings.

5. Legitimate interests we rely on

Where we rely on legitimate interest, this is usually for protecting the service, preventing fraud and abuse, account and profile security, limiting bot requests, diagnostics, product improvements and protecting our legitimate business interests.

6. Personal data processors and providers

Under the default settings for the business API of these providers, inputs and outputs are not used for model training by default. Temporary storage may apply depending on account settings, contracts, security and abuse prevention requirements, and the law.

• Cloudflare — hosting, CDN, security, WAF, Workers, D1, Turnstile, analytics services, Google Tag Gateway and tag management via Zaraz according to your consent choice
• Stripe — payment processing, subscriptions and billing
• Google — Maps / Places for address search, geocoding and map visualisation
• Microsoft Azure / Microsoft 365 and related email infrastructure — transactional emails and operational communications
• OpenAI — AI-assisted draft creation, classification, moderation, translation and content generation; depending on the feature, it may process the data described in section 3
• Anthropic — backup or specialised provider for AI-assisted drafts, moderation and content generation; depending on the feature, it may process the data described in section 3

7. International transfers

Some providers may process data outside the EEA, the United Kingdom or the country where you are located. Where such transfers occur, we use appropriate safeguards, such as standard contractual clauses and/or applicable data adequacy mechanisms, where available. You may request more information or a copy of the applicable safeguards via contact@firmlocator.com, to the extent permitted.

8. Data retention

• Account data: while the account is active, and afterwards usually for up to 12–24 months for disputes, security and backups
• Listing and profile data: while published or retained for administration; removed or anonymised upon deletion, unless the law requires otherwise
• Invoices and accounting data: 7–10 years or as long as required by applicable tax and accounting law
• Logs, anti-abuse data and security data: usually 90–365 days, unless longer retention is necessary for an incident, dispute or legal requirement
• Aggregated and de-identified metrics: may be retained for longer for reporting and product analytics

9. Security measures

We apply appropriate technical and organisational measures, including TLS encryption, access control, password hashing, security logs and access restriction on a need-to-know basis.

10. Your rights and right to lodge a complaint

You may exercise your rights of access, rectification, erasure, portability, restriction, objection and withdrawal of consent via contact@firmlocator.com. If you are in the EEA or the United Kingdom, you also have the right to lodge a complaint with your local supervisory authority, including the Commission for Personal Data Protection in Bulgaria (CPDP), where applicable. Important: complaints about how we process your personal data are submitted to the supervisory authority described above; complaints about a specific business profile in Firmlocator (misleading information, wrong category, copied content, etc.) are handled through contact@firmlocator.com under the editorial complaints process described in section 15 of the Terms and section 7 of the Directory Rules.

11. When data is mandatory

Some data is contractually or legally required so that we can create an account, publish a profile, verify ownership, issue an invoice, accept payment, or respond to an enquiry. If you do not provide it, we may be unable to activate a service, publish a profile, or comply with our legal obligations.

12. US Privacy

US enquiries: contact@firmlocator.com. We do not sell personal data and do not share it for cross-context behavioural advertising.

13. Children

The Service is not directed to children. If applicable law allows use by minors only from a certain age or with parental authorisation, additional age and consent requirements may apply; in Bulgaria this may be relevant below 14 years of age where consent is the legal basis.

14. Changes

We may update this Policy and will publish the new version with an updated date.

15. Automated decision-making

We do not currently carry out automated decision-making or profiling with significant legal or similarly material effects on you. If this changes in a material way, we will update this policy and the relevant product flows.

16. Safety, fraud and rules-enforcement review

We may process submitted content and business data for automated and manual review for the purposes of safety, fraud prevention, abuse protection and enforcement of the platform rules.

• This may include company name, descriptions, services, keywords, categories, links, public contacts and other fields that affect the public profile.
• Where necessary, we may mark a profile for additional review, request corrections or restrict publication pending an administrative decision.
• These checks are used to protect the directory, users and legitimate businesses from misleading, fraudulent or prohibited profiles.
• Where we use external processing services for safety or analysis, this is done under appropriate contractual, technical and organisational measures.

17. Verified client records

When a client confirms a working relationship with a company via the “verified client” feature, we record the data necessary to display the badge and maintain an audit trail. The confirmer’s name, as well as the optional comment, role and company, are displayed publicly on the company profile. The confirmer’s email address is not displayed publicly.

• Data collected: confirmer’s email, name, optionally role and company, optionally a public comment of up to 140 characters, verification status (pending / confirmed / withdrawn / flagged) and audit timestamps.
• Public display: only the confirmer's name and the optional comment, role and company are shown on the business's public profile. The confirmer's email is not published.
• Legal basis: consent (Art. 6(1)(a) of GDPR) for the public display of name, comment, role and company — the confirmer explicitly clicks a confirmation link; and legitimate interest (Art. 6(1)(f) of GDPR) for maintaining an audit trail of verifications so that we can prove that the verification was genuine and withdraw it on request.
• Withdrawal: the confirmer may withdraw the confirmation at any time via the link in their email. Withdrawal removes the public display and marks the record as withdrawn.
• Retention period: active verifications are kept while the badge is displayed; withdrawn or flagged records are kept for the moderation audit-trail period (see section 8) for fraud prevention and audit purposes.

18. Reports concerning a company profile

When you submit a report about a profile on Firmlocator (see section 15 of the Terms), we record the report and the editorial communication so that we can respond, give the company a right of reply and preserve an audit trail.

• Data collected: sender’s name, sender’s email, report text and any attachments, the company’s written response, the editorial decision and the relevant timestamps.
• Sharing: where applicable, we forward the report to the company so that it can respond. By default, we hide your email address from the forwarded copy; we share your contact details with the company only if you expressly request this.
• Legal basis: legitimate interest in protecting consumers and the integrity of the directory (Art. 6(1)(f) of GDPR) and legal obligation (Art. 6(1)(c) of GDPR), where applicable consumer or hosting legislation requires action on a report.
• Retention period: reports, responses and decisions are kept for the same period as moderation records (see section 8 and section 14, letter “d” of the Terms) — currently up to 3 years — for audit and quality control purposes.

19. Notification emails for new enquiries to companies

When a user sends an enquiry to a registered company via the enquiry form or project description, we send the enquiry by email to the registered owners of the relevant company in the portal and also display it in their portal. This allows the company to respond directly to the user.

• Data forwarded: the user’s name, email and message, as well as any additional fields they have completed, so that the company can respond. We process these data on the basis of performance of a contract with the registered company and the legitimate interest in maintaining the directory (Art. 6(1)(b) and (f) of GDPR).
• Enabled by default and opt-out: owners in the portal are opted in by default to receive notifications of new enquiries. Each notification email contains a one-click unsubscribe link that stops future notifications for the relevant company. The link is company-specific, so unsubscribing from one profile does not affect the other companies managed by the same owner.
• These are operational notifications about a user enquiry, not marketing messages. Users who have submitted an enquiry may request deletion of their enquiry at any time via contact@firmlocator.com.

20. Public unclaimed company profiles

Firmlocator may publish basic information about companies and business premises in public unclaimed profiles. These profiles may be created on the basis of publicly available information, open sources, public registers, public business pages and/or user suggestions. If a profile is not marked as verified, this means it has not been claimed or verified by a representative of the company concerned.

The information in such a profile may include company name, trading name, category, address or locality, telephone number, email, website, description, photos, company registration number or another publicly available identifier, where published or necessary for the proper distinction of the company.

Where the published information contains personal data, for example in the case of sole traders, managers, representatives, personal emails or telephone numbers, the processing is carried out on the basis of legitimate interest under Art. 6(1)(f) of GDPR. The legitimate interest is maintaining a transparent B2B directory, facilitating the discoverability of businesses and providing a mechanism for correcting incomplete, outdated or inaccurate public information.

If the personal data have not been obtained directly from you, this section provides information pursuant to Art. 14 of GDPR. You have the right to request access, rectification, erasure or restriction of processing, as well as to object to processing pursuant to Art. 21 of GDPR. You also have the right to lodge a complaint with the Commission for Personal Data Protection.

You may exercise your rights through the options for claiming a profile, suggesting a correction, submitting a report, GDPR request or removal request, available from the relevant profile or via the contact page.