Privacy Policy

Privacy Policy and Cookies:

Effective Date: January 1, 2026

I. DATA CONTROLLER

"Century Homes" Ltd.
UIC: 104687201
Registered office: Veliko Tarnovo 5000, 4 Rafael Mihaylov Str., Floor 2
Manager: Kaloyan Sashev Ganev
Email: customercare@ch-eu.com
Phone: +359 897 964 343

II. LEGAL FRAMEWORK

This policy has been prepared in accordance with:

• Regulation (EU) 2016/679 (GDPR)
• Personal Data Protection Act (PDPA)
• Electronic Document and Electronic Trust Services Act (EDETSA)
• Anti-Money Laundering Act (AMLA)
• Consumer Protection Act (CPA)
• Commercial Act (CA)

III. SCOPE AND PURPOSES OF PROCESSING

3.1. Scope

The policy covers the processing of personal data through:

• Website ch-eu.com and mobile version m.ch-eu.com
• Bitrix24 CRM system and internal systems
• Communication channels (email, phone, SMS, WhatsApp, Viber)

3.2. Purposes of Processing

IV. DATA CATEGORIES AND DATA SUBJECTS

4.1. Data Subjects

• Clients (buyers, sellers, landlords, tenants)
• Website users
• Contractors and partners
• Employees and agents of the company

4.2. Categories of Personal Data

Identification Data:

• Full name
• Personal ID number
• ID card number
• Permanent and current address

Contact Data:

• Phone number
• Email address
• WhatsApp/Viber profiles

Transaction Data:

• Property offers
• Contracts and annexes
• Viewing protocols
• Payment data

Communication Records:

• Emails
• Bitrix24 chat messages
• SMS and Viber messages

Technical Data:

• IP address
• Device and browser data
• Site browsing history
• Cookie identifiers

V. PROCESSING IN BITRIX24 AND INTERNAL SYSTEMS

5.1. Bitrix24 CRM System

This policy covers all activities of collecting, storing and processing personal data within Bitrix24 and the company's internal systems, where the following are stored:

• Client contact information
• Communication history
• Transaction documents
• Tasks and reminders
• Protocols and contracts

5.2. Access and Security in Bitrix24

• Access is granted only to authorized employees and administrators
• Mandatory two-factor authentication
• All actions are logged and tracked
• Data is stored on secure servers in the EU
• Employees have undergone data protection training
• Signed confidentiality declarations

5.3. Archives and Backups

• Daily automatic backups
• Archive storage up to 30 days
• Encryption of all backup copies

VI. ELECTRONIC CONSENT AND SIGNATURES

6.1. Forms of Consent

The client gives consent for personal data processing by signing mediation contracts or through electronic confirmation via:

• Handwritten signature on paper document
• Simple electronic signature – filling out online form
• Advanced electronic signature – two-factor verification (SMS + email)
• Qualified electronic signature (QES)
• Confirmation via Bitrix24, SMS, WhatsApp or email

6.2. Evidential Value

According to Art. 13 of EDETSA and Art. 160 of the Civil Procedure Code:

• Any confirmation received electronically has evidential value
• The CRM system stores: date, time, IP address, confirmation content
• WhatsApp/Viber messages are equivalent to written form
• Records serve as proof of consent given

VII. RIGHTS OF DATA SUBJECTS

7.1. Basic Rights

• Access – to receive information about what data we process
• Rectification – to correct inaccurate data
• Erasure – “the right to be forgotten”
• Restriction – temporary suspension of processing
• Portability – receiving in structured format
• Objection – against certain types of processing
• Withdrawal of consent – at any time, without affecting prior processing

7.2. How to Exercise Your Rights

• Send a written request to: customercare@ch-eu.com
• Attach a copy of an identity document
• You will receive a response within 30 days

VIII. DATA SHARING

8.1. Who We Share Data With

We share personal data only when necessary and only with:

• State authorities (NRA, CPDP) – when legally required
• Notaries – for real estate transactions
• Accounting and legal consultants – under confidentiality clause
• Technical providers (Bitrix24, hosting) – under data processing agreements

8.2. International Transfers

When using services such as Google Analytics or Facebook, data may be transferred outside the EU under the protection of:

• EU Standard Contractual Clauses (SCCs)
• Additional technical and organizational measures

We DO NOT sell or provide your data to third parties for marketing purposes.

IX. DATA SECURITY

9.1. Technical Measures

• SSL encryption of all connections
• Secure EU-based servers with firewall protection
• Regular security and system updates
• Antivirus and anti-malware protection
• Two-factor authentication in Bitrix24

9.2. Organizational Measures

• Staff training on GDPR
• Confidentiality declarations from all employees
• Role-based access control (“need-to-know” principle)
• Documented data incident procedures

9.3. Security Breaches

In case of a personal data breach or unauthorized access:

• We notify CPDP within 72 hours (Art. 33 GDPR)
• We inform affected data subjects when there is a high risk (Art. 34 GDPR)
• We document all incidents and corrective measures taken

X. STORAGE PERIODS

After the period expires, data is deleted or archived securely.

XI. COOKIE POLICY

11.1. What are Cookies

"Cookies" are small text files that the site sends to your device to:

• Ensure basic functions
• Remember your preferences
• Analyze traffic
• Personalize content

11.2. Types of Cookies We Use

Essential Cookies

• Necessary for basic site functions
• Language settings, session, chat
• Cannot be disabled

Analytics Cookies

• Google Analytics for statistics
• Analysis of visits and behavior
• Duration: up to 50 months
• Opt-out of Google Analytics

Marketing Cookies

• Facebook Pixel and Google Ads
• Personalized ads and remarketing
• Duration: 90 days
• Google Ads Settings
• Facebook Settings

Functional Cookies

• Remembering preferences and searches
• Recently viewed offers
• Duration: up to 12 months

Session Cookies

• Temporary, for navigation between pages
• Deleted when browser closes

11.3. Cookie Management

• On first visit: You will see a banner to choose cookies
• Through browser: You can control cookies from settings
• Warning: Blocking may impair site functionality

11.4. Third-Party Cookies

We use services from Google, Facebook/Meta, and YouTube, which are managed by their respective providers.

More information: aboutcookies.org

XII. CHILDREN

We do not knowingly collect data from persons under 18 years old. If you are a parent and find that your child has provided personal data, please contact us for deletion.

XIII. POLICY CHANGES

• The policy may be updated periodically
• For significant changes we will notify you by email in accordance with the General Terms
• Cookie changes take effect immediately for new users and after 30 days for existing users
• The current version is always available at ch-eu.com

XIV. CONSENT DECLARATION

By signing a mediation contract, using our services or providing electronic confirmation, you declare that:

• ☑ You are familiar with this Privacy Policy
• ☑ You give consent for your personal data to be processed for the stated purposes
• ☑ You understand your GDPR rights and how to exercise them
• ☑ You accept communication and confirmations through electronic means (SMS, WhatsApp, email, Bitrix24)
• ☑ Electronic confirmation has the same force as a handwritten signature
• ☑ You can withdraw your consent at any time
• ☑ You agree to the use of cookies according to this policy

XV. CONTACT

Data Protection Officer:

Email: customercare@ch-eu.com
Phone: +359 897 964 343
Address: Veliko Tarnovo, 4 Rafael Mihaylov Str., Floor 2

Supervisory Authority:

Commission for Personal Data Protection (CPDP)
Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
Phone: +359 2 915 3580
Email: kzld@cpdp.bg
Website: www.cpdp.bg

This policy has been adopted by the manager of "CENTURY HOMES" Ltd. and takes effect on January 1, 2026.

© 2026 "Century Homes" Ltd. All rights reserved.