Privacy Policy

Вълшебните Метли ООД (Magic Brooms Ltd.) · vulshebnitemetli.com · Last updated: 17 October 2026

1. Introduction

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, share and protect personal data when you visit https://vulshebnitemetli.com (the “Website”), contact us, request a quote or use our cleaning services. It is prepared in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and the Bulgarian Personal Data Protection Act.

2. Who is the data controller

The controller of your personal data is:

Вълшебните Метли ООД (Vulshebnite Metli OOD, trading as Magic Brooms), UIC/EIK 207247998, VAT BG207247998

Registered seat: Sofia 1000, Iskar district, Druzhba 1 residential complex, bl. 157, entr. B, floor 1, apt. 28, Bulgaria

Office address: Sofia, Mladost 3 residential complex, 51 Aleksandar Malinov Blvd., Metro City Center, 1712 Sofia, Bulgaria

Email: [email protected]

Phone: +359 88 400 3000

We have not appointed a Data Protection Officer, because we are not required to by law. For any privacy question or request, write to [email protected].

3. What personal data we collect

Depending on how you interact with us, we may process the following data.

Enquiries and quote requests (contact form, phone, email, messaging): name, phone number, email address, company name and position, address or location of the site to be cleaned, type and size of premises, desired services and schedule, the content of your message and any photos or files you send us.

Clients and service recipients: identification and contact details, billing details, service history, agreed schedule and prices, invoices and payment records, communication with us, complaints and feedback. Individual Consumers provide this data themselves; for Business Clients, we process data of their representatives and contact persons.

Site access data: where you entrust us with keys, access cards, alarm or door codes, or tell us about pets, alarms and other site details, we process this information only to perform the service.

Technical data about your visit: IP address, device and browser type, language, pages viewed, date and time of access, referring page, and information collected through cookies and similar technologies (see our Cookie Policy).

Reviews and public interactions: content you post about us on Google, Facebook, Instagram, LinkedIn, YouTube or TikTok, and messages you send us through those platforms.

We do not intentionally collect special categories of personal data (such as health data). Please do not include such data in your messages unless it is necessary for the service, for example allergies relevant to cleaning products.

4. Why we use your data and on what legal basis

Answering your enquiry and preparing a quote – steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

Concluding and performing the service agreement (scheduling, performing the service, invoicing, payments, customer support) – performance of a contract (Art. 6(1)(b)).

Meeting legal obligations (accounting, tax and invoicing records, responding to authorities) – legal obligation (Art. 6(1)(c)).

Handling complaints, protecting our rights and claims, quality control and service improvement – our legitimate interests (Art. 6(1)(f)).

Operating and securing the Website, preventing abuse and fraud – our legitimate interests (Art. 6(1)(f)).

Analytics and measuring advertising performance through non-essential cookies – your consent (Art. 6(1)(a)), given through the cookie banner.

Sending marketing messages (newsletters, offers) by email, SMS or similar – your consent (Art. 6(1)(a)). If you are an existing client, we may send you information about similar services where the law allows, and you can opt out at any time.

Where we rely on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal. Where we rely on legitimate interests, you have the right to object (see section 9).

Providing data through the contact form is voluntary, but without the data marked as required we cannot respond to your enquiry or provide a quote.

5. Who we share your data with

We do not sell your personal data. We share it only where necessary and only with:

Service providers (processors) that help us run our business, under data processing agreements: providers of the website, CRM and marketing automation platform (HighLevel / GoHighLevel and related hosting and content delivery services), email and communication tools, cloud storage, accounting and invoicing software, IT support.

Professional advisers and accountants, where necessary for accounting, tax, legal or audit purposes.

Subcontractors performing parts of the cleaning services at your site, who receive only the data needed to do so.

Payment and banking providers, when payments are made by transfer or card.

Analytics and advertising providers (for example Google or Meta), only if you consent to the relevant cookies.

Public authorities, courts and other bodies, where we are required by law or need to establish, exercise or defend legal claims.

6. Transfers outside the European Economic Area

Some of our providers, such as HighLevel and Google, are established in or may process data in countries outside the EEA, including the United States. Where this happens, we make sure that appropriate safeguards are in place, such as an adequacy decision of the European Commission (including the EU–US Data Privacy Framework for certified companies) or the EU Standard Contractual Clauses. You can request more information about these safeguards by writing to us.

7. How long we keep your data

Enquiries that do not lead to a contract: up to 12 months after our last communication, unless you ask us to delete them earlier.

Client and contract data: for the duration of the contract and then for the periods required by accounting, tax and other legislation. Invoices and accounting records are kept for the statutory periods.

Keys, access cards and codes: only for the duration of the engagement; returned or securely deleted at the end or on your request.

Complaints and claims: until the matter is resolved and for the limitation period applicable to possible claims.

Marketing consents and subscriptions: until you withdraw consent or unsubscribe.

Cookie data: for the periods stated in our Cookie Policy.

After these periods, we delete or anonymise the data.

8. How we protect your data

We apply appropriate technical and organisational measures, including access controls limited to authorised staff, confidentiality obligations for employees and subcontractors, secure storage of keys and access codes, encrypted connections (HTTPS) on the Website, and regular review of the tools we use. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security. If a breach affecting your rights occurs, we will notify you and the competent authority as required by law.

9. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you and receive a copy;

rectification of inaccurate or incomplete data;

erasure (“right to be forgotten”) where the conditions of the law are met;

restriction of processing in certain cases;

data portability – to receive data you provided in a structured, commonly used, machine-readable format and to have it transferred to another controller, where processing is based on consent or contract and carried out by automated means;

object to processing based on legitimate interests, and to direct marketing at any time;

withdraw consent at any time, where processing is based on consent;

not be subject to automated decision-making, including profiling, that produces legal effects – we do not make such decisions.

To exercise your rights, email [email protected]. We may need to verify your identity. We will respond within one month, which may be extended by up to two further months for complex requests, in which case we will inform you.

10. Complaints

If you believe that your data is processed unlawfully, you have the right to lodge a complaint with the supervisory authority. In Bulgaria this is the Commission for Personal Data Protection (Комисия за защита на личните данни, КЗЛД): 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia; www.cpdp.bg; [email protected]. You may also contact the authority in the EU country where you live or work. We would appreciate the chance to address your concern first, so please contact us.

11. Marketing communications

We send newsletters or promotional messages only where you have given consent, or where the law otherwise allows. Every message contains a simple way to unsubscribe, and you can also write to us at any time. Service messages related to a booked service (confirmations, scheduling, invoices) are not marketing and are sent as part of the contract.

12. Children

The Website and our services are not directed at children. We do not knowingly collect personal data from persons under 18 through the Website. If you believe a child has provided data to us, please contact us and we will delete it.

13. Third-party websites and social media

The Website contains links to third-party platforms, including Google, Facebook, Instagram, LinkedIn, YouTube and TikTok. These are independent controllers with their own privacy policies, and we are not responsible for how they process your data.

14. Changes to this Policy

We may update this Privacy Policy from time to time. The current version is always available on the Website with its date of last update. If we make material changes, we will take reasonable steps to inform you.

15. Contact

Вълшебните Метли ООД, 51 Aleksandar Malinov Blvd., Metro City Center, 1712 Sofia, Bulgaria · [email protected] · +359 88 400 3000