Privacy Policy

1. Who operates the service

Rental Apartments Sofia is the website brand used by РЕФЕР ПЛЮС ЕООД (REFER PLUS Ltd), UIC/EIK 204945810. It is not a separate legal entity. REFER PLUS Ltd provides the rental assistance service and is the intended data controller because it determines the purposes and means of processing enquiry information.

Registered address

6 Nerazdelni Street, Lozenets District, Sofia, Bulgaria

Privacy and enquiries

rentalapartmentssofia@gmail.com

Phone

+359 877 268 787

2. Information you provide

Depending on which form you use and what you choose to share, we collect:

• Full name and email address.
• Optional phone or WhatsApp number.
• Preferred area in Sofia.
• Apartment size or number of bedrooms.
• Monthly rental budget.
• Move-in timing.
• Optional comments, requirements or other information you include in your message.

The apartment questionnaire collects your rental preferences in separate steps. The standalone contact form collects your name, email, optional phone, budget and message; rental preferences may also be included in that message. Please avoid including sensitive personal information or identity documents in these enquiry forms.

3. Why we use this information

We use enquiry information to respond to your request, understand your rental requirements, communicate with you, arrange viewings and provide the rental assistance you request.

4. Lawful basis

Where processing is necessary to respond to your request, take steps at your request before entering a contract, or perform an agreed service, the applicable basis may be Article 6(1)(b) of the General Data Protection Regulation (GDPR).

Where specific records must be retained to meet a legal obligation, Article 6(1)(c) may apply. Any additional processing must have an appropriate lawful basis identified by the controller. Sending a form does not constitute consent to all processing. If a separate activity requires consent, it must be requested separately and may be withdrawn without affecting the lawfulness of earlier processing.

5. How enquiries are handled

Enquiries are received through the website. The intended enquiry workflow uses Google Apps Script to receive the information, Google Sheets to manage enquiry records, and email for notifications and communication. The actual deployed script, spreadsheet mappings and permissions, and notification recipients remain subject to verification by the controller; this policy does not confirm that every submission is successfully saved or emailed.

6. Access and recipients

According to the controller’s current access arrangement, direct access to the Google Sheets enquiry database is limited to the two authorised people identified by the controller. The spreadsheet is not shared directly with brokers. Relevant enquiry details may be forwarded to an assigned broker when necessary to handle your request.

The controller must confirm that the two authorised account holders act under its instructions and have appropriate confidentiality and access arrangements. Website hosting, Google Apps Script, Google Sheets and email services may also handle information as part of providing their services. Their applicable roles, terms, access arrangements and any other recipients must be verified against the deployed configuration. Information may also need to be disclosed where required by law.

7. How long information is kept

• Unsuccessful or inactive enquiries: the proposed period is up to six months after the last meaningful contact, subject to controller approval and any legal need for longer retention. This is a proposal, not a confirmed deletion schedule.
• Active enquiries: while the requested rental search remains active, with periodic review of whether the information is still needed.
• Completed transactions and legally required records: for the applicable statutory periods, depending on the record and legal obligation.

The approved schedule should cover enquiry records and related emails, not only spreadsheet rows. No specific statutory period is asserted here without confirmation of the applicable requirements.

8. Your data protection rights

Under the GDPR, subject to the conditions and exceptions that apply to each right, you may request access to your personal data, correction of inaccurate or incomplete data, erasure, or restriction of processing. You may object where the applicable lawful basis gives you that right. Data portability applies where the relevant conditions are met, including qualifying automated processing based on consent or contract.

To exercise a right, contact rentalapartmentssofia@gmail.com. Describe your request and the enquiry it concerns. We may need proportionate information to verify your identity before disclosing or changing personal data. Requests should be handled within the applicable GDPR time limits; we will explain any lawful limitation or extension.

You also have the right to complain to Bulgaria’s Commission for Personal Data Protection (CPDP / KZLD). Information on the authority and its complaint procedures is available at cpdp.bg. You do not have to contact us first to make a complaint.

9. Security and international transfers

The controller is responsible for appropriate technical and organisational safeguards proportionate to the risks, including limiting access to people who need the information and reviewing permissions. The actual access controls and confidentiality arrangements require verification. No system can be guaranteed completely secure, and this policy makes no claim of a security certification or completed formal GDPR compliance audit.

Provider arrangements may involve processing outside the European Economic Area. Actual storage locations, transfer destinations and applicable safeguards have not been confirmed. The controller must verify whether transfers occur and, where applicable, identify the relevant GDPR transfer mechanism, such as an applicable adequacy decision or appropriate contractual safeguards. You can contact the privacy email for information about the confirmed arrangements and any applicable safeguards.

10. Website technologies

The website loads Plus Jakarta Sans through Google Fonts, which involves your browser contacting Google’s font services. Requests to website hosting, font and media services can involve technical information such as an IP address and browser request details. The controller must review the applicable provider arrangements and whether further disclosures or consent are needed.

Any analytics, cookies or other technologies in the published website must also be checked before publication. This policy does not confirm that the website is cookie-free or that no analytics are used.

11. Changes to this policy

This page may be updated when the service, processing practices or legal requirements change. Material changes should be clearly identified and, where required, communicated to affected people. The controller should confirm the outstanding arrangements above and record the approved revision date before publication.