Privacy Policy and Cookies – Century Homes Ltd.
Privacy Policy and Cookies:
Effective Date: January 1, 2026
I. DATA CONTROLLER
"Century Homes" Ltd.
UIC: 104687201
Registered office: Veliko Tarnovo 5000, 4 Rafael Mihaylov Str., Floor 2
Manager: Kaloyan Sashev Ganev
Email: customercare@ch-eu.com
Phone: +359 897 964 343
II. LEGAL FRAMEWORK
This policy has been prepared in accordance with:
- Regulation (EU) 2016/679 (GDPR)
- Personal Data Protection Act (PDPA)
- Electronic Document and Electronic Trust Services Act (EDETSA)
- Anti-Money Laundering Act (AMLA)
- Consumer Protection Act (CPA)
- Commercial Act (CA)
III. SCOPE AND PURPOSES OF PROCESSING
3.1. Scope
The policy covers the processing of personal data through:
- Website ch-eu.com and mobile version m.ch-eu.com
- Bitrix24 CRM system and internal systems
- Communication channels (email, phone, SMS, WhatsApp, Viber)
3.2. Purposes of Processing
| Purpose |
Legal Basis |
Storage Period |
| Performance of mediation contracts |
Contract (Art. 6.1.b GDPR) |
3 years |
| Management of client relationships and transactions |
Legitimate interest |
3 years |
| Preparation of offers, protocols and documents |
Contract |
3 years |
| Reservations and client communication |
Contract/Consent |
1 year |
| Response to inquiries |
Legitimate interest |
1 year |
| Marketing communications |
Consent |
Until withdrawal |
| Accounting documents |
Legal obligation |
5 years |
| AML checks and documentation |
Legal obligation (AMLA) |
5 years |
IV. DATA CATEGORIES AND DATA SUBJECTS
4.1. Data Subjects
- Clients (buyers, sellers, landlords, tenants)
- Website users
- Contractors and partners
- Employees and agents of the company
4.2. Categories of Personal Data
Identification Data:
- Full name
- Personal ID number
- ID card number
- Permanent and current address
Contact Data:
- Phone number
- Email address
- WhatsApp/Viber profiles
Transaction Data:
- Property offers
- Contracts and annexes
- Viewing protocols
- Payment data
Communication Records:
- Emails
- Bitrix24 chat messages
- SMS and Viber messages
Technical Data:
- IP address
- Device and browser data
- Site browsing history
- Cookie identifiers
V. PROCESSING IN BITRIX24 AND INTERNAL SYSTEMS
5.1. Bitrix24 CRM System
This policy covers all activities of collecting, storing and processing personal data within Bitrix24 and the company's internal systems, where the following are stored:
- Client contact information
- Communication history
- Transaction documents
- Tasks and reminders
- Protocols and contracts
5.2. Access and Security in Bitrix24
- Access is granted only to authorized employees and administrators
- Mandatory two-factor authentication
- All actions are logged and tracked
- Data is stored on secure servers in the EU
- Employees have undergone data protection training
- Signed confidentiality declarations
5.3. Archives and Backups
- Daily automatic backups
- Archive storage up to 30 days
- Encryption of all backup copies
VI. ELECTRONIC CONSENT AND SIGNATURES
6.1. Forms of Consent
The client gives consent for personal data processing by signing mediation contracts or through electronic confirmation via:
- Handwritten signature on paper document
- Simple electronic signature – filling out online form
- Advanced electronic signature – two-factor verification (SMS + email)
- Qualified electronic signature (QES)
- Confirmation via Bitrix24, SMS, WhatsApp or email
6.2. Evidential Value
According to Art. 13 of EDETSA and Art. 160 of the Civil Procedure Code:
- Any confirmation received electronically has evidential value
- The CRM system stores: date, time, IP address, confirmation content
- WhatsApp/Viber messages are equivalent to written form
- Records serve as proof of consent given
VII. RIGHTS OF DATA SUBJECTS
7.1. Basic Rights
- Access – to receive information about what data we process
- Rectification – to correct inaccurate data
- Erasure – “the right to be forgotten”
- Restriction – temporary suspension of processing
- Portability – receiving in structured format
- Objection – against certain types of processing
- Withdrawal of consent – at any time, without affecting prior processing
7.2. How to Exercise Your Rights
- Send a written request to: customercare@ch-eu.com
- Attach a copy of an identity document
- You will receive a response within 30 days
VIII. DATA SHARING
8.1. Who We Share Data With
We share personal data only when necessary and only with:
- State authorities (NRA, CPDP) – when legally required
- Notaries – for real estate transactions
- Accounting and legal consultants – under confidentiality clause
- Technical providers (Bitrix24, hosting) – under data processing agreements
8.2. International Transfers
When using services such as Google Analytics or Facebook, data may be transferred outside the EU under the protection of:
- EU Standard Contractual Clauses (SCCs)
- Additional technical and organizational measures
We DO NOT sell or provide your data to third parties for marketing purposes.
IX. DATA SECURITY
9.1. Technical Measures
- SSL encryption of all connections
- Secure EU-based servers with firewall protection
- Regular security and system updates
- Antivirus and anti-malware protection
- Two-factor authentication in Bitrix24
9.2. Organizational Measures
- Staff training on GDPR
- Confidentiality declarations from all employees
- Role-based access control (“need-to-know” principle)
- Documented data incident procedures
9.3. Security Breaches
In case of a personal data breach or unauthorized access:
- We notify CPDP within 72 hours (Art. 33 GDPR)
- We inform affected data subjects when there is a high risk (Art. 34 GDPR)
- We document all incidents and corrective measures taken
X. STORAGE PERIODS
| Type of Data |
Storage Period |
Basis |
| Mediation contracts |
3 years |
Limitation period under LOC |
| Accounting documents |
5 years |
Accounting Act |
| AML documentation |
5 years |
Anti-Money Laundering Act |
| Site registration data |
Until deletion by user |
Consent |
| Marketing subscriptions |
Until withdrawal |
Consent |
| System logs |
1 year |
Security |
| Backup copies |
30 days |
Recovery |
| Correspondence, complaints, signals |
3 years |
Limitation period |
| CVs of candidates |
1 month |
Personnel selection |
| Cookies |
Up to 12 months |
Functionality |
After the period expires, data is deleted or archived securely.
XI. COOKIE POLICY
11.1. What are Cookies
"Cookies" are small text files that the site sends to your device to:
- Ensure basic functions
- Remember your preferences
- Analyze traffic
- Personalize content
11.2. Types of Cookies We Use
Essential Cookies
- Necessary for basic site functions
- Language settings, session, chat
- Cannot be disabled
Analytics Cookies
- Google Analytics for statistics
- Analysis of visits and behavior
- Duration: up to 50 months
- Opt-out of Google Analytics
Marketing Cookies
Functional Cookies
- Remembering preferences and searches
- Recently viewed offers
- Duration: up to 12 months
Session Cookies
- Temporary, for navigation between pages
- Deleted when browser closes
11.3. Cookie Management
- On first visit: You will see a banner to choose cookies
- Through browser: You can control cookies from settings
- Warning: Blocking may impair site functionality
11.4. Third-Party Cookies
We use services from Google, Facebook/Meta, and YouTube, which are managed by their respective providers.
More information: aboutcookies.org
XII. CHILDREN
We do not knowingly collect data from persons under 18 years old. If you are a parent and find that your child has provided personal data, please contact us for deletion.
XIII. POLICY CHANGES
- The policy may be updated periodically
- For significant changes we will notify you by email in accordance with the General Terms
- Cookie changes take effect immediately for new users and after 30 days for existing users
- The current version is always available at ch-eu.com
XIV. CONSENT DECLARATION
By signing a mediation contract, using our services or providing electronic confirmation, you declare that:
- ☑ You are familiar with this Privacy Policy
- ☑ You give consent for your personal data to be processed for the stated purposes
- ☑ You understand your GDPR rights and how to exercise them
- ☑ You accept communication and confirmations through electronic means (SMS, WhatsApp, email, Bitrix24)
- ☑ Electronic confirmation has the same force as a handwritten signature
- ☑ You can withdraw your consent at any time
- ☑ You agree to the use of cookies according to this policy
XV. CONTACT
Data Protection Officer:
Email: customercare@ch-eu.com
Phone: +359 897 964 343
Address: Veliko Tarnovo, 4 Rafael Mihaylov Str., Floor 2
Supervisory Authority:
Commission for Personal Data Protection (CPDP)
Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
Phone: +359 2 915 3580
Email: kzld@cpdp.bg
Website: www.cpdp.bg
This policy has been adopted by the manager of "CENTURY HOMES" Ltd. and takes effect on January 1, 2026.
© 2026 "Century Homes" Ltd. All rights reserved.