Privacy Policy

This policy explains what personal data the Property by the Black Sea platform collects, why it collects them, whom it passes them to and what rights you have. Details of the operator are published on the Legal information page.

Who processes your data

The controller of personal data is „ИФКЕЕС“ ЕООД (IFKEES LTD), company number 208715371. For questions about this policy: office@ifkees.bg.

What data we collect and on what basis

Enquiry through the form in a listing

We collect your name, email, phone number (if you fill it in) and the text of your message, together with the listing you are asking about. The basis is your explicit consent and the taking of steps at your request before entering into a contract (Art. 6(1)(a) and (b) GDPR). Without these data we cannot answer your enquiry.

Request for a video viewing

When you request a video viewing of a property, we collect your name and telephone number, the date and time you would like, your time zone and the listing the request is about. An email address is optional. The request is stored in the internal enquiry log and sent to the distributor of the listing, who contacts you and confirms the time. The basis is your consent and the taking of steps at your request before entering into a contract (Art. 6(1)(a) and (b) GDPR). Without a telephone number we cannot arrange the viewing.

Proposing a property through the restricted-access form

If you are given access and propose a property through the form, we collect your name and telephone, the capacity in which you propose the property, your email if you give one, the details of the property you filled in, the photographs you uploaded, the text of the declaration by which you confirm your rights to them, and the language the form was filled in. Your IP address is not stored with the submission. The basis is the taking of steps at your request before entering into a contract and your consent, Art. 6(1)(a) and (b) GDPR.

Your contact details are not published. The name, telephone and email stay in the internal part of the listing and only our team sees them. The page of the property shows the telephone of the distributor of the listing, not yours. What goes public is only what you wrote about the property itself, together with its photographs.

A submission is a submission and not a publication. Someone from the team reads and checks it before the listing appears on the site. Until then the photographs sit outside the public part of the server and cannot be opened by address.

If you gave an email, we send to it a confirmation that the submission arrived and a link for adding the photographs. That link works for 14 days. If the listing is published, every 60 days you get one letter asking whether it is still current. It carries two buttons, one confirms, the other takes the listing down at once.

Technical data

When you visit the site, standard server logs are written: IP address, time of the request, page and browser. When a form is submitted we store an irreversible fingerprint of your IP address for 60 seconds in order to limit automated spam. The basis is legitimate interest under Art. 6(1)(f), namely security and availability of the service.

Whom we pass data to

• To the distributor responsible for the listing: your enquiry goes to them so that they can answer you and arrange a viewing.
• To the developer, owner or partner agency: when you ask for a viewing or for direct contact with the seller. The recipient processes your data as a separate controller.
• To processors who provide us with technical services: a server infrastructure provider in the EU, Cloudflare (network protection and acceleration) and MXRoute (outgoing mail).

We do not sell your data and do not pass them to third parties for marketing purposes.

Transfers of data outside the European Union

The server the site runs on is in the European Union and the data from the forms are stored there. Two of the processors are companies established in the United States: Cloudflare, whose network the requests to the site pass through, and MXRoute, which sends the outgoing mail. In the course of their work technical data such as the IP address and the content of a sent message may be processed outside the EU.

The transfer rests on the grounds in Chapter V GDPR: an adequacy decision under Art. 45 where the provider is certified under the EU-US Data Privacy Framework, or the European Commission’s standard contractual clauses under Art. 46(2)(c). You may request a copy of the applicable safeguards at office@ifkees.bg.

External services

The pages of this site are served from our own server. Maps, fonts, scripts and photographs all come from it, and the map base is our own copy of OpenStreetMap data. There are no advertising networks and no tracking scripts on the site.

There are two exceptions. The first is the counting of visits, for which we use Cloudflare Web Analytics, whose small script your browser loads from a Cloudflare address (static.cloudflareinsights.com). The script sets no cookies and reads nothing from your device, it does not recognise you on a later visit and it does not follow you around other sites.

What reaches Cloudflare is the address of the page you opened, the page you came from, general information about your browser and screen, and your IP address, which every internet request carries with it. Cloudflare does not use it to identify you, and we see only aggregate figures for the whole site rather than an individual visitor. The basis is legitimate interest under Art. 6(1)(f) GDPR, namely knowing which pages are read.

The second exception works on one page only. When you submit a listing through the form, Cloudflare Turnstile is at work there, telling a person apart from an automated script so that the form is not filled with spam. Its script loads from challenges.cloudflare.com and runs the check inside your browser, without asking you anything and without making you recognise pictures. When the form is sent, we pass Cloudflare the result of that check together with your IP address, so that we can confirm the check was passed. Turnstile may leave a technical record of its own in your browser for the purposes of the check itself. The basis is legitimate interest under Art. 6(1)(f) GDPR, namely protecting the form from automated abuse. On every other page of the site Turnstile is not loaded.

Cookies and local storage

The site uses no analytics, advertising or tracking cookies and is not connected to any advertising network. The counting of visits described above also works without a cookie.

While you are reading the site, you get exactly one cookie and it is called pll_language. All it holds is the code of the language you are reading, that is bg, en, de or ru. The language module sets it the first time you open the site, so that every next page does not send you back to Bulgarian. It is kept for one year and holds nothing by which you could be identified. It is a technical cookie, and without it the site cannot show you the language you chose, so no consent is asked for it.

If someone from our team signs in to the administration, WordPress adds its own session cookies. A visitor never receives those. On the page where a listing is submitted, the Turnstile check may leave a technical record of its own, as described above under External services.

The listings you save are kept in the local storage of your browser. That list appears only once you save a listing yourself, stays on your device, is never sent to us, and is deleted when you clear your browser data.

How long we keep data

• Correspondence about an enquiry: for as long as it is needed for the answer and any transaction, and no longer than 3 years from the last contact.
• A copy of emails sent from the site, in the log of the mail module: 365 days.
• The fingerprint of the IP address used against spam: 60 seconds.
• Server logs: according to the provider’s settings, usually up to 30 days.
• A submission we have declined or marked as a duplicate or spam is deleted 90 days after the last change to it.
• Photographs uploaded to a form that was never sent through are deleted after 7 days.

Your rights

You have the right of access to your data, and rights to rectification, to erasure, to restriction of processing, to portability and to object to processing based on legitimate interest. Where we process data on the basis of consent, you may withdraw it at any time. The withdrawal does not affect the lawfulness of processing before it.

We take no automated decisions with legal effect for you and do not profile you. Every submitted listing is reviewed by a member of the team.

To exercise your rights, write to office@ifkees.bg. We answer within one month.

If you believe your rights have been infringed, you may lodge a complaint with the Commission for Personal Data Protection: cpdp.bg, 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592.

Changes

If the way we process data changes, we update this page and note the date below.

Last updated: 5 October 2026.

This is a translation for convenience. In case of any discrepancy, the Bulgarian version of this policy prevails.