Privacy Policy

1.1. Personal data controller:

“BEYOND SOFT” EOOD (BEYOND SOFT LTD), entered in the Commercial Register at the Registry Agency, Company ID (EIK): 201055706, with registered office and address of management: Republic of Bulgaria, Pleven, postal code 5800, 6 “Grenadirska” St.

1.2. Contact details for matters relating to personal data protection:

• Official email address for exercising rights: support@digitalmarket.bg.
• Telephone for contact: +359 883 684 370.
• Postal address for correspondence: Pleven 5800, 6 “Grenadirska” St., attn. “Personal Data Protection” Department.

1.3. All identification data of the controller, processors and sub-processors is kept up to date. In its public policy, the controller does not use conditional, unconfirmed or incomplete data regarding its identity, registered office, corporate number, hosting region, contracting entity or transfer mechanism.

Depending on how the Platform is used, the Controller processes the following categories of data:

2.1. Data upon creating a user profile (Registration):

• Natural persons (Clients and Freelancers): names (first and last name), valid electronic address (email), mobile telephone number, encrypted (hashed) password, country, locality (city), date and time of registration, status of consents to the terms. The mobile telephone number is mandatory at registration. The user may choose for their telephone number not to be displayed publicly (see clause 11.2);
• Legal entities (Companies and Business Clients): business email address, business telephone, company trade name, Company ID (registration number), number of employees, country and city.

2.2. Data upon login and authentication via a Google profile (OAuth 2.0 / Google Identity Services):

When choosing to log in through Google, the Platform receives from Google Ireland Limited only: the public name from the Google profile, a verified email address and a unique numeric user identifier (Google User ID). The Platform does not receive, require or have access to the user’s password for their Google account.

2.3. Additional data in the user profile:

Professional description/biography, professional skills, link to a personal/company website, profile photo or company logo, added voluntarily by the data subject.

2.4. Data in published listings:

• Service Listings (Freelancers/Companies): title, detailed description of the service, categories, scope, indicative prices in euro, references, image material and portfolio;
• Request Listings (Clients): technical brief, indicative budget in euro, desired completion timeframe, preferred provider type and images. The public part of the listing displays the author’s name, locality and contact details (email address and telephone number) from their profile; the telephone number can be hidden (see clause 11.2). Inquiries and proposals to the listing may also be sent through the website’s forms.

2.5. Data upon sending Inquiries (“Request a quote”) and Proposals (via the proposal form):

Sender’s names, email address, contact telephone, free text of the message, indicative budget/proposed price in euro and estimated completion timeframe. When the user is logged into their account, the message is linked for service purposes to their user profile.

2.6. Financial and invoicing data (Payments and loading of Digital Coins):

Date, time and amount of the transaction in euro, selected payment method (bank card or bank transfer), virtual status and history of Digital Coins top-ups, data for issuing a tax invoice (name of company/person, Company ID/unique identifier, VAT number, registered office/address). The Platform does not collect, process or store full bank card numbers, expiry dates or CVC/CVV codes. Card or bank transfer details are entered directly into the secure environment of the licensed payment operator Stripe.

2.7. Security data, logs and protection against automated abuse:

IP address, date and exact time of access, system logs of successful/unsuccessful logins, profile modifications, technical data about the device and browser, collected through the Google reCAPTCHA Enterprise service when submitting forms for registration, forgotten password, contact, inquiry and proposal, as well as at login after several unsuccessful attempts.

2.8. Behavioural and analytical data (only with express consent):

Data about navigation on the website, clicks, viewed listings and recordings of user sessions, processed through the PostHog tool, with mandatory masking of all data input fields.

2.9. For each field in the Platform’s forms, the Controller expressly indicates whether the provision of the data is:

• a) mandatory for creating a profile or for using a specific functionality;
• b) necessary for the performance of a contract;
• c) necessary for compliance with a legal obligation;
• d) entirely voluntary.

Failure to provide non-mandatory data does not result in refusal to create a profile or use the core functionalities, except where the respective functionality by its nature requires this data.

The Controller processes personal data only where there is a lawful basis under Art. 6(1) GDPR, for the following exhaustively defined purposes:

• 1. Registration, support, authentication and management of a user profile on the Platform.

  Categories of data processed

  Names, email, telephone, password (hash), country, city, Google ID.

  Legal basis under GDPR

  Art. 6(1)(b) GDPR – performance of a contract (the website’s General Terms).

• 2. Publication, review, technical formatting and administration of Service Listings and Request Listings.

  Categories of data processed

  Listing parameters, title, description, prices, budget, timeframes, photos, portfolio.

  Legal basis under GDPR

  Art. 6(1)(b) GDPR – performance of a contract.

• 3. Public display of personal data of natural persons (names, photo, contacts) in profiles and listings accessible to all visitors and internet search engines.

  Categories of data processed

  First name, last name, profile photo (if added), city, email and telephone number (unless hidden at the user’s choice).

  Legal basis under GDPR

  Art. 6(1)(b) GDPR – performance of a contract (publication of the profile and listing at the user’s request).

• 4. Intermediation in the exchange of Inquiries and Proposals and their delivery to the designated counterparty user.

  Categories of data processed

  Names, email, telephone, message, offered price, proposed timeframe.

  Legal basis under GDPR

  Art. 6(1)(b) GDPR – taking steps at the request of the data subject prior to entering into a contract.

• 5. Payment processing, crediting of Digital Coins and activation of promotional services (VIP/TOP).

  Categories of data processed

  Amount, date, payment method, transaction status, Digital Coins balance.

  Legal basis under GDPR

  Art. 6(1)(b) GDPR – performance of a contract for paid services.

• 6. Tax and accounting reporting, issuing invoices and financial control.

  Categories of data processed

  Names/name, Company ID, address, VAT number (if any).

  Legal basis under GDPR

  Art. 6(1)(c) GDPR – compliance with a legal obligation under the Accountancy Act, the Tax and Social Security Procedure Code and the VAT Act.

• 7. Protection of web forms against spam, abuse and bot attacks (Google reCAPTCHA Enterprise).

  Categories of data processed

  IP address, technical parameters of the browser and screen, other data on interaction with the page collected by Google reCAPTCHA Enterprise.

  Legal basis under GDPR

  Art. 6(1)(f) GDPR – legitimate interest of the controller in ensuring the cybersecurity of the website.

• 8. Sending transactional, system and technical notifications (profile activation, listing approval, inquiry received).

  Categories of data processed

  Email address, name, system identifiers.

  Legal basis under GDPR

  Art. 6(1)(b) GDPR – performance of the contract for provision of the service.

• 9. Analysis of user behaviour, session recording, heatmaps and interface optimisation (PostHog).

  Categories of data processed

  Pseudonymised analytical identifiers, clicks, navigation, time spent.

  Legal basis under GDPR

  Art. 6(1)(a) GDPR – prior freely given consent (opt-in) through the cookie banner.

• 10. Establishment, exercise and defence of legal claims, dispute resolution and legal protection.

  Categories of data processed

  Profile history, communications, payment records, activity logs.

  Legal basis under GDPR

  Art. 6(1)(f) GDPR – legitimate interest of the company in judicial and out-of-court protection.

The Controller does not sell, rent or disclose personal data to unauthorised third parties. Personal data is provided only to the following trusted categories of recipients, in strict compliance with Art. 28 GDPR:

4.1. Providers of technical services and infrastructure (Processors):

• Amazon Web Services (AWS) (Amazon Web Services EMEA SARL, Luxembourg): Provides secure server capacity, cloud hosting and databases. The servers are located in the region: Frankfurt, Germany (eu-central-1);
• Zoho Corporation (Zoho Corporation B.V., Netherlands): Used for routing and automated sending of system and transactional emails (registration confirmations, notifications of received messages);
• Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland): Provider of Google Identity Services (Google login module) and reCAPTCHA Enterprise (protection of forms against automated spam);
• PostHog Inc. (PostHog Inc.; data is hosted in the EU cloud region – PostHog Cloud EU, Germany): Behaviour analytics and session recording tool, activated only after express consent.

4.2. Payment service providers:

• Stripe (Stripe Payments Europe, Ltd., Ireland): Licensed payment institution acting as an independent controller/processor with respect to card payments and the technical transfer of funds.

4.3. Other registered Users of the Platform:

When you send an Inquiry or Proposal through the website’s forms, the contact data you enter (name, email, telephone, message) is transmitted automatically to the respective listing author or provider so that they can contact you to discuss the order.

4.4. Public and law enforcement authorities:

State institutions, courts, Ministry of Interior bodies, the National Revenue Agency, the Commission for Consumer Protection or the Commission for Personal Data Protection only where there is an express statutory basis, an enforceable court act or a reasoned official request under the applicable law.

5.1. By default, “BEYOND SOFT” EOOD stores and processes personal data within the European Union and the European Economic Area (EEA).

5.2. Where some of the technical providers (e.g. AWS, Zoho, Stripe, Google, PostHog) transfer or remotely access data from servers located in third countries outside the EEA (including the USA or India), the transfer is carried out with strict application of the safeguards under Chapter V GDPR:

• Adequacy decisions of the European Commission (Art. 45 GDPR) – including the EU-U.S. Data Privacy Framework for certified organisations;
• Standard Contractual Clauses (SCCs) approved by the European Commission (Art. 46(2)(c) GDPR), accompanied by a transfer impact assessment (TIA) and additional technical measures for encryption in transit and at rest;
• Binding corporate rules (BCRs) under Art. 47 GDPR, where applicable.

The Digital Market Platform uses cookies and similar local storage technologies to ensure the proper technical functioning of the website, the security of user sessions and statistical analysis.

6.1. Classification and list of cookies used:

• digitalmarket_access / digitalmarket_refresh / XSRF-TOKEN

  Provider / Domain

  digitalmarket.bg (first-party)

  Specific purpose and function

  Maintaining authentication of the logged-in user and protecting web forms against CSRF attacks. digitalmarket_access and digitalmarket_refresh are HttpOnly and Secure; XSRF-TOKEN is readable by the site’s script, as required by CSRF protection.

  Duration

  For the duration of the session

  Category and legal basis

  Necessary (Art. 261a ECommA / Art. 6(1)(b) GDPR). Cannot be disabled.

• NEXT_LOCALE

  Provider / Domain

  digitalmarket.bg (first-party)

  Specific purpose and function

  Remembers the selected interface language (Bulgarian or English). Contains no personal data.

  Duration

  1 year

  Category and legal basis

  Necessary (Art. 261a ECommA / Art. 6(1)(b) GDPR).

• cookie_consent

  Provider / Domain

  digitalmarket.bg (first-party)

  Specific purpose and function

  Remembers your choice regarding cookies (necessary and analytics).

  Duration

  1 year

  Category and legal basis

  Necessary (Art. 261a ECommA / Art. 6(1)(f) GDPR).

• dm_listing_mode

  Provider / Domain

  digitalmarket.bg (first-party)

  Specific purpose and function

  Remembers the choice of the toggle in the catalogue (listings from providers or request listings). Set only when the toggle is used. Contains no personal data.

  Duration

  1 year

  Category and legal basis

  Necessary (Art. 261a ECommA / Art. 6(1)(b) GDPR).

• g_state

  Provider / Domain

  digitalmarket.bg (set by the Google Identity Services script)

  Specific purpose and function

  Remembers the authentication state through Google Identity Services. Set when the Google login button loads.

  Duration

  180 days

  Category and legal basis

  Necessary / Authentication (Art. 261a ECommA / Art. 6(1)(b) GDPR).

• dm_listing_visitor

  Provider / Domain

  digitalmarket.bg (first-party)

  Specific purpose and function

  Random identifier for counting unique visits to a listing in order to prevent artificial inflation of the counter. Set when a listing is opened. HttpOnly.

  Duration

  1 year

  Category and legal basis

  Necessary (Art. 261a ECommA / Art. 6(1)(f) GDPR).

• Google reCAPTCHA

  Provider / Domain

  google.com

  Specific purpose and function

  Google reCAPTCHA Enterprise may store its own cookies and data in the browser on pages with forms in order to recognise automated requests.

  Duration

  Determined by Google

  Category and legal basis

  Necessary / Security (Art. 261a ECommA / Art. 6(1)(f) GDPR).

• ph_* / posthog_*

  Provider / Domain

  posthog.com / digitalmarket.bg

  Specific purpose and function

  Product analytics, behaviour analysis, heatmaps and session recording. Loaded ONLY after express consent.

  Duration

  up to 1 year

  Category and legal basis

  Analytics (opt-in) (Art. 261a ECommA / Art. 6(1)(a) GDPR). Disabled by default.

6.2. Management of cookie consent:

On first visit to the website, the user sees an interactive banner allowing them to accept or reject the optional analytics cookies. The user may change their preferences or withdraw their consent at any time through the “Cookie settings” link located at the bottom (footer) of every page of the website.

In implementation of the storage limitation principle (Art. 5(1)(e) GDPR), the Controller applies differentiated retention periods according to the specific purpose of processing:

• User account data: Retained for the period during which the account is active. After final closure or deletion of the account by the user, the core identification data is deleted immediately from the active database, and system backups are overwritten within up to 30 (thirty) calendar days;
• Accounting and tax documents (Invoices and payment records): Retained for 10 (ten) years, starting from 1 January of the year following the reporting period, under Art. 12(1), item 2 of the Accountancy Act and the Tax and Social Security Procedure Code;
• Published and completed Listings: An active listing is accessible until the author deletes it or the Administrator deactivates it. A listing marked as “Completed” remains accessible via a direct link until it is deleted or deactivated. After deletion or deactivation, the listing is removed from public access, and its data is retained only as long as necessary for the purposes of processing or for the defence of legal claims;
• Inquiries and Proposals: Exchanged messages are stored in the profiles of the corresponding parties for up to 3 (three) years from the time they were sent, for protection in pre-contractual and non-contractual disputes. Inquiries from unregistered visitors are retained for up to 12 (twelve) months. The history of inquiries remains visible to the other party to the correspondence within the stated periods, including after the account of one of the participants is deleted;
• Analytical session recordings (PostHog): Session recordings and heatmaps are retained for a maximum of 30 (thirty) days, after which they are deleted automatically;
• Security logs and IP addresses: Retained for 6 months, unless a specific incident, complaint, dispute or official proceeding requires longer retention, but not more than the period necessary for the defence of legal claims.

Every natural person whose data is processed by “BEYOND SOFT” EOOD has the following rights under Articles 15 – 22 GDPR:

8.1. Catalogue of rights:

• Right of access (Art. 15 GDPR): The right to obtain confirmation of whether your data is being processed and a copy of the personal data processed, together with full information on the purposes, categories and recipients;
• Right to rectification (Art. 16 GDPR): The right to request without delay the rectification of inaccurate or completion of incomplete personal data directly through the profile settings or by written request;
• Right to erasure (“Right to be forgotten”) (Art. 17 GDPR): The right to request deletion of personal data where the purposes have ceased, consent has been withdrawn, you have objected to the processing or the data has been processed unlawfully (except for data that the controller is legally obliged to retain for tax purposes);
• Right to restriction of processing (Art. 18 GDPR): The right to require temporary suspension of processing when the accuracy is contested or while a legitimate interest is being verified;
• Right to data portability (Art. 20 GDPR): The right (upon written request) to receive the personal data provided by you on the basis of consent or contract, in a structured, commonly used and machine-readable format, or to request its transfer to another controller;
• Right to object (Art. 21 GDPR): The right to object at any time to processing based on legitimate interest (including reCAPTCHA or security). The Controller ceases the processing unless it demonstrates compelling legitimate grounds that override;
• Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on consent (analytics cookies and session recording), the data subject has the right to withdraw it at any time. Withdrawal operates for the future and does not affect the lawfulness of processing prior to the withdrawal.

8.2. Procedure for exercising rights:

• Self-service through the profile: Every registered user can view, edit or permanently delete their profile directly through the menu “Profile settings” -> “Delete account”. Protection against unauthorised deletion requires confirmation with the current password or by re-authentication with a Google profile;
• Submitting a written request: Visitors without a profile and users can send a written request by email: support@digitalmarket.bg. To prevent fraud, the Controller may request additional information to confirm the identity of the applicant under Art. 12(6) GDPR;
• Response time: The Controller decides and provides information on the request without undue delay and in any case within 1 (one) month of receiving it. In case of factual or technical complexity, the period may be extended by a further 2 (two) months, of which the subject is informed within the first month. The Controller does not charge fees for exercising rights, except in cases of manifestly unfounded or excessive requests, where the burden of proving this lies with the Controller.

If you believe that the processing of your personal data infringes the provisions of the GDPR or the PDPA, you have the right to lodge a complaint with the national supervisory authority:

Commission for Personal Data Protection (CPDP)

• Address: Republic of Bulgaria, Sofia 1592, 2 “Prof. Tsvetan Lazarov” Blvd.
• Telephone: +359 2 915 35 18 | Fax: +359 2 915 35 25
• Email: kzld@cpdp.bg | Website: www.cpdp.bg

If your habitual residence or place of work is in another EU Member State, you have the right to lodge a complaint with the data protection supervisory authority of the respective Member State.

In accordance with Art. 32 GDPR, the Controller applies modern information security standards, including:

• Cryptographic protection: Communication between the user’s browser and the servers is protected by the encrypted protocol HTTPS;
• Secure password storage: User passwords are stored only in hashed form using recognised one-way cryptographic algorithms and are not accessible in plain text to any employee or administrator of the Platform;
• Cookie protection: Authentication cookies are marked with the flags HttpOnly (protection against Cross-Site Scripting / XSS attacks), Secure (transmission only over an encrypted connection) and SameSite=Strict (protection against CSRF attacks);
• Access restriction and backups: Access to the production environment and database is restricted on a need-to-know basis, and backups are maintained;
• Masking in analytics: The PostHog module is activated only with the user’s consent, and when recording sessions mandatory masking of all data input fields is applied, so that personal or financial data being entered is not recorded.

11.1. Public scope of profiles and listings:

The Digital Market Platform is a public online marketplace. The public profiles of Providers (Freelancers and Companies) and approved Listings (including Clients’ Request Listings) are visible to all registered and unregistered internet visitors and are subject to indexing by external automated search engines (e.g. Google, Bing).

11.2. Public display of personal data:

• For natural persons (Clients and Freelancers), profiles and listings publicly display the first name, last name, profile photo (if added), locality and contact data (email address and telephone number) provided by the person in their profile, so that the service of publishing a listing can be delivered and interested persons can contact the author;
• The telephone number is visible by default and can be hidden from publicly accessible pages through a checkbox at registration or later from the user’s profile. The email address is always displayed. Inquiries and proposals to authors can also be sent through the website’s secure forms;
• For Companies, the company name, number of employees, locality, an indication that the profile belongs to a company, email address and telephone number (unless hidden at the user’s choice) are displayed publicly.

11.3. Indexing and caching by external search engines:

Upon deletion or deactivation of a listing/profile, the data is removed from the public part of the Platform, and the Controller takes reasonable technical measures to have it removed from search engine indexes. The Controller is not responsible for the temporary retention of cached copies of pages in the databases of independent search engines (Google, Bing, etc.), over whose refresh frequency the company has no direct control.

11.4. Protection against automated extraction (Web Scraping):

The Controller applies reasonable technical and organisational measures to limit unauthorised automated extraction of publicly available data. The existence of a publicly accessible page does not constitute consent to mass collection, enrichment, resale, republication or profiling of natural persons by third parties.

11.5. Confidentiality of direct messages:

Inquiries (“Request a quote”) and Proposals (via the proposal form) are strictly confidential and are not publicly accessible in the catalogue. Only the author of the message and the designated addressee (recipient) have access to them.

The Controller does not apply automated individual decision-making processes, including profiling within the meaning of Art. 22(1) and (4) GDPR, that produce legal effects concerning data subjects or similarly significantly affect them. The algorithmic ranking of listings in the catalogue is based on objective criteria (requested VIP/TOP promotions, the presence of a stated price or budget, and the sorting selected by the user) and does not constitute individual profiling of natural persons.

The Platform is not intended for persons under 18 years of age, unless expressly stated otherwise for a specific functionality. The Controller does not knowingly collect personal data from children without the necessary legal basis and, where applicable, without the consent of the holder of parental responsibility. If such collection is discovered, the data is deleted without undue delay.

14.1. This Privacy Policy is subject to periodic review and update in case of changes in legislation, introduction of new functionalities or integration of new technology providers.

14.2. In case of material changes that affect the rights of data subjects or introduce new purposes of processing, the Controller notifies registered users by a message on a durable medium (email) and/or by an express message in the user interface at least 15 (fifteen) days before they enter into force.

14.3. All previous versions of the Policy are kept in an archive and are available upon written request by data subjects.