NautiLex EOOD, UIC 202385493 (the “Company”), with registered office and management address at 105 Knyaz Al. Dondukov-Korsakov Blvd., Apt. 3, Oborishte District, 1527 Sofia, Bulgaria, and email: office@nautilex.bg.
We process contact details and the description of your enquiry. The following section explains contact options and the AI questionnaire.
Website enquiries and the AI-assisted questionnaire
Updated: 8 September 2026. This section specifies how the general policy applies to initial enquiries and takes precedence over differing general descriptions of retention and technologies below. The controller is NautiLex EOOD, identified at the beginning of this policy.
Data and purposes
We process the enquirer's name and email, phone number and organisation if provided, preferred contact method, selected area, description, answers, deadline and stage of the matter, and the internal summary. Name and email are required to submit the questionnaire. A phone number is required only if you request a call; organisation is optional. Without the required fields you cannot submit the questionnaire, but you can contact us by email.
We use this information to understand the assistance requested, organise and review the enquiry, and reply. It is not used for advertising messages. Do not enter national identification numbers, bank details, passwords, health information, criminal conviction data, confidential documents or unnecessary information about other people. Use generic descriptions such as “employee” or “shareholder”. Arrangements for providing documents and sensitive details will be agreed separately with the firm.
Legal bases
For an individual enquiring about their own engagement, the basis is taking steps at their request before entering into a contract — GDPR Article 6(1)(b). For communication with representatives of organisations, routing enquiries and AI assistance with the initial review, we rely on our legitimate interest in reviewing and handling incoming enquiries; for technical security, on our interest in preventing spam, fraud and abuse — Article 6(1)(f). The “I have read” acknowledgement records that the information was provided; it is not marketing consent or blanket consent to processing.
How AI is used
The description and answers are sent to the OpenAI API to select follow-up questions, suggest a category and prepare an internal summary in Bulgarian, including for English enquiries. Processing begins while you complete the questionnaire, before final submission. Separate name, email, phone and organisation fields are not sent to OpenAI. If you include these details in free text, they will be sent with that text. Closing the questionnaire does not undo AI processing already performed.
Results may be inaccurate and are reviewed by a person. The questionnaire does not provide legal advice or automatically accept or reject an engagement. No decision producing legal or similarly significant effects for you is made solely through automated processing. You can send an enquiry without this AI questionnaire to office@nautilex.bg.
Recipients and international processing
Authorised people at the firm and hosting and email providers have access as necessary to deliver their services. The website is hosted with Jump.bg. OpenAI receives the data described above for AI processing. Cloudflare Turnstile receives technical signals, including IP address, browser and connection information and request origin, to prevent bots. It loads after the acknowledgement on the first screen. Cloudflare acts as a processor for website protection and as an independent controller for improving bot detection, as described in the Turnstile notice.
OpenAI and Cloudflare services may involve processing outside the EEA, including in the United States. Applicable contractual safeguards, including standard contractual clauses for international transfers, are described in the OpenAI data processing addendum and Cloudflare addendum. You can request information and a copy of the safeguards applicable to the processing at office@nautilex.bg.
Retention and security
The questionnaire session expires 15 minutes after it starts; expired sessions are cleaned up on the next request or scheduled cleanup. Submitted working records in the add-on are kept for 7 days from submission and cleaned up in the same way. Their contents are encrypted and stored outside the public website directory. Session identifiers, timestamps, delivery status, notice version and technical abuse-prevention counters are also processed. Server logs follow the general security rules.
The submitted enquiry, original answers and summary are sent to the firm's mailbox. For enquiries that do not lead to an engagement, correspondence is deleted 6 months after it ends. Where an engagement follows, necessary information becomes part of the client file and follows applicable contractual and statutory retention periods. For a specific dispute or legal obligation, only information necessary for that purpose and period is retained. Backups are used for incident recovery and expire through rotation; deletion rules are reapplied after restoration. Add-on cleanup does not delete emails or backups.
OpenAI requests disable storing the response for later retrieval. This does not mean zero retention: under the provider's standard rules, abuse-monitoring data may be kept for up to 30 days, or longer when legally required or necessary to protect against harm. API data is not used for training by default. See OpenAI API data controls.
Your rights
You may request access, rectification, erasure, restriction and, where applicable, portability; you may object to processing based on legitimate interests on grounds relating to your particular situation. Contact office@nautilex.bg. You may complain to the Bulgarian Commission for Personal Data Protection or another competent supervisory authority. For the necessary session cookie and technical protection, see our cookie policy.
The Company being a personal data controller collects and processes information about natural persons. Personal data are the information related to an identified or identifiable natural person. Personal data protection in the course of data processing is of foremost importance for the Company.
The present policy for personal data protection (“The Policy”) is part of “The rules and procedures for personal data protection” of the Company as it regulates the manner of processing and storage of personal data for compliance with the applicable legislation. Access to the full text of the rules, policies, instructions and registers can be gained at the registered office of the Company.
I. Personal data processing
The Company processes personal data, collected in accordance with its activity.
The rules of the applicable legislation for personal data protection are implemented by the Company whether data are processed electronically or on paper. For the compliance of the personal data processing with the applicable legislation, personal data are collected and used for a particular purpose, they are stored safely and the Company takes the necessary organizational and technical measures for preventing breach of the data security.
The Company processes personal data for the following purposes:
1. Employees and sub-contractors
In regard to the natural persons – employees and sub-contractors of the Company, their data are processed for the purpose of physical identification and for communication (name, PIN, phone number, email, address), as well as for information about education, employment status, employment experience, medical status and marital status, as the data are collected by virtue of a contract and under statutory obligation for collection of such information, for the following purposes:
- conclusion, execution and termination of a contract;
- performance of accounting services in relation to the contract;
- exercising the rights and protection of the legitimate interests in relation to the contract.
3. Clients, contractors, suppliers and subcontractors
In regard to the natural persons – clients, contractors, suppliers and subcontractors, as well as the natural persons who represent companies which act in the above-mentioned capacities, their data are processed for the purpose of communication (name, phone number, email, address), as well as for information about education, professional experience, ownership, owned shares from the company’s capital, as the data are collected by virtue of a contract and under statutory obligation for collection of such information, for the following purposes:
- conclusion, execution and termination of a contract;
- performance of accounting services in relation to the contract;
- exercising the rights and protection of the legitimate interests in relation to the contract.
Personal data are collected on paper or electronically. Prior to the collection or as of the moment of data receipt, the natural persons are notified for the provisions of the present Policy.
The Company does not collect personal data of persons under the age of 16 years without the explicit consent of their parent/s.
Where the personal data are collected on the grounds of an explicit consent given by the data subject, the consent may be withdrawn in the manner in which the latter is given – by filling free-text request for termination of personal data processing for the purposes specified by the data subject or by filling a sample for consent withdraw.
II. Log files, “Cookies”, Web analytics and social media
1. Log files
Each click in the web browser by the person transfers particular information, stored by the Company in log files. This information is kept for short term for the purpose of detection of irregularities, as well as for security reasons. Log files, which are supported for evidentiary purpose, shall not be erased until the particular accident (an attempt for or breach of data security) is fully resolved, as they may be handed over to the investigative bodies. The log files are used for the purpose of analytics, as well (without IP address or with shortened one).
In the log files the following information is stored:
- IP address (internet protocol address) of the device used for access to the web site of the Company;
- the name of the loaded files or information;
- date and time, as well as the length of stay on the web site;
- data transfer rate;
- operating system and information about the web browser, including the installed add-ons (e.g. Flash Player).
2. “Cookies”
“Cookies” are small text files that are saved on the computer used by the data subject, when the latter visits a web site. If you have access to this web site at any other time, the browser sends back the content of the “cookies” to the respective offeror, thus allowing re-identification of the device.
When the web sites of the Company are visited, the data subject is asked in the cookie layer pop up whether to allow the “cookies”, which are in the web site, or to block/deactivate them in the settings.
In the event that “cookies” are blocked, an opt out “cookie” is saved on the browser. This “cookie” serves only for the purpose of activating the objection of the data subject. Blocking/deactivating cookies may forbid individual features on the Company’s web site.
The Company uses the following “cookies”:
- Cookies that store certain settings of the web site.
3. Web analytics
The Company currently does not use a web analytics tool. If one is introduced in the future, it will load only after the relevant consent, will be configured with data-minimisation safeguards and this Policy will be updated.
4. Social networks plug-ins
The website does not use embedded social plug-ins. Ordinary links to external professional profiles transfer data to the relevant platform only after the user follows the link.
5. External links
The web sites of the Company can contain links to web sites of third persons/legal entities. In case that a data subject clicks on the link, the Company cannot influence the processing of personal data, which are sent by the data subject to the third person/legal entity, thereby the Company takes no responsibility for the processing of personal data by third persons/legal entities.
III. Data transfer
Personal data can be transferred to a personal data processor in relation to accounting service of the Company, data hosting. All service providers are obliged to maintain their activities in strict confidence, to comply with the applicable legislation, as well as to apply the rules and the policies of the Company for personal data protection.
The Company does not transfer personal data to countries other than the Member States of the European Union.
IV. Rights of the persons whose data are processed by the Company
The Company provides information to the data subjects in concise, easy to understand and easy accessible form, using clear and plain language. The Company provides information to the persons in written or other form, including electronically.
The Company provides the persons with free information about the actions undertaken in relation to their requests within one month as of the receipt of the requests. If necessary, this period may be extended by two months, taking into account the complexity and the number of requests. The Company shall notify the person of any such extension within one month as of the receipt of the request, indicating the reasons for the delay.
Should the Company refuse to act on the request, the latter shall notify the person within one month as of receiving the request for the reasons of the delay, as well as for his/her right to complaint to the Commission of Personal Data Protection.
Where the requests of the person are manifestly unfounded or excessive, in particular due to their repetitive character, the Company may charge a fee upon the costs of providing information or communication or undertaking the requested actions.
The rights of the data subject are, as follows:
1. Rights of information and access
Any data subject has the right to obtain from the Company confirmation as to whether or not personal data concerning him/her are being processed, and, where that is the case, access to the personal data and the information related to them. The Company provides the person with a copy of his/her processed personal data.
2. Rights to rectification and erasure
Data subject has the right of request to the Company for rectification of inaccurate personal data, related to him/her without undue delay. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.
The data subject has the right of request for his/her personal data erasure, unless the data erasure might breach rights and legitimate interests of other persons or legal entities, including the Company, or a statutory obligation prescribes the data storage.
Where the Company has made the personal data public and is obliged to erase them, the Company undertakes reasonable steps, including technical measures, to notify the personal data controllers and processors that the data subject concerned has made a request for erasure of all links, copies and replica of his/her personal data by those data controllers.
4. Restriction of processing
The data subjects have the right to obtain from the Company restriction of processing, pursuant to the conditions in which the right of restriction is exercised.
5. Objection to personal data processing
Data subjects have the right to object their personal data processing at any time, unless processing is necessary for the performance of a task carried out in the public interest or processing is necessary for the purposes of the legitimate interest of the Company or third persons or legal entities.
The objection to the direct marketing is unconditional and shall be applied by the Company without undue delay.
If personal data are processed only on the grounds of data subject’s consent, the latter have the right to withdraw his/her consent immediately. The lawfulness of the data processing prior to the withdraw remains unchanged.
6. Data portability
The data subjects have the right to receive the personal data concerning him or her, which he or she has provided to the Company, in a structured, commonly used and machine-readable format or, if it is technically feasible, to request the Company to transmit these data to third persons/legal entities.
7. Right to lodge a complaint before the Commission of Personal Data Protection
Data subjects have the right to lodge a complaint before the Commission of Personal Data Protection at: Sofia 1592, 2 Professor Tsvetan Lazarov Blvd., phone number: 02/91-53-518, email: kzld@cpdp.bg.
V. Destruction
The accounting and business information, as well as all other documents relevant to taxation and compulsory social insurance contributions are stored by the Company within the following terms:
- salary payroll – 50 years;
- accounting registers and financial statements – 5 years;
- documents relevant to tax and social control – 5 years as from the expiry of the prescription period for the public obligation repayment, which the documents are related to;
- the other data storage devices – 5 years.
Following the data storage expiry, the data shall be erased without undue delay by destruction of papers via shredding; as to the technical devices, data shall be erased by deleting the relevant files from them.
VI. Miscellaneous
The Company reserves its right to change the security measures for personal data protection, if this is necessary due to technical development for the purpose of better data protection. The Company shall amend the policy of personal data protection accordingly and shall update the current version of notification related to personal data protection.