Privacy policy

1. Who is responsible for your data

МЕДИАПОЛИС ГРУП ЕООД (MEDIAPOLIS GROUP Ltd.), EIK 204743576, VAT number BG204743576, registered address: 36 Polkovnik Sava Mutkurov Street, floor 3, apartment 3, Plovdiv 4003, Bulgaria, operates ExpatBG.com and is the controller of the personal data described in this policy (“ExpatBG”, “we”, “us”).

For privacy requests, contact privacy@expatbg.com. For general questions, email hello@expatbg.com or use our contact form.

2. Information we use

Account information: name, email address, password (stored by WordPress as a non-readable password hash), city or town, whether you live in Bulgaria, and any newsletter opt-in preference you choose.
Content you submit: posts, comments, ratings, business or event details, and images. Information you choose to publish, such as your display name and post or listing details, is visible to site visitors. Comments may include the name, email address and optional website you submit; the comment and name are public, while your email address and website are not shown publicly. Private organiser contact details are used for administration and are not displayed as public event details.
Messages and quote requests: your name, email, topic, message, and any optional details you provide. A quote request may also include the business you chose, services, city, citizenship, timing, language, phone number, preferred contact method, and your consent to send the request to that business. Messages are stored in a private WordPress admin area and sent to the site’s configured inbox.
Payment records: when you buy a Featured business or event placement, ExpatBG receives the selected package, amount, payment status and Stripe Checkout reference. We do not receive or store your full card number.
Technical and security information: WordPress login cookies, a rating cookie, and short-lived anti-spam and rate-limit records. For some security checks, the site creates a keyed hash of the visitor IP address rather than storing that address in the plugin’s records. The production host may also keep technical request logs.

3. Why we use your information

Accounts and site features: to create and secure accounts, let members manage their submissions, and display content you choose to publish. Our legal basis is performing the account and site service you request; we also have a legitimate interest in moderating public content and keeping the site secure.
Messages and requests: to reply to you and review business claims because you asked us to do so. We send a quote request to the selected business on the basis of your express agreement to that transfer.
Moderation and security: to check submissions, prevent spam and abuse, and protect the site and its users. Our legal basis is our legitimate interest in operating a safe, useful service.
Featured placements: to collect payment and provide the placement you selected. Our legal basis is performing that purchase; we keep transaction records where accounting or tax law requires us to.
Newsletter: if you opt in during account creation, we store that preference on the basis of your consent. The current site build does not send newsletter campaigns. We will only send them if a newsletter service is later enabled and you have opted in; you can withdraw consent at any time by emailing us.

5. Payments

Featured-placement checkout is currently integrated with Stripe. The site sends Stripe your account email, the selected listing or event, package and account reference so Stripe can create the payment. Stripe collects the payment details directly through its checkout page; ExpatBG receives confirmation, amount and transaction reference. Read Stripe’s privacy policy. PayPal is not currently connected to the site.

6. Cookies and fonts

WordPress uses necessary authentication cookies when you sign in. If you choose to save your details in the comment form, WordPress may set comment cookies so the form can remember them on your next visit. After you rate a business, ExpatBG sets a first-party ebg_rated_[listing] cookie for up to one year so the site can remember that browser’s vote and prevent repeat ratings. The site also uses short-lived server-side records to limit sign-in attempts and form spam.

The story editor can keep an unsaved text copy in this browser’s local storage so you can recover your work. This copy is separate from drafts saved to your account; it is not sent to ExpatBG until you save or submit the story. Original image files are not stored in local recovery. Photos inserted within a story are uploaded when you select Insert image; their links can be kept with the recovered text. Like cover photos, uploaded image files may be accessible to anyone who has their direct link, even while a draft is private. The editor removes the recovery copy after a successful save or when you choose to discard it.

The current build does not configure analytics or advertising cookies, and it has no cookie-preference panel. It loads fonts from Google Fonts; your browser contacts Google to request the font stylesheet and files, sending the technical information required for that request. See Google’s privacy policy. If we add non-essential cookies or tracking, we will update this policy and obtain any consent required by law before using them.

7. How long we keep information

Account details are kept while your account remains open. If you ask us to close it, we remove or anonymise account information unless we must keep specific records for legal obligations or a claim.
Public submissions remain available while they are published. You can delete your reader post from your account or ask us to remove or anonymise other content.
Contact, claim and quote-request records are kept while we handle the request and for up to 12 months after it is closed, unless a longer period is needed for a legal claim or required by law.
Payment and accounting records are retained for the periods required by applicable tax and accounting law. Stripe keeps its own records under its policy.
Form-error records expire after 15 minutes. Form and sign-in rate limits expire after 10 minutes. Rating-prevention records expire after 180 days, and the one-hour rating rate limit expires after one hour. The rating cookie on your device lasts up to one year.

8. Security and international transfers

We use WordPress password hashing, access controls and anti-spam protections appropriate to the site. No website can promise that transmission or storage is completely risk-free. Our hosting, email, font and payment providers may process information in different countries. If personal data is transferred outside the European Economic Area, we will use a transfer mechanism required by data-protection law, such as an adequacy decision or Standard Contractual Clauses, and make the relevant information available on request.

9. Your rights

Depending on the circumstances, you can ask to access, correct, delete or restrict your personal data; object to processing based on legitimate interests; receive certain data in a portable format; or withdraw consent. Withdrawing consent does not affect processing that already took place. We normally respond within one month, as required by applicable law. To make a request, email privacy@expatbg.com. We may ask for enough information to confirm your identity.

10. Children and changes

You must be at least 16 to create an account. We do not knowingly invite children under 16 to register. If you believe a child under 16 has created an account, contact us so we can review and remove the account information where appropriate.

We may update this policy when our practices or legal requirements change. The current version and its “Last updated” date will always appear on this page.

11. Contact and complaints

Questions or privacy requests: privacy@expatbg.com. You may also complain to the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, kzld@cpdp.bg, cpdp.bg.