Privacy policy
This policy explains how DIPLAM 09 OOD processes personal data in connection with bifacto.com and the Bifacto platform. It applies to website visitors, prospects, customers, authorised users and individuals whose data appears in uploaded documents.
1. Controller
| Controller | DIPLAM 09 OOD |
|---|---|
| EIK / UIC | 200760165 |
| VAT | BG200760165 |
| Address | 93 Ekzarh Yosif Street, 1000 Sofia, Bulgaria |
| GDPR email | doc.bifacto@gmail.com |
| Telephone | +359 88 40 92 994 |
| Website | bifacto.com |
2. Role of DIPLAM 09 OOD
DIPLAM 09 OOD acts as controller for the website, accounts, subscriptions, security, support, payments and its own analytics.
When a business customer uploads personal data relating to its clients, employees, suppliers or partners, the customer generally remains controller and DIPLAM 09 OOD acts as processor on documented instructions. This relationship should be governed by an Article 28 GDPR data processing agreement.
3. Personal data
- Identification and contact data: name, company, position, address, email and phone.
- Account and authentication data: identifier, hashed password, preferences, login history, two-factor authentication and data received from Google or Microsoft when those sign-in methods are chosen.
- Subscription and payment data: plan, invoices, payment status, transaction references and fraud-prevention data. Full card details are processed by Stripe.
- Documents: invoices, quotations, credit notes, bank statements, supporting documents, contracts, attachments and other accounting or administrative files.
- Third-party data contained in documents: clients, suppliers, employees, managers, contacts, bank details and billing information.
- Technical and support data: IP, browser, device, logs, pages, errors, events, cookies, messages and support attachments.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Provide Bifacto, create the account and store documents | Contract or pre-contractual steps - Art. 6(1)(b) |
| Manage subscriptions, invoices and Stripe payments | Contract and legal obligations - Art. 6(1)(b) and (c) |
| Secure access, prevent fraud and maintain logs | Legitimate interests and security obligations - Art. 6(1)(f) and, where applicable, (c) |
| Provide support and handle requests | Contract and legitimate interests - Art. 6(1)(b) and (f) |
| Google Analytics (audience measurement) | Prior consent - Art. 6(1)(a) and ePrivacy rules |
| Google or Microsoft sign-in | Contract and user choice - Art. 6(1)(b) |
| Legal compliance and defence of claims | Legal obligation and legitimate interests - Art. 6(1)(c) and (f) |
5. Recipients and providers
- Authorised DIPLAM 09 OOD personnel and contractors.
- SuperHosting.BG OOD, 36 D-r G.M. Dimitrov Boulevard, 1000 Sofia, Bulgaria, for hosting.
- Stripe for payments and fraud prevention.
- Google for authentication, Google Analytics and Google Tag Manager, subject to enabled features and consent.
- Microsoft for authentication, when Microsoft sign-in is chosen.
- Professional advisers, insurers, authorities or courts where necessary and lawful.
6. Transfers outside the EEA
The declared primary hosting is in Bulgaria. Some international providers, in particular Google, Microsoft and Stripe, may process data outside the EEA. DIPLAM 09 OOD then relies on a GDPR-recognised mechanism, such as an applicable adequacy decision, including the EU-US Data Privacy Framework for participating organisations, or European Commission Standard Contractual Clauses, supplemented where required by additional safeguards.
7. Retention
| Category | Period or criterion |
|---|---|
| Account and documents | For the subscription and up to 3 months after termination for retrieval or reactivation, before deletion or anonymisation. |
| Billing and legal records | For periods required by applicable tax, accounting, commercial or litigation law. |
| Security logs | As long as necessary for security, investigations and defence of rights, subject to periodic review. |
| Backups | For a limited disaster-recovery cycle before overwrite. |
| Cookies and analytics | According to the Cookie policy and provider settings; consent may be withdrawn at any time. |
8. Security
DIPLAM 09 OOD applies measures appropriate to the risks, including access controls, privilege limitation, password protection, authentication, logging, secured communications, backups and incident management. Absolute security cannot be guaranteed. Users must protect their credentials and immediately report any suspicious use.
9. Your rights
- Information and access
- Rectification
- Erasure
- Restriction
- Portability where applicable
- Objection, including to direct marketing
- Withdrawal of consent at any time
- Protection against certain solely automated decisions
Requests may be sent to doc.bifacto@gmail.com. Reasonable identity verification may be requested. DIPLAM 09 OOD responds without undue delay and generally within one month, subject to extensions permitted by the GDPR.
10. Complaints
You may lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592, Bulgaria, email: kzld@cpdp.bg, or with the supervisory authority of your habitual residence, workplace or the place of the alleged infringement.
11. Children and automated decisions
Bifacto is intended for professional use and is not designed for direct use by minors. Bifacto is not intended to make decisions producing significant legal effects solely through automated processing. Analytics tools may create audience segments after consent.
12. Changes and contact
This policy may be amended to reflect legal, technical or functional changes. The version published on bifacto.com applies. Contact: doc.bifacto@gmail.com.
This policy refers to Regulation (EU) 2016/679 (GDPR) and Directive 2002/58/EC (ePrivacy).