This is a courtesy translation. In case of any discrepancy, the Bulgarian version at https://fincontrol.bg/terms prevails - it is the legally binding text.
Fincontrol EOOD, UIC 208331221, registered seat and address of management: Sofia 1618, 27 Bratya Buxton Blvd., Bulgaria, email office (at) fincontrol.bg, processes personal data as a controller within the meaning of Regulation (EU) 2016/679 (GDPR). For the corporate clients of the Platform who process personal data of their own employees and counterparties through it, Fincontrol EOOD also acts as a processor on behalf of the client, who is the controller of that data.
The platform serves companies registered in Bulgaria, and access to the website is restricted to visitors from the country. To determine this, your address is checked against a list of address blocks that we compile from the public data of the regional internet registries (RIPE NCC, APNIC, AFRINIC, ARIN, LACNIC). The check happens at the moment of the request; the address is not stored.
Where access is refused, we keep only the number of refusals for the day and the country concerned - no address, no page, nothing about the individual request. Access to your own panel (app.fincontrol.bg) is not restricted by country, so that you can work while travelling. If you need access to the website from outside Bulgaria, write to us.
If you choose AI reading of documents, the content of the document is sent to Anthropic (provider of the Claude API, USA) solely for the purpose of reading it - it is not used by the provider to train models by default. The feature is optional.
Database backups are stored encrypted and also outside the main server, with a cloud storage provider - the data in the copies is the same as in the main database.
Public authorities. We provide data to public authorities only where the law obliges us and to the extent it requires - see section 6a of the Terms of Service.
The enterprise must keep its accounting documents and records for the periods set by the Accountancy Act (usually 10 years for accounting registers and financial statements; longer for some payroll data). The platform does not automatically delete accounting entries, documents or payroll runs after a certain time - the history is kept without a limit in years while the account is active. After the subscription ends the data stays available for download for 12 months; after that it may be deleted, and we notify you by email at least 30 days beforehand, unless you have paid storage (section 9 of the Terms of Service). You can ask for earlier deletion at any time.
Site visit records are deleted automatically after 12 months. Until then they do not permit identification in any case: the visitor code changes every day. The count of refusals per country is kept without a time limit - it is a number only, with nothing about individual requests.
Personal identification numbers and company settings (including the access keys for a connected online shop) are stored encrypted in the database. Access to the system requires a password; failed login attempts are rate-limited automatically, and login and sign-up are protected against automated attacks (reCAPTCHA - see the Cookie Policy). We take daily backups of the entire database, themselves additionally encrypted before storage - so that regardless of an incident with the current data, we hold an up-to-date copy for restoration.
These measures reduce the risk but cannot guarantee absolute security under all circumstances - the limits of our liability in this respect are described in the Terms, section 8.
For data protection questions: office (at) fincontrol.bg.