I. General information and applicability
1.1. This privacy policy (hereinafter referred to as “the Policy”) applies to the website www.xstate.bg (hereinafter referred to as “the Website”), which is a professional internet portal of Xstate BG Ltd. real estate agency (hereinafter referred to as “the Company”). It explains how and what personal data is processed, in order for the Website to be accessible and operational.
1.2. Please beware that if you share the Website on external networks (e.g. Facebook, Twitter, LinkedIn) or follow a link to another site, you would be subject to the privacy and other policies of these external networks/sites and, therefore, the current policy would not be applicable to your activities there.
1.3. Information about the Company:
name: Xstate BG Ltd.
place of practice: Sofia, Plovdiv and other
address: 81 Tzar Boris III Blvd., Krasno selo administrative district, entrance V, 6th floor, studio 1, 1612, Bulgaria
e-mail: office@xstate.bg
mobile number: +359898611759
UIC: 208662787
II. Information regarding data processing during the use of the Website
2.1. Summary
2.1.1. In this section you would find information about the processing of personal data, when you use the Website.
2.2. Purpose of the data processing
2.2.1. Your personal data is used to:
- a) provide the Website to you (“traffic data” – e.g., your IP address) and
- b) ensure the security of the Website.
2.3. Period of storage of the data
2.3.1. Traffic data is not stored for the maintenance of the Website.
2.3.2. The security log data (which is for example aggregated in the case of occurrence of an accident) is deleted within a period, reasonably needed for the investigation and solving of the security issue. In exceptional cases such data may be stored for a longer period – for example, when the blocking of a specific IP address is needed.
2.4. Legal basis for the processing of the data
2.4.1. The traffic data is processed on the basis of your consent to access and use the Website.
2.4.2. The security log data is processed on the basis of the Company’s legitimate interest to guarantee the security of the Website.
2.5. Existence of other recipients and third country transfers
2.5.1. Personal data, obtained for the purposes of accessing and maintenance of the Website, is, in principle, not shared with other recipients. Exclusion from this principle can occur only if the Company is legally obliged to share the data.
2.5.2. Personal data is not transferred to third countries outside of the EU/EEA.
2.6. Cookies
2.6.1. The Website uses strictly necessary cookies only. Learn more about them in our Cookies policy.
III. Information regarding data processing during the use of the Website’s contact form
3.1. Summary
3.1.1. In this section you would find information about the processing of personal data, when you use the Website’s contact form in order to contact the Company.
3.2. Purpose of the data processing
3.2.1. Your personal data is used so that the Company may come into contact with you and eventually answer to your questions.
3.3. Period of storage of the data
3.3.1. The received messages are kept for a period, reasonably needed for the reply of your questions and the structuring of the Company’s professional archive.
3.4. Legal basis for the processing of the data
3.4.1. The messages are processed on the basis of your consent when sending the Company a message via the contact form. Sometimes the processing of these messages is based on the Company’s legitimate interest or legal duty to keep communication for his professional archive.
3.5. Existence of other recipients and third country transfers
3.5.1. Personal data, obtained via your use of the Website’s contact form, is, in principle, not shared with other recipients. Exclusion from this principle can occur only if the Company is legally obliged to share the data.
3.5.2. Personal data is not transferred to third countries outside of the EU/EEA.
IV. Information regarding data processing in connection with the Website’s newsletter
4.1. Summary
4.1.1. In this section you would find information about the processing of personal data, when you subscribe for the newsletter of the Company, offered via the Website.
4.2. Data that is processed
4.2.1. In order to subscribe for the newsletter, you provide your e-mail address.
4.2.2. For the purposes of proving your subscription, the Company also records the date and time of your subscription request, the date and time of the confirmation of the request, and the IP address, from which they were made.
4.2.3. The Company may process data about the delivery of the newsletter and about your interaction with it (for example, whether a message has been opened and whether a link, contained in it, has been followed), in order to measure and improve the quality of the newsletter.
4.3. Purpose of the data processing
4.3.1. Your personal data is used to:
a) send you the newsletter – periodic messages with information about the services of the Company, about current property offers and about other news, related to the activity of the Company; and
b) demonstrate that you have subscribed for the newsletter and that you have consented to receive it.
4.4. Period of storage of the data
4.4.1. Your e-mail address and the other data, related to your subscription, are stored until you withdraw your consent (unsubscribe) or until the Company discontinues the newsletter.
4.4.2. The record of your subscription, of your consent and of the withdrawal thereof is kept for a period of 1 (one) year after the withdrawal, so that the Company is able to demonstrate that the newsletter has been sent lawfully and that the withdrawal has been honoured.
4.4.3. Your e-mail address may be kept in a separate list of unsubscribed persons for the sole purpose of not being included again in the list of subscribers.
4.5. Legal basis for the processing of the data
4.5.1. The newsletter is sent on the basis of your consent, which you give by subscribing and by confirming your subscription. The withdrawal of your consent does not affect the lawfulness of the processing, carried out before the withdrawal.
4.5.2. The record of your subscription, of your consent and of the withdrawal thereof is processed on the basis of the Company’s legal obligation to be able to demonstrate that your consent has been obtained, as well as on the basis of the Company’s legitimate interest to defend itself against claims.
4.6. Withdrawal of your consent (unsubscribing)
4.6.1. You may withdraw your consent at any time, free of charge and without giving reasons, by sending a request to office@xstate.bg.
4.6.2. After the withdrawal, the Company shall stop sending you the newsletter without undue delay.
4.6.3. Neither the refusal to subscribe for the newsletter, nor the withdrawal of your consent, affects in any way your ability to use the Website or the services of the Company.
4.7. Existence of other recipients and third country transfers
4.7.1. Personal data, obtained for the purposes of the newsletter, is, in principle, not shared with other recipients. Exclusion from this principle can occur only if the Company is legally obliged to share the data.
4.7.2. Personal data is not transferred to third countries outside of the EU/EEA.
V. Your rights in connection with the data processing
5.1. In connection with the processing of your data you have the following rights:
5.1.1.the right of access to and rectification or erasure of the personal data;
5.1.2. the right to object and to restrict personal data processing;
5.1.3. the right to data portability;
5.1.4. the right to withdraw your consent for personal data processing (when the data is processed on the basis of your consent only);
5.1.5. the right to lodge a complaint with your local data protection authority. The Company’s activities in regard to data processing are regulated by the Bulgarian Commission for Personal Data Protection.
5.2. You can learn more about the above indicated rights and the situations in which you can exercise them by carefully reviewing Art. 15 – Art. 22 of the GDPR.
5.3. If you want to exercise any of your rights in connection with your data, which is processed according to this Privacy policy, please contact the Company via this e-mail address: office@xstate.bg.
VI. Miscellaneous
6.1. If any provision of this Policy is found to be invalid, this shall not invalidate the Policy as a whole or any other provision thereof. In such a case, the invalid provision shall be superseded by the mandatory rules of law and, if there are none, the Policy shall apply without the invalid provision.
6.2. The provisions of the current legislation of the Republic of Bulgaria shall apply to all matters not covered by these Policy.
6.3. Any disputes that may arise in connection with this Policy must be resolved voluntarily, and for this purpose you may at any time contact The Company (office@xstate.bg). If it proves impossible to resolve the dispute by agreement, the competent courts are the courts in the city of Sofia, the Republic of Bulgaria.
6.4. This Policy may be unilaterally amended and supplemented by The Company, in which case the updated text of the Policy will be promptly published on the Website and will be deemed applicable from the date of its publication. The users of the Website are obliged to regularly check the content of the Policy and monitor for amendments and supplements. For the sake of clarity, it is stated that the current version of the Policy was published on 17.07.2026.