Controller for application data
Keagan Solutions EOOD, UIC 175203784, represented by Ivan Tanev. Registered office and management address: Sofia, Zapaden Park 82. Contact: info@keagansolutions.com.
What the form processes
Company details, the applicant's name, email and phone, requested access, the PDF application, signature and necessary power of attorney. Data is sent to the protected server only when you take an action. It is not stored in localStorage or used for advertising. A technical session links your data, PDF and attachments.
EGN, identity card and date of birth
These are personal data. EGN is Bulgaria's national personal identifier and has additional protection requirements; it is not a password or standalone proof of identity. We do not require it in the initial form; we use the identity verified through the qualified electronic signature. An additional identifier may be requested only where necessary, for an explained purpose and legal basis, through a protected channel. We do not derive a date of birth from EGN for other purposes.
We do not accept identity-card copies. Article 25g of the Bulgarian Personal Data Protection Act allows an identity document to be copied only where the law provides for it. The identity-card number and date of birth are not necessary for this initial request. The qualified signature and power of attorney may already contain personal identifiers; access to them must be restricted.
Purposes, legal bases and recipients
The purposes are processing the request, contacting the applicant, checking authority to represent the company, preventing abuse and evidencing approved access. A pre-contractual basis is used only where the individual will be a party to the contract; for representatives and contact persons, legitimate interests are assessed and documented. A legal requirement must identify the specific provision. Acknowledging the notice is not blanket consent to unrestricted processing.
The intended recipients are the authorised Keagan Solutions team at info@keagansolutions.com and the necessary contracted hosting, mail and signing providers. Applications are stored privately and sent over an encrypted connection to the recipient mailserver. Access is limited to the authorised team. Mail copies follow the same retention policy. EGN is not included in email subjects or filenames.
Retention and protection
Unfinished applications are deleted within 24 hours of the last action. Rejected or withdrawn applications and their documents are retained for up to 90 days after rejection or withdrawal and then deleted. For approved applications, only the evidence necessary to establish identity, authority and granted access is retained while needed for the service and applicable legal claims. Where a specific legal obligation or ongoing dispute requires it, necessary evidence is retained for the relevant period with restricted access. Email copies of applications follow the same periods. These periods concern registration, not clients’ accounting archives. Files are stored outside the public directory and are not accessible through a public list or a link to another person’s application.
Your rights
Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction, objection and portability. Where processing is based on consent, you may withdraw it for the future. You may complain to Bulgaria's Commission for Personal Data Protection. For data enquiries: info@keagansolutions.com; do not attach identity documents to your initial enquiry. Applications are approved by a person, without an automated access decision.
Company data in ACP
The provider's role in registration is different from processing accounting and personnel data on a company's behalf. The latter requires a separate agreement under GDPR Article 28. It defines instructions, confidentiality, security, subprocessors, incidents, assistance and return or erasure of data.
Sources: GDPR Articles 5, 6, 13, 28, 32, 82 and 87; Bulgarian Personal Data Protection Act, Articles 25g and 25zh.