Privacy policy
“Nautilex” EOOD, UIC 202385493 (“the Company”), registered seat and management address: Sofia 1527, Oborishte district, 105 Knyaz Al. Dondukov-Korsakov Blvd., apt. 3; email: office[@]nautilex.bg.
Website information
When you make an enquiry we process contact data and the description of your question. The rules for enquiries through wealth-architecture.eu and through nautilex.bg are set out in the two following sections.
Enquiries through wealth-architecture.eu
Version 4.0 of the platform. This section applies to the contact form and the four questions on wealth-architecture.eu and prevails over the general descriptions below. The controller is Nautilex EOOD, with the contact details given at the beginning.
Data and purpose. When you send an enquiry we process your name, email, phone number (if given), the selected topic, the answers to the four questions (if used), the preferred way to begin and the text of the message. The purpose is to respond to the enquiry and to arrange a call or a meeting. The data is not used for advertising. Please do not enter personal identification numbers, bank details, health data, confidential documents or unnecessary data about other people.
Legal basis. Consent (Art. 6(1)(a) GDPR), given by ticking the box before sending. Consent may be withdrawn at any time at office[@]nautilex.bg. Withdrawal does not affect the lawfulness of processing before it. For the technical protection of the form (a hidden field against automated programs and a limit on the number of submissions) our legitimate interest in preventing abuse applies (Art. 6(1)(f) GDPR).
Artificial intelligence tools. At present no artificial intelligence tools are used on wealth-architecture.eu to process visitors’ data. The AI questionnaire described in the following section applies only to nautilex.bg. If such tools are introduced on wealth-architecture.eu in the future, for example for the initial sorting of enquiries, this section will be supplemented before their use begins, stating the purpose, the provider and the legal basis. No decisions with legal effects for visitors will be taken solely by automated means.
Self-assessment checks. The answers in the checks on wealth-architecture.eu stay in the visitor’s browser and are not sent. If the visitor moves from the result to the contact form, only the selected topic is carried over to the form, and the visitor can change or remove it before sending.
Measuring visits. With your consent the site uses Google Analytics to record the opening of the contact page, enquiries sent, checks and interactive business cases started and completed. No names, email addresses, message texts or answers to the checks are sent to Google Analytics. The legal basis is consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time through the cookie settings.
Recipients. Access is limited to authorised persons in the practice and to the hosting and email providers (Jump.bg) to the extent required for the service.
Retention. Enquiries that do not lead to an engagement are deleted at the annual review once 12 months have passed since they were received. Where an engagement follows, the necessary information is transferred to the client file and kept for the applicable contractual and statutory periods.
Your rights. Access, rectification, erasure, restriction and, where applicable, portability and objection. Contact office[@]nautilex.bg. You have the right to lodge a complaint with the Commission for Personal Data Protection.
Enquiries through nautilex.bg and the AI questionnaire
Last updated: 8 September 2026. This section specifies the general policy for initial enquiries and prevails in case of any difference with the general descriptions of the periods and technologies below. The controller is “Nautilex” EOOD, with the contact details given at the beginning.
Data and purpose. We process the name and email of the enquirer, the phone and organisation if provided, the preferred means of contact, the chosen area, the description of the question, the answers, the deadline and stage of the matter, and the internal summary generated. Name and email are mandatory to submit through the questionnaire. Phone is mandatory only if telephone contact is chosen; organisation is optional. Without the mandatory fields the enquiry cannot be submitted through the questionnaire, but you can contact us by email. We use the data to understand the assistance requested, to organise and review the enquiry, and to respond. It is not used for advertising messages. Do not enter a personal identification number, bank details, passwords, health data, data on convictions, confidential documents or unnecessary data about other people. For the initial description, use general designations such as “employee” or “partner”. The provision of documents and sensitive details is arranged separately with the practice.
Legal bases. For an enquiry from a natural person regarding their own engagement: the taking of steps at their request prior to entering into a contract (Art. 6(1)(b) GDPR). For contact with representatives of organisations, the organisational allocation and the AI support of the initial review: the legitimate interest in reviewing incoming enquiries; for the technical protection: the interest in preventing spam, fraud and abuse (Art. 6(1)(f)). The confirmation “I have read this” certifies that the information was provided; it is not consent to marketing.
How AI is used. The description and the answers are transmitted to the OpenAI API to select clarifying questions, propose a category and produce an internal summary in Bulgarian, including where the enquiry is in English. Processing begins while the form is being completed, before final submission. The separate contact fields (name, email, phone and organisation) are not sent to OpenAI. If you include such data in the free text, it will be transmitted together with it. Closing the questionnaire does not undo the AI processing already carried out. The results may contain inaccuracies and are reviewed by a human. The questionnaire does not provide legal advice and does not accept or decline an engagement automatically. No decisions with significant legal or similar effects for you are taken solely by automated processing. You can send an enquiry without this AI questionnaire to office[@]nautilex.bg.
Recipients and international processing. Access is held by the authorised persons at the practice and by the hosting and email providers, to the extent necessary for the service. The site is hosted with Jump.bg. OpenAI receives the data described above for the AI processing. Cloudflare Turnstile receives technical signals, including IP address, browser and connection data and the origin of the request, for protection against bots. It loads after the confirmation on the first screen. Cloudflare acts as a processor for the protection of the site and as an independent controller for improving bot detection. The services of OpenAI and Cloudflare may involve processing outside the EEA, including in the USA. The applicable contractual safeguards, including the standard contractual clauses for international transfers, are described in OpenAI’s data-processing addendum and Cloudflare’s addendum. You can request information and a copy of the applicable safeguards at office[@]nautilex.bg.
Periods and security. The questionnaire session expires 15 minutes after it begins; expired sessions are cleared on the next request or by the scheduled clean-up. The working records submitted in the add-on are kept for 7 days from submission and cleared in the same way. Their content is encrypted and stored outside the site’s public folder. We also process a session identifier, timestamps, submission status, the version of the information and technical counters to limit abuse. Server logs are processed under the general security rules. The submitted enquiry, the original answers and the summary arrive in the office mailbox. For enquiries without an engagement, the correspondence is deleted 6 months after it is concluded. Where there is an engagement, the necessary information passes into the client file and is kept for the applicable contractual and statutory periods. Backups are used for recovery after an incident and drop out on rotation; after recovery the deletion rules apply again. Cleaning the add-on does not delete the office mailbox or the backups.
Requests to OpenAI. Requests are made with storage of the response for later retrieval switched off. This does not mean zero storage: under the provider’s standard rules, abuse-control data may be kept for up to 30 days, and longer where legally required or necessary to defend against harm. API data is not used for training by default.
Your rights. Access, rectification, erasure, restriction and, where applicable, portability; the right to object to processing based on legitimate interest. Contact office[@]nautilex.bg. You have the right to lodge a complaint with the Commission for Personal Data Protection.
General provisions
The Company, as controller, collects and processes information about natural persons whether the data is processed electronically or on paper, applying the necessary organisational and technical measures. This Policy forms part of the Company’s “Rules and procedures for personal data protection”.
Processing of personal data
Employees and subcontractors: data on physical identity and communication (name, personal identification number, phone, email, address), education, employment, professional experience and family status, for the conclusion, performance and termination of a contract, accounting services and the protection of legitimate interests.
Clients, counterparties, suppliers and their representatives: communication data (name, phone, email, address), education and professional experience, ownership and participation in the capital of companies, for the same purposes. The Company does not collect the data of children under 16 without a parent’s consent.
Log files and cookies
When the site is used, the browser transmits information stored in log files for a short time for security (IP address, files loaded, date/time and duration of the visit, volume of data, operating system and browser). The site uses cookies that store certain site settings; if they are blocked, an “opt-out cookie” is recorded. No web-analytics tool is currently used. The site does not use embedded social plug-ins.
Transfer of data
Data may be passed to processors in connection with accounting services and hosting, under an obligation of confidentiality. As a general rule the Company does not transfer data outside the EU; the exceptions for AI and bot protection are described above, with the applicable safeguards.
Rights and response times
The Company responds within one month (extendable by two months in complex cases). Rights include information and access, rectification and erasure, restriction, objection, portability, and a complaint to the CPDP: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., tel. +359 2 91-53-518, kzld@cpdp.bg.
Retention and destruction
Payroll records: 50 years; accounting registers and financial statements: 5 years; tax-and-social-security control documents: 5 years after the limitation period; all other media: 5 years. After the period, data is destroyed (shredding of paper, deletion of files).
The Company may change its protection measures in line with technical developments and update this policy accordingly.