Privacy Policy

1. Information About the Personal Data Controller

Personal Data Controller: Seneca Advisory Ltd
Registered in: United Kingdom
Company Number: 10605225
Registered Address: 4 Lorden Walk, London E2 6NL, United Kingdom

Seneca Advisory Ltd processes personal data in accordance with applicable data protection legislation, including the EU General Data Protection Regulation (GDPR) and relevant Bulgarian legislation where applicable.

We process your personal data on the following legal grounds:

• Performance of a contract concluded between you and us;

• Your explicit consent, where the purpose is specified in each individual case;

• Compliance with a legal obligation.

The sections below provide detailed information on how your personal data is processed depending on the applicable legal basis.

2. Processing for the Performance of a Contract or Pre-Contractual Relations

We process your personal data in order to fulfill contractual and pre-contractual obligations and to exercise our rights under contracts concluded with you.

Purposes of Processing:

• Verifying your identity;

• Managing and fulfilling your requests and performing concluded contracts;

• Preparing offers for entering into a contract;

• Issuing and sending invoices for services you use;

• Providing comprehensive customer service and collecting payments due;

• Retaining correspondence related to orders, inquiries, problem reports, etc.;

• Notifying you about matters related to the services you use;

• Detecting and/or preventing unlawful actions or actions contrary to our service terms.

Categories of Data Processed:

Based on the contractual relationship, we process information related to its type and content, including:

• Contact data – email address, phone number, and other contact details;

• Identification data – full name, delivery address, email;

• Feedback provided by you;

• Information related to your actions on our website.

Providing these personal data is mandatory in order to conclude and perform the contract. Without them, we would not be able to fulfill our contractual obligations.

3. Disclosure of Personal Data to Third Parties

We may disclose your personal data to third parties in order to provide high-quality, fast, and comprehensive services. We only do so after ensuring that appropriate technical and organizational security measures are in place. We remain responsible for the confidentiality and security of your data.

Categories of Recipients:

• Postal operators and courier companies;

• Service providers maintaining hardware, software, and IT infrastructure;

• Consultants providing services in various professional fields.

Data Retention Period:

Personal data processed on this basis is retained for 5 years after termination of the contractual relationship, regardless of the reason for termination.

4. Processing for Compliance with Legal Obligations

In certain cases, we are legally required to process your personal data, including but not limited to:

• Obligations under anti-money laundering legislation;

• Obligations related to distance sales and off-premises sales under consumer protection law;

• Providing information to the Consumer Protection Commission;

• Providing information to the Personal Data Protection Commission;

• Accounting and tax obligations under applicable legislation;

• Providing information to courts or competent authorities in legal proceedings.

Data Retention Period:

• Accounting records – 11 years;

• Legal and regulatory obligations – 5 years or as required by law.

Disclosure:

When required by law, personal data may be disclosed to competent public authorities or legally authorized entities.

5. Processing Based on Your Consent

We process personal data on this basis only after receiving your explicit, voluntary, and informed consent. Refusal to provide consent does not result in any adverse consequences.

Consent is a separate legal basis and applies only to the purposes stated at the time it is given.

With your consent, and until its withdrawal, we may:

• Prepare personalized product or service offers;

• Conduct detailed analyses of your personal data.

Profiling and Data Analysis:

Data analysis may involve statistical models, algorithms, pseudonymization, and anonymization techniques to identify trends and statistical indicators.

Categories of Data:

• Email address

• Names

• Address

• Phone number

• IP address

• Other data explicitly provided by you

Third-Party Disclosure:

Data may be shared with marketing agencies, Facebook, Google, or similar platforms.

Withdrawal of Consent:

Consent may be withdrawn at any time via our website or contact details. Withdrawal does not affect prior lawful processing.

Retention Period:

Data processed based on consent is deleted upon request or 6 months after initial collection.

6. Processing of Anonymized Data

We process anonymized data for statistical and analytical purposes. Such data cannot be used to identify individuals.

Anonymization permanently removes identifying elements and is an alternative to deletion. Anonymized data is not subject to statutory deletion requirements.

7. Automated Processing and Profiling

We use partially automated algorithms and profiling techniques to improve and personalize our products and services.

8. Security of Personal Data

We apply all necessary technical and organizational measures required by data protection legislation to ensure data security.

Measures may include:

• Encryption;

• Pseudonymization;

• Internal security policies;

• Breach prevention procedures.

9. Data Received from Third Parties

We may receive personal data about you from other users of our services.

10. User Rights

Users are entitled to all rights under Bulgarian law and EU data protection legislation. Rights may be exercised via our contact form or email.

You Have the Right To:

• Be informed about data processing;

• Access your personal data;

• Correct inaccurate data;

• Erase personal data (“right to be forgotten”);

• Restrict processing;

• Data portability;

• Object to processing;

• Not be subject to automated decision-making with legal or significant effects;

• Seek judicial or administrative protection.

Right to Erasure Applies When:

• Data is no longer necessary;

• Consent is withdrawn and no other legal basis exists;

• Processing is unlawful;

• Legal obligation requires deletion;

• Data was collected in relation to services offered to children.

11. Right to Restriction of Processing

You may request restriction when:

• Data accuracy is contested;

• Processing is unlawful but deletion is not desired;

• Data is required for legal claims;

• An objection to processing is pending verification.

12. Right to Data Portability

You may receive your data in a structured, commonly used, machine-readable format and transfer it to another controller, where processing is based on consent or contract and carried out by automated means.

13. Right to Object

You may object to processing. Processing will cease unless compelling legal grounds override your interests. Objections to direct marketing result in immediate cessation.

14. Complaints

You may lodge a complaint with the Personal Data Protection Commission or a competent court.

15. Processing Records

We maintain a register of processing activities, including:

• Controller identity and contact details;

• Processing purposes;

• Categories of data subjects and data;

• Data recipients;

• Retention periods;

• Security measures.

16. Effective Date

This Privacy Policy was adopted and approved on 01 January 2026.