Privacy Policy

1. Data controller and contact details

The controller of personal data for the activities described here is EIGHT INVEST EOOD, a Bulgarian single-member limited liability company, Unified Identification Code (UIC) 202156441, with its registered office and address of management at: Bulgaria, Sofia 1113, Izgrev District, 15–17 Tintyava Street. In this Policy, the company is referred to as “EIGHT INVEST” or “we”.

Contact person for personal data protection matters: Dimitar Ivanov. For questions and the exercise of your rights, contact privacy@eightinvest.com. Requests are handled by authorised persons at EIGHT INVEST. Correspondence address: Sofia 1113, Izgrev District, 15–17 Tintyava Street, Bulgaria, marked “Personal Data Protection”.

2. Scope of this Policy

This Policy explains how personal data is processed when you visit our corporate website at https://eightinvest.com/, submit enquiries and project proposals, and engage in related initial business communications. Personal data means information that identifies you or can be linked to you as a natural or legal person.

We apply Regulation (EU) 2016/679 (“GDPR”), the Bulgarian Personal Data Protection Act and the relevant rules on electronic commerce and electronic communications. Merely visiting the Website or reading this Policy does not constitute consent to processing that requires separate consent.

Before collecting additional data in connection with a specific transaction, due diligence, a job application or a particular service, we provide additional information about the relevant processing. This Policy is not a general authorisation to collect identity documents, financial files or information about all companies with which we are affiliated.

3. Enquiries from individuals

Through the “Apply for investment” form, we receive names, an email address, a legal entity name, the current stage of development and a brief description of the idea or business. These fields are mandatory; a website link is optional. The form does not allow file attachments. In general email correspondence, we process the contact details provided and the content of messages.

Where an individual requests specific steps before entering into a contract to which that individual will be a party, processing that is objectively necessary for those steps is based on Article 6(1)(b) GDPR. For a general enquiry without that contractual purpose, the basis is our legitimate interest in responding and maintaining business correspondence under Article 6(1)(f) GDPR, following an assessment of necessity and a balancing of interests against your rights.

Submitting a proposal is voluntary. The name, email address, legal entity, stage of development and brief description fields are required to submit the form. A website link is optional. General enquiries may be sent to info@eightinvest.com.

4. Company representatives and project proposals

For the initial assessment, we process the information provided in the form, including the company represented, its stage of development and the brief description. Subsequent communications take place by email; detailed projects and files are sent after a confidentiality agreement has been signed. Additional personal data in those materials is limited to what is necessary for the assessment.

The purposes are to contact the sender, assess the project initially, clarify the proposal and organise relations with the company represented. The basis is EIGHT INVEST’s legitimate interest in assessing business proposals and managing those relations under Article 6(1)(f) GDPR. A contract with a company does not automatically make its representative a party to that contract.

At the initial contact stage, we do not require a Bulgarian personal identification number (EGN), passport, identity card, health data or criminal conviction data. Do not send such information without a separately established need and a lawful communication channel. Where identification or a specific check is applicable, we provide advance information about the specific legal basis, the data required, whether it is mandatory, the recipients and the retention period. Such requirements do not arise solely from the word “invest” in the Company’s name.

5. Technical access and security

When the service is used, the transmission of technical information is limited to what is necessary to handle requests, ensure the normal operation and security of the service, and prevent misuse. The purposes are to display the requested page, resolve faults, and prevent and investigate misuse. The basis is our legitimate interest in reliable and secure Website operation under Article 6(1)(f) GDPR. We do not rely on this basis to circumvent any consent required for non-essential tracking.

6. Rights requests and legal claims

To handle requests concerning personal data, we process contact details, the content of the request, the response and only the information necessary to verify identity. The basis is compliance with our obligations under Articles 12–22 GDPR, pursuant to Article 6(1)(c) GDPR.

In connection with a specific legal claim or where necessary to demonstrate compliance with our obligations, we may retain relevant documentation with restricted access on the basis of our legitimate interest in establishing, exercising or defending legal claims under Article 6(1)(f) GDPR. Disclosure to a competent authority to comply with a specific legal obligation is based on Article 6(1)(c) GDPR and the relevant applicable provision.

7. Marketing communications

As of this version, we do not send newsletters or advertising messages and do not carry out marketing profiling. Submitting an enquiry does not add the sender to a marketing list.

If a subscription to marketing communications is introduced in future, information about the purposes, data used, legal basis and retention period will be provided in advance. Where consent is required, it will be obtained separately and voluntarily, with an easy way to withdraw it.

8. Data from other persons or sources

In addition to receiving information directly from you, we may receive professional information about representatives and team members from the sender of a specific project proposal or from the company represented. Where necessary to verify a proposal, we may check names, representative capacity and publicly disclosed professional information against the Commercial Register or the relevant organisation’s official website.

The basis for this limited verification is our legitimate interest in identifying the appropriate business contact and verifying the reliability of the proposal. The public availability of information does not authorise its use for any other purpose.

Where we obtain your data indirectly, we provide the information required by Article 14 GDPR, including the specific source and categories of data, within a reasonable period and no later than one month. If we contact you or disclose the data earlier, we inform you no later than the first communication or disclosure. An exception applies only where its statutory conditions are actually met. Information provided by the sender does not remove our own obligations.

9. Who may receive the data

Submissions are forwarded to EIGHT INVEST’s own server in Bulgaria and processed through internal email services. Hosting, email, maintenance and security are provided internally by the Company. Only authorised persons have access, according to their duties.

Where a provider processes data on our behalf, the relationship is governed by Article 28 GDPR. A professional adviser or authority may act as a separate controller for its own statutory functions. Joint controllership arises where the purposes and means of processing are genuinely determined jointly, rather than solely because entities belong to the same group.

Submitting a project does not authorise general sharing with portfolio companies, partners or prospective investors. Before any such separate disclosure, the recipient or a sufficiently specific category of recipients, the purpose and legal basis are determined, and you are given the necessary information. We do not disclose your data for third parties’ independent marketing merely because you have contacted us.

No external providers or subcontractors are used for the infrastructure described. If this changes, information about recipients is updated before the relevant processing begins.

10. Data location and international transfers

Data from the form is processed on a server in Bulgaria. Storage and remote access for the activities described are limited to the EU and the European Economic Area (EEA). As of this version, there is no processing or access from countries outside the EEA.

Transfers outside the EEA are permitted only in compliance with Chapter V GDPR: an applicable adequacy decision or appropriate safeguards, such as applicable standard contractual clauses and any necessary supplementary measures. Derogations under Article 49 GDPR are not the usual basis for permanent infrastructure arrangements.

If a service involving such a transfer is used, we provide specific information in advance about the service concerned, the recipient or category of recipients, the country and the applicable transfer mechanism. You may request information and a copy of the relevant safeguards at privacy@eightinvest.com, subject to the protection of others’ rights and confidential information. Acceptance of the Terms of Use or reading this Policy is not general consent to international transfers.

Before any future infrastructure change involving a transfer outside the EEA, the necessary safeguards and transfer information will be put in place.

11. How long we retain data

The Website does not maintain a separate database of submitted forms. Enquiries are received and stored as emails within the email infrastructure for the time necessary for communication and assessment of proposals. Such storage is part of personal data processing and is subject to the rules on storage limitation.

Data retention periods

Data	Starting point and maximum retention period
General enquiry without subsequent negotiations	6 months after the enquiry is closed.
Project proposal not resulting in a transaction	12 months after the assessment is completed or negotiations end. Retention for a future, unrelated opportunity is agreed separately on an appropriate legal basis.
Ongoing contacts with representatives of organisations	For as long as the contact is needed for active relations and for up to 12 months after those relations end; accuracy is reviewed at least annually.
Routine technical logs	30 days after the event is recorded.
Records isolated in connection with a specific incident	Until the investigation is completed and for up to 90 days thereafter, unless an applicable obligation or a specific legal claim requires otherwise.
Personal data rights requests and responses	3 years after the request is closed, to demonstrate how it was handled; unnecessary identity verification data is removed earlier.
Backups	Data deleted from live systems is removed through cyclical overwriting within 90 days; backups have restricted access and are not used for ordinary business purposes.

If a dispute arises or a specific legal obligation applies, only the relevant portion of the data is retained for the duration of that obligation, the applicable limitation period or until the final conclusion of the proceedings and enforcement, as appropriate. The retention period is not automatically extended for all data.

If a contract is subsequently concluded, retention periods for contractual and accounting records are determined separately according to the type of document and applicable law. There is no general ten-year retention period for all Visitors, enquiries and project proposals.

12. Cookies and similar technologies

When verification is requested in the investment application form, we use the essential first-party session cookie “eight_invest_session” for form verification and protection against forged requests and automated spam. It contains a session identifier, not your application details. The cookie normally lasts until the browser session ends; browsers that restore sessions may retain it. Verification questions expire after 15 minutes. We do not use analytics, advertising pixels, externally embedded components or other tracking technologies. If such technologies are introduced, we will publish the necessary information and provide a prior choice where consent is required.

Before non-essential technologies are introduced, their names, providers, purposes, categories and retention periods, together with data recipients and any applicable international transfers, will be disclosed.

Where consent is required, equally accessible options to accept, refuse and adjust settings are provided. Non-essential categories are disabled by default; withdrawing consent is as easy as giving it.

Refusing non-essential technologies does not restrict access to public information or the ability to submit an enquiry. Components requiring consent are loaded only after the relevant choice. Continuing to browse does not constitute consent.

13. Your rights

Subject to the applicable legal conditions, you have the right to access and obtain a copy of your personal data, have inaccuracies rectified, request erasure and restrict processing. Erasure is not unconditional, for example where data is necessary to comply with a legal obligation or defend legal claims.

Where processing is automated and based on your consent or a contract with you, you may receive the personal data you have provided in a structured, commonly used and machine-readable format and, where technically feasible, request its direct transmission to another controller under Article 20 GDPR.

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of earlier processing. Withdrawal does not override any separate applicable obligation to retain necessary documentation.

14. Right to object

Where processing is based on legitimate interests, you may object at any time on grounds relating to your particular situation. We will stop processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or a need to establish, exercise or defend legal claims.

You may object to processing for direct marketing at any time without giving reasons. Following an objection, we stop processing for that purpose, including related profiling.

15. How to exercise your rights and lodge a complaint

Send your request to privacy@eightinvest.com or to EIGHT INVEST’s postal address, marked “Personal Data Protection”. Describe your request and provide enough information for us to locate the data relating to you. You do not have to use a particular form provided by us.

We respond without undue delay and no later than one month after receiving the request. Where necessary due to its complexity or the number of requests, the period may be extended by a further two months; we inform you of the extension and the reasons within the first month.

Where we have reasonable doubts about your identity, we may request only the additional information necessary to verify it. We do not automatically require a copy of an identity card. Requests are generally free of charge. A reasonable fee or refusal is permitted only under the statutory conditions for manifestly unfounded or excessive requests; we bear the burden of demonstrating this. The first copy provided in response to an access request is free; a reasonable fee may be charged for additional copies.

If we do not take action, we inform you within one month of the reasons and the possibility of lodging a complaint and seeking a judicial remedy.

You may lodge a complaint with the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592, Bulgaria; kzld@cpdp.bg; https://cpdp.bg. Follow its current complaint submission instructions. You may also contact another competent supervisory authority, in particular in the country of your habitual residence, place of work or the alleged infringement. You do not need to contact us first; your right to a judicial remedy is preserved.

16. Automated decisions and children’s data

We do not carry out profiling or automated assessment of proposals and do not make decisions based solely on automated processing. Proposals are assessed by authorised persons.

Before introducing such a process, we provide the applicable information about the legal basis, the logic involved, its significance and envisaged consequences, and ensure the safeguards required under Article 22 GDPR. The corporate Website is not directed at children; children’s data is not sought for the purposes described. This does not restrict the rights of an affected child or their legal representative.

17. Data security

Requests concerning personal data and responses to incidents are handled by an authorised person at EIGHT INVEST. Access to submissions and correspondence is limited according to duties.

Information should be protected through appropriate technical and organisational measures proportionate to the nature of the data and the risks involved in its processing. The allocation of responsibilities must ensure continuity of activities, including arrangements for cover when the authorised person is absent.

In the event of a personal data breach, the risk to affected individuals is assessed and the necessary notifications are made in accordance with applicable legal requirements. Technical and organisational measures are proportionate to the nature of the data and the processing risks.

18. Updates and other websites

When processing changes, we update this Policy and the stated date of the version in force. We provide appropriate notice of material changes before applying them. Before processing for a new purpose, we provide the necessary information and establish the applicable legal basis, including fresh consent where required.

When you visit another website, the rules of its operator apply. This does not override our own obligations when embedding services or disclosing data. An affiliation between companies or the display of another entity’s logo does not automatically bring their websites within the scope of this Policy.