Data controller
The data controller is Invest Bulgaria Group EOOD, UIC 131238011, 5 Hristo Kovachev Str., Sofia 1527, Bulgaria. For any question about your personal data, write to us through the contact form. We reply within one month.
What we collect
- Account: email, password (we store only a cryptographic hash, never the password itself), name, nickname, phone and town if you fill them in, language and notification setting, the date you registered and last signed in.
- Portfolio: the coins you enter, quantity, purchase price and date, notes.
- Exchange: listings and photos, bids, offers, questions and answers, orders, ratings, reports and saved searches.
- Form messages: name, email, company, the text of the message and the page it was sent from.
- Technical data: your IP address is used to limit sign-in and form attempts (those records are deleted within 24 hours). With form messages we keep only a shortened hash of the address. The hosting keeps standard server logs.
Why we use them
- For your account, portfolio and the Exchange: to provide the service under the Terms of Use (Art. 6(1)(b) GDPR).
- To answer your messages, at your request (Art. 6(1)(b) and (f)).
- To protect the site against spam, fraud and abuse and to keep it secure: legitimate interest (Art. 6(1)(f)).
- For service emails: email confirmation, password reset, notices about bids, offers and sales. You can switch off alerts for saved searches in your account.
We do not use your data for advertising, we do not sell them and we do no profiling. The site has no advertising cookies and no third-party analytics.
Who sees your data
- Other Exchange users see your nickname, town, ratings and listings. After a deal, buyer and seller see each other’s names, email and phone so they can arrange payment and delivery.
- Our hosting and email providers, who process the data on our behalf and on our instructions.
- Public authorities, when the law requires it.
- YouTube: videos load from youtube-nocookie.com only after you press play.
How long we keep them
- Account and portfolio: for as long as you have an account. When you delete your account under “My account”, we delete your portfolio, watchlist and messages, and erase your name, email, phone and town. Completed deals and ratings stay, but without data that identify you.
- Form messages: unconfirmed ones for up to 7 days, the rest for up to 12 months.
- Your sign-in session: up to 30 days. Rate-limit records: up to 24 hours.
Your rights
You have the right to access your data, to have them corrected or erased, to restrict processing, to data portability and to object. You can download your portfolio as a CSV file at any time. If you believe your rights have been breached, you may complain to the Bulgarian Commission for Personal Data Protection.
Security
The site runs over HTTPS only. Passwords are stored as hashes and the database is kept outside the server’s public folder. Registrations and form messages are confirmed by email.
Children
You must be at least 16 to open an account. Buying and selling on the Exchange is for adults only.
Changes
If we change this policy we will update the date at the top, and we will email registered users about significant changes. See also Cookies.