Convenience translation. This is an English translation of the Bulgarian text. If the two differ, the Bulgarian text prevails.
Effective from: 4 October 2026
In short. This agreement governs the use of the website romfeya.online and contains the information on how the personal data of its visitors and registered users are processed. Registering on the website means accepting the agreement. The website does not track visitors and loads nothing from third parties. We use the personal data you give us only for the purposes described in section 7 – we do not sell them and do not pass them on for advertising.
1. Parties and subject matter
1.1. The website romfeya.online (the “website”) is operated by Kibersigurnost EOOD, UIC 205848886, VAT identification number BG205848886, with its seat and registered address at 23 Akad. Petar Dinekov St., Sofia, Bulgaria (“Kibersigurnost”, “we”) – the publisher of Romfeya UBP.
1.2. The agreement is concluded between Kibersigurnost and the person who creates an account on the website on behalf of a company (the “user”, “you”). By registering, you confirm that you are authorised to act on behalf of that company.
1.3. The agreement governs registration and the account on the website, access to the documentation, and the requests, enquiries and messages submitted through the website. The sections on personal data and cookies (6–13) contain the information under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) for the website’s visitors and users.
1.4. The agreement does not govern the use of the Romfeya UBP system itself. Such use is governed by a separate contract with the companies that use the system (the “clients”); personal data in the system are governed by the general terms and conditions attached to that contract – the Romfeya UBP Personal Data Protection Policy and the Romfeya UBP Personal Data Processing Agreement.
2. Acceptance
2.1. Registering on the website constitutes acceptance of this agreement. Registration means creating an account – either on the registration page or by submitting a demo request or purchase enquiry without an account.
2.2. The text of the agreement is available on this page before registration. When registering, you confirm that you have read it and accept it.
2.3. Visitors without an account may browse the website and write to us through the contact form without accepting the agreement. For them, sections 6–13 serve as information on how we process their data. Accepting the agreement is not consent to the processing of personal data: the legal bases for the processing are set out in section 7, and the only consent – to receiving news – is given separately and optionally.
3. Registration and account
3.1. Registration is free of charge. It requires the company name, UIC, the name of the contact person, a work email address and a password; optionally – position and telephone.
3.2. The account is activated once you confirm your email address through the link we send you. An account that has not been confirmed within 7 days is deleted automatically.
3.3. You are responsible for the accuracy of the data you enter and for keeping your password secret. The account is personal and must not be made available to other persons.
3.4. You can change your data and delete your account at any time – from the account itself. Deletion is immediate; for backups, see section 8.
3.5. When using the website, you must not infringe the law or the rights of others, attempt to circumvent its protection or to gain access to other users’ accounts and data, send automated or mass requests or overload the website, or enter unlawful or malicious content.
3.6. We may suspend or delete an account created with false data or used in breach of this agreement. We will notify the user by email, unless prohibited by law.
4. The documentation and the content of the website
4.1. The Romfeya UBP user guide and functional specification are available to registered users.
4.2. The documentation and the other content of the website – texts, illustrations, names and marks – are subject to intellectual property rights that belong to Kibersigurnost, unless stated otherwise; the names of other companies’ products mentioned in the documentation belong to their owners. You may use the content to familiarise yourself with Romfeya UBP, including by sharing it within your company. Any reproduction or distribution beyond that requires our written consent.
4.3. The documentation describes the system as at the date of its edition. The features evolve and their status changes; for the relationship between the client and Kibersigurnost, the contract for the use of the system prevails.
5. Requests, enquiries and messages
5.1. Through the website you can request a demo, send a purchase enquiry or send a message. Requests, enquiries and messages are not orders and create no obligations for either party; the contract for the use of the system is concluded separately.
5.2. We reply to the email address given in the request or in the account.
6. Personal data – who processes them
6.1. The controller of the personal data processed through the website is Kibersigurnost EOOD, with the details given in clause 1.1.
6.2. Send questions and requests relating to your personal data through the contact form or by letter to the address of Kibersigurnost EOOD. No data protection officer has been designated; these matters are handled by the managing director of Kibersigurnost EOOD.
7. What data we process, why and on what basis
| When | What data | Why | Basis |
|---|---|---|---|
| You write to us through the contact form | name, email address and message; optionally – company and telephone | so that we can reply to you | our legitimate interest in replying to the enquiries we receive (Article 6(1)(f) of the GDPR) |
| You create a website account | company, UIC, name of the contact person, work email address and password (we keep only a hash); optionally – position and telephone | so that we can maintain your account, accept your requests and give you access to the documentation | performance of this agreement (Article 6(1)(b)) |
| You request a demo or send a purchase enquiry | the data from the account; optionally – line of business, the modules you are interested in, number of users and a message | so that we can set up access to the demo environment or prepare the quotation | performance of this agreement and steps taken at your request prior to entering into a contract (point (b)) |
| You have indicated that you would like news | your email address and when the consent was given or withdrawn | so that we can send you news about Romfeya UBP | your consent (point (a)); it is not a condition of registration and you can withdraw it at any time from your account |
| You log in to your account | a login cookie; the network address and the browser recorded with the session; the time of the last login | so that you stay logged in and so that we can protect your account | performance of this agreement (point (b)) and our legitimate interest in the security of the accounts (point (f)) |
| You open a page of the website | an entry in the web server log: truncated network (IP) address, time, the page opened without its parameters, browser; if the server refuses the request or an error occurs – an entry in the error log with the full network address | for the operation and protection of the website and for aggregate visit statistics | our legitimate interest in the website working and being protected (point (f)) |
| You try to log in to an account | a record of the attempt with the full network address; after many failed attempts within a short time the address is blocked | for protection against password guessing | our legitimate interest in security (point (f)) |
The fields marked in the forms as required are needed so that we can do what you are writing to us about; the rest are optional. We do not profile you and do not make automated decisions about you.
To limit the rate of requests to the forms, we keep only a salted hash of the network address or of the email address – not the value itself – and delete it after one day at the latest.
8. How long we keep the data
| Data | Period |
|---|---|
| Website account | until you delete it. Deletion is done from the account itself and is immediate; upon deletion, the name, email address, telephone and the messages in your requests are erased |
| Account with an unconfirmed email address | deleted automatically within 7 days after registration |
| Requests and messages from the forms | up to 24 months from their submission; after that the personal data in them are erased |
| Login session | until you log out of the account or close the browser, but no longer than 2 days |
| Log of actions on the website (logins, failed attempts, changes) | 30 days |
| Visit log (with truncated address) | 30 days; the aggregate monthly reports, which contain no personal data – 2 years |
| Log of login attempts (with full address) | up to 2 days; the list of blocked addresses – 90 days |
| Web server error log (with full address and the address of the refused request) | 14 days |
| Backups of the website | up to 8 weeks. A deleted account remains in the old backups until they expire; the backups are encrypted and are used only for recovery after a failure |
9. Who receives the data
- The provider of the rented server on which the website runs, and the provider of the email service of Kibersigurnost EOOD, through which the emails from the website pass. Both are established in the European Union and process the data only in order to provide their service.
- Public authorities – only on a legally binding request issued in accordance with the procedure laid down by law.
We do not transfer personal data to recipients outside the European Economic Area. The website has no analytics or advertising services, no social network buttons and no embedded content from third parties.
10. Your rights
You have the right of access to your data, to their rectification and erasure, to restriction of processing and to object to processing that is based on legitimate interests. Where the processing is based on consent or on a contract, you also have the right to receive your data in a machine-readable format. You can withdraw your consent to receiving news at any time, without this affecting the lawfulness of the processing before the withdrawal.
You can exercise some of these rights yourself, from your account: you can change your data, withdraw your consent to receiving news and delete the account. For everything else, write to us through the contact form. We reply within one month; for complex or numerous requests the period may be extended by a further two months, of which we will inform you. To protect your data, we may ask you to confirm that the request comes from you.
If you believe that we are processing your data unlawfully, you have the right to lodge a complaint with the Commission for Personal Data Protection – 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, cpdp.bg.
11. How we protect the data
The website is accessible only over an encrypted connection (HTTPS). Passwords are kept solely as a hash. The account is activated only after the email address has been confirmed. Login to the account is locked for 15 minutes after 5 failed attempts, and a network address with many failed attempts within a short time is blocked. The forms do not reveal whether a given email address has an account. The visit log contains truncated addresses. Only staff accounts have access to the administration of the website.
12. Cookies
A visitor without an account receives no cookie at all. After you log in to your account, the website sets only the cookies needed for you to stay logged in. The details are on the “Cookies” page.
13. Clients and users of the Romfeya UBP system
The login to the system is at a separate address and is not part of this website.
The data that your company and its users enter in the system – about employees, counterparties and documents, including the user accounts, the login data and the records of access to the system and of the actions carried out in it – are processed on your company's behalf: your company is their controller and Kibersigurnost EOOD is the processor. You exercise your rights regarding these data with your company.
The personal data of the client, where the client is a natural person, and of its legal representatives, authorised representatives and contact persons, which we process in connection with the contract – names, position, contact details, signature, the data in the contract and in the accounting documents, and our correspondence – are processed by us as controller: to conclude and perform the contract, to fulfil our accounting obligations and to defend our rights in the event of a dispute. We keep them for the term of the contract and five years after its termination and, in the event of a pending dispute, until it has been finally resolved; accounting documents are kept for the periods laid down in the Accountancy Act and the Tax and Social Insurance Procedure Code.
The details are in the Romfeya UBP Personal Data Protection Policy and in the Romfeya UBP Personal Data Processing Agreement.
14. Liability
14.1. The content of the website is provided for information purposes and is not an offer. It describes the system as at the date of its publication.
14.2. We take care to keep the website working and protected, but we do not guarantee that it will be available without interruption. We are not liable for damage resulting from temporary unavailability of the website or from the use of the information on the website, except in the case of intent or gross negligence.
15. Changes to the agreement
15.1. The current text is always on this page, with the date from which it is effective.
15.2. We will notify registered users by email of any material change at least 14 days before it takes effect. If you do not agree with the change, you can delete your account; if you continue to use it after the effective date, you are deemed to have accepted the amended text.
16. Term and termination
16.1. The agreement remains in force for as long as you have an account on the website and terminates when the account is deleted – by you, by us under clause 3.6 or automatically under clause 3.2.
16.2. After termination, the personal data are retained and erased in accordance with the periods set out in section 8. Clauses 4.2, 14 and 17 continue to apply after termination.
17. Governing law and disputes
17.1. The agreement is governed by Bulgarian law.
17.2. Disputes are resolved by mutual agreement and, where that is not possible, by the competent Bulgarian court.
18. Final provisions
18.1. If any provision of the agreement proves to be invalid, this does not affect the remaining provisions.
18.2. The agreement is drawn up in Bulgarian. The English and Russian translations are provided for convenience; if they differ, the Bulgarian text prevails.
18.3. Send questions about this agreement through the contact form or by letter to the address of Kibersigurnost EOOD given in clause 1.1.