Privacy notice. What we collect, why, and your rights.
Recruitedia OOD is committed to protecting the personal data of candidates, clients, and website visitors. This notice explains what we collect, how we use it, and the rights you have under the EU GDPR and Bulgarian Data Protection Act.
1. Who we are
Recruitedia OOD ("Recruitedia", "we", "us") is a Bulgarian limited liability company registered in Sofia, licensed as an employer under Bulgarian law since 2023. We are the data controller for personal data processed through this website and in the course of providing our recruitment and employment-of-record services.
Contact for data-protection matters:
Email: hr@recruitedia-bg.com
Phone: +359 877 333 697
Address: Sofia, Bulgaria
2. What personal data we collect
Website visitors
- Data submitted through the contact form or calendar booking (name, work email, company, phone, role context)
- Technical data (IP address, browser type, pages visited) collected through basic analytics
- Cookies — see section 8
Candidates
- Contact data (name, email, phone, location)
- CV and career-related information (employment history, qualifications, references)
- Salary expectations and availability
- Notes from screening interviews and reference checks
- Employment-related data where we act as Employer of Record (identity documents, tax ID, bank details for payroll)
Client contacts
- Business contact data (name, work email, phone, job title, company)
- Records of communications, engagement scoping notes, contract data, invoicing information
3. Why we process personal data (legal basis)
- Contract performance — to deliver Search, Embedded, Activate, Launch, Employ, Insights, and Blueprint services under a signed engagement
- Legitimate interests — to identify and evaluate candidates for roles our clients have engaged us to fill; to maintain a talent pool for future opportunities; to respond to inbound business enquiries
- Legal obligation — payroll, tax, and social-security reporting when we act as Employer of Record; retention of accounting records
- Consent — for marketing communications; for keeping candidate profiles in our pipeline database beyond a specific search
4. Who we share data with
- Clients — candidate profiles are shared with the specific client who engaged the search, with the candidate's knowledge and consent
- EOR partners — for Employ engagements outside Bulgaria, we share employee data with our vetted country-specific EOR partners under strict data-processing agreements
- Service providers — hosting provider, Calendly, payroll/accounting providers, all bound by GDPR-compliant data-processing agreements
- Legal or regulatory authorities — where required by Bulgarian or EU law
We do not sell personal data. We do not transfer personal data outside the EU/EEA except where a client is based outside the EU and requires candidate profiles to be shared with them (typical for our cross-border recruitment model). In those cases we rely on Standard Contractual Clauses or an equivalent legal safeguard.
5. How long we keep data
- Candidate data: up to 24 months after the last active interaction unless the candidate consents to longer retention. Candidates may request deletion at any time.
- Client engagement data: duration of the engagement plus 5 years, per Bulgarian commercial and accounting law.
- Employer of Record employment records: statutory period required by Bulgarian labour law.
- Website analytics: anonymised after 14 months.
- Marketing consent records: retained until consent is withdrawn.
6. Your rights under the GDPR
- Access — request a copy of the personal data we hold about you
- Rectification — correct inaccurate or incomplete data
- Erasure ("right to be forgotten") — request deletion where we no longer have a legal basis to hold the data
- Restriction — restrict processing in specific circumstances
- Portability — receive your data in a machine-readable format
- Object — object to processing based on legitimate interest, including for direct marketing
- Withdraw consent — where processing is based on consent, you may withdraw it at any time
To exercise any of these rights, contact us at hr@recruitedia-bg.com. We respond within 30 days.
7. Cookies
- Strictly necessary — required for the site to function (session, security). No consent needed.
- Analytics — anonymised page-view data. Deployed only after consent.
We do not use advertising cookies, cross-site trackers, or third-party marketing pixels. Calendly (for booking calls) sets its own cookies subject to Calendly's own privacy policy.
8. Data security
We apply appropriate technical and organisational measures — encrypted transit (TLS), access controls limited to those staff who need the data to perform their role, regular reviews of our data-processing agreements. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the CPDP within 72 hours and the affected individuals without undue delay, per GDPR Articles 33 and 34.
9. Changes to this notice
This notice was last updated in September 2026. We will publish material changes on this page and update the "last updated" date.
This privacy notice is provided for information and is not legal advice. Our Master Services Agreement includes a specific data-processing addendum that governs processing in the context of our services.