Privacy and Personal Data Protection Policy

1. Controller and Contact

Data Controller: "AI Logic Solutions" Ltd., UIC 207233308, registered office and management address: Sofia 1592, Druzhba 1 residential complex, bl. 195, entrance D, floor 1, apt. 63, Bulgaria.

• Email for privacy enquiries and data-subject requests: info@konsultanti.bg
• Phone: +359 877 701 044, +359 876 449 942
• Data Protection Officer: No statutory Data Protection Officer is appointed; all privacy queries and GDPR requests are handled directly at info@konsultanti.bg.

2. Who this Policy Covers

• Clients — individuals who browse consultant profiles and book appointments on the Platform.
• Consultants — independent specialists who offer consulting services on the Platform, whether self-registered or added by a company.
• Companies — organisations that register to offer services through a team of consultants.
• Visitors — anyone browsing public pages of the Platform, including public consultant profile pages.

3. Categories of Data, Purposes and Legal Grounds

4. Public Consultant Profiles

To allow clients to discover and select appropriate consultants, the following information is shown on public profile pages visible without signing in: name, profile photo, spoken languages, location, areas of expertise, services offered and rates, ratings and review count, and years of experience.

• Legal Basis: performance of the contract between the consultant and the Platform (Art. 6(1)(b) GDPR) — profile publication is the core service provided to the consultant.
• Email addresses and personal telephone numbers are not exposed on public profile pages; all initial inquiries and bookings take place securely through the Platform.
• Consultants can update their profile information, adjust visibility, or request profile deletion at any time (§8).

5. Third-Party Integrations

5.1 Google Calendar and Google Meet

When a consultant connects their Google account, we integrate with Google Calendar (to check availability and create calendar events) and Google Meet (to automatically generate virtual meeting links for client bookings).

• The connection is directly to the consultant's own Google account under their terms of service with Google LLC.
• Permissions Requested (OAuth Scopes): https://www.googleapis.com/auth/calendar.events (creating and updating calendar events for appointments) and https://www.googleapis.com/auth/calendar.readonly (checking free/busy availability). We do not read unrelated calendar entries.
• What We Store: encrypted OAuth access and refresh tokens, the ID of the selected calendar, and the external IDs of meetings created by the Platform. Tokens are never exposed publicly.
• Disconnecting: a consultant can disconnect Google Calendar at any time under Calendar Settings; all stored tokens are immediately deleted.
• Our use of information received from Google APIs strictly complies with the Google API Services User Data Policy (including Limited Use).

5.2 Calendly

When a consultant connects Calendly (via Personal Access Token), we read their scheduling availability so clients can book appointments seamlessly. The token is stored encrypted and can be revoked at any time in profile settings.

5.3 Payments — Stripe

Payment card details are entered directly into Stripe and are never received or stored on our servers. Stripe processes transactions, payouts, and subscriptions according to certified PCI-DSS Level 1 compliance.

5.4 Other Processors

For transactional emails (booking confirmations, notices, password resets) and server hosting, we use certified infrastructure providers located within the European Union. We do not sell or lease personal data.

6. Company Accounts and Consultants Added by a Company

A registered company may create accounts for and manage its consultants. Where a company provides us with personal data of a consultant, we notify the individual in accordance with Art. 14 GDPR. Within a company team, the company administrator can view booking schedules and performance metrics of their team members solely for organizational and business management purposes.

7. Consultants as Independent Controllers

Regarding the substantive advice, documents, and discussions during a consultation, the consultant acts as an independent data controller, not as our data processor. The Platform provides the technical infrastructure for booking and connecting; each consultant is independently responsible for confidentiality and data handling within their professional practice.

8. Your Data Protection Rights

Under the GDPR, you have the right to exercise the following rights free of charge via the Privacy Center (when logged in) or by contacting us at info@konsultanti.bg:

• Right of Access: confirmation of processing and a copy of your personal data (self-service ZIP export with JSON and CSV available).
• Right to Rectification: correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): deletion of your account and personal data, subject to legal obligations (such as statutory accounting retention).
• Right to Restriction of Processing: restriction of processing under legally specified circumstances.
• Right to Data Portability: receiving your personal data in a structured, commonly used, machine-readable format.
• Right to Object: objection to processing based on legitimate interest or for direct marketing.
• Right to Withdraw Consent: withdrawing consent for marketing communications or optional cookies at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

We respond to all verified requests within one month (Art. 12(3) GDPR). You also have the right to lodge a complaint with the supervisory authority: Commission for Personal Data Protection (CPDP), Sofia 1592, 2 "Prof. Tsvetan Lazarov" Blvd., website: www.cpdp.bg.

9. Data Retention Periods

10. International Data Transfers

Certain processors (Stripe, Google, Calendly) are based in the United States. Transfers to these entities are governed by the EU-US Data Privacy Framework or European Commission Standard Contractual Clauses (SCCs), ensuring adequate protection.

11. Automated Decision-Making

The Platform does not engage in automated decision-making or profiling that produces legal effects concerning you under Art. 22 GDPR. Featured consultant listings reflect search criteria, user reviews, and active platform subscriptions.

12. Cookies

We use strictly necessary cookies to ensure the Platform operates properly, as well as optional analytics and marketing cookies subject to your consent. For complete details, see our Cookie Policy. You can adjust preferences at any time via "Cookie Settings" in the footer.

13. Security Safeguards

We implement rigorous organizational and technical security measures: TLS/SSL encryption across all network communication, encryption of third-party integration tokens, role-based access control on a strict need-to-know basis, regular database backups, and continuous system monitoring.

14. Protection of Minors

The Platform is not intended for individuals under 14 years of age. Individuals aged 14–18 may provide consent for information society services personally or with parental/guardian approval in accordance with applicable legislation.

15. Amendments to this Policy

We may update this Policy from time to time. Material changes will be communicated via notice on the Platform or via email. The "Last updated" date above indicates the current version.

16. Processors (Sub-processors)

The following service providers process personal data on our behalf under Data Processing Agreements (DPAs):