This policy explains what personal data we process when you browse wphost.bg, write to us, order, use the client account at my.wphost.bg or we maintain your site. It fulfils our duty to inform you under Articles 13 and 14 of Regulation (EU) 2016/679 (“the Regulation”). Cookies are described in detail in the cookie policy at https://wphost.bg/en/cookie-policy.
In short
- We collect the data you enter in the forms and in the client account to reply to you, conclude and perform the contract and issue invoices.
- We do not sell data and do not use it for advertising.
- We run our statistics ourselves. Only if you press “Accept” do we set the wph-vid cookie and keep your IP address and city in the statistics, for 90 days.
- The website and database run on servers in the EU, and traffic passes through Cloudflare.
- You have the right of access, rectification, erasure, objection and other rights, and you can lodge a complaint with the Bulgarian Commission for Personal Data Protection.
1. Controller
1.1. The controller is Private DevOps LTD (ПРАЙВЪТ ДЕВОПС ЕООД), company number (EIK) 204791393, registered office and management address Manastirski Livadi, bl. 200, entr. G, fl. 4, apt. 404, 1404 Sofia, Bulgaria, which offers its services under the WPhost brand (“we” or “us”). For questions and for your rights under section 7, write to support@wphost.bg.
1.2. We have no data protection officer, because our activity does not require one.
1.3. We are the controller of the data in this policy. For personal data in the sites and servers we maintain, for example the data of buyers in your store, you are the controller and we are a processor under the Data Processing Agreement at https://wphost.bg/en/data-processing. This policy does not cover that data or the visitors of your site.
2. What data we process and why
2.1. Visiting the website and bot protection
- Data. IP address, date and time, the page requested, browser and device data, and the country from the IP address as determined by Cloudflare.
- Purpose and basis. To deliver the website, protect it from attacks and limit excessive requests. The basis is our legitimate interest in a secure website (Article 6(1)(f) of the Regulation).
- Form protection. The order, inquiry, emergency help and withdrawal forms and the account logins are protected by Cloudflare Turnstile. It assesses from browser, device and IP address data whether a form is being sent by a person, and does not use this data for advertising. The basis is our legitimate interest in protecting the forms from spam and abuse.
2.2. Statistics and cookies
- Data. The pages visited without the address parameters, how long a page was visible, the referring site and campaign parameters (UTM), country, device type, browser and operating system family, screen width group, clicks on phone or email links without the number or address itself, and the stages of the forms, and on sending the order or inquiry number.
- Cookie. If you press “Accept”, we set a random number (the wph-vid cookie) and a flag showing whether the browser has visited on an earlier day. The basis is your consent (Article 6(1)(a)), which you can withdraw at any time from the cookie policy. While the cookie is set, the statistics also keep your IP address and city from Cloudflare, so that we can see who is on the site and the path of an individual visitor. They are deleted after 90 days.
- Without a cookie. Until you answer the banner, we count the visit with a number derived from the IP address and the browser that changes every night, and the IP address itself is not stored. The basis is our legitimate interest in knowing how many people visit the website. After “Refuse” the browser sends nothing for statistics.
- Purpose. To understand how the website is used and how far visitors get in the order and the inquiry, so that we can improve it. We recognise a browser, not a person.
- Link to orders and inquiries. If you order or write to us, we link the visits from the same browser to the order or inquiry, by the cookie or, without it, by the day's number.
2.3. Inquiries and emergency help
- Data. Name, email, preferred contact method, phone number if you choose contact by phone, the service, the site address, the title and description, and the deadline for the work. Optionally you say whether you write as a company, and for a company its name, company number and VAT number. We also record the inquiry number, the website language, the IP address and the link to visits under clause 2.2. Inquiries sent before 13 October 2026 may also contain a choice of Viber.
- Purpose and basis. To reply and make you a quote, at your request before a contract (point (b)). The IP address protects against spam and limits inquiries from one address (point (f)).
2.4. Unsent inquiries and orders
- Data. What you typed and chose in the inquiry, emergency help or order form before sending it, with the same fields as in clauses 2.3 and 2.5, a random form key, the language, the time and the IP address, of which only the first half is kept for IPv6. We save when you leave a field or the page, and only if you have typed something. Unless you have refused cookies, we also link what you typed to your visit in the statistics under clause 2.2, that is to the number for the day, and after “Accept” also to the wph-vid cookie, so that we can see how you reached the form.
- Purpose and basis. So that a started inquiry or order is not lost and we can help you if you left a way to contact you. If you send the form, what you typed is linked to the inquiry or the order. The basis is our legitimate interest (point (f)). You can object and ask for erasure by emailing us.
2.5. Orders
- Data. Name, email, phone, country, the chosen Plan, extra hours and payment period and the site address, and optionally company, company number, managing director, company address, VAT number and a note. We record when you accepted the terms and conditions and which version, and if you order as a consumer, when you asked for the work to start right after payment. We also record the order number, the website language, the IP address, the country from the IP address and the link to visits under clause 2.2.
- Purpose and basis. To process the order, issue the pro forma invoice and conclude and perform the contract (point (b)). The record of accepting the terms and of the early start request proves what you asked for (points (b) and (f)). Data on the place of supply is used to determine VAT (point (c)), and the IP address and its country to protect against fraud and as additional evidence of your country (point (f)).
2.6. VAT number check in VIES
- Data. The VAT number and country you give, and the reply from the European Commission's VIES system on whether the number is valid, with the name and address registered to it where the country provides them.
- Purpose and basis. To establish whether VAT is charged (points (c) and (f)). The check does not stop the order. If the number is not confirmed, our team checks it manually and issues a new pro forma invoice if needed.
2.7. Withdrawal from the contract
- Data. The name, email and order or pro forma number you enter in the form at https://wphost.bg/en/withdraw, the date and time of submission, the language and the IP address.
- Purpose and basis. To carry out the withdrawal and send you the confirmation the law requires (point (c)), and to be able to prove when it was received (point (f)).
2.8. Client account
- Data. Email, name, billing details, country, language, your services and domains, pro forma invoices and invoices, support requests, messages and your choice on marketing messages. You sign in with a link sent to your email, which we keep only as an irreversible code, which is valid for 15 minutes and works once. We record sign-in requests to limit abuse, keeping the email in them only as an irreversible code.
- Team access. If you ask for help, a member of our staff can open your account read-only. Each opening is recorded with the staff member's name, their IP address and the customer number.
- Purpose and basis. Access to your services, documents and requests (point (b)), protection of the sign-in and control of staff access (point (f)), and marketing messages with consent (clause 2.12).
2.9. Pro forma invoices, payments and invoices
- Data. Billing details, the services ordered and the amounts, document numbers and dates, and the payment details we receive from the bank, such as payer, account, amount and reference.
- Purpose and basis. Issuing the documents, accounting and tax reporting (points (b) and (c)).
2.10. Emails and support requests
- Data. Your email, the content of messages and requests, attachments and delivery data. Do not send passwords in requests and emails.
- Purpose and basis. Messages about the inquiry and the contract, such as confirmations, sign-in links, pro forma invoices, invoices and replies, and fixing problems (point (b)). Inquiry and order confirmations do not contain the name or site address you typed. The confirmation of a withdrawal does, because the law requires it.
2.11. Work on your site and server
- Data. The site and server addresses, the access details you give us, monitoring data such as availability, speed, errors, load and certificates, the history of changes in Git and records of our work.
- Purpose and basis. Performing the contract and responding to problems (point (b)). The personal data in the site itself and its copies is covered by the Data Processing Agreement (clause 1.3).
2.12. Marketing messages, requests from authorities and defending rights
- Marketing. We send commercial messages rarely and only if you consented with the box in the client account (point (a)). You can withdraw consent at any time from the account or by emailing us.
- Authorities. Data that an authority requests from us under the law is provided where there is a legal basis (points (c) and (f)).
- Defending rights. We also use the contract data and correspondence to establish, exercise or defend legal claims (point (f)).
3. Do you have to give us the data
3.1. An inquiry needs a name, email, description and contact method, plus a number for contact by phone. An order needs a name, email, phone and country. Without them we cannot reply to you or accept the order. Billing details are needed because the law requires us to issue invoices. The VAT number is needed for the reverse charge. The statistics cookie and marketing messages are voluntary and the website works without them.
4. Who receives the data
4.1. The data is available to our team as far as their work requires, and to the following recipients.
| Recipient | Purpose | Role |
|---|---|---|
| Cloudflare, Inc. | DNS, proxy, attack protection, Turnstile and website delivery | processor |
| Hetzner Online GmbH | servers for the website and database and copies of the maintained sites, in the EU | processor |
| Our email service provider | sending emails | processor |
| European Commission, VIES system | VAT number checks | independent controller |
| Our accountant | accounting | processor |
| Our bank | payments and refunds | independent controller |
| Legal, tax and audit advisers | advice and defending rights | processor or independent controller |
| Authorities, such as the National Revenue Agency, the consumer and data protection commissions, courts and prosecutors | where the law requires it | independent controller |
4.2. Processors act on our instructions and under a contract under Article 28 of the Regulation. We add a new recipient to the table before we start sharing data with it.
4.3. Cloudflare, Inc. is based in the USA and may process traffic data outside the European Economic Area. The transfer relies on the EU-US Data Privacy Framework, in which Cloudflare participates, and on the standard contractual clauses in its data processing agreement. Any other transfer outside the EEA would only be based on an adequacy decision or standard contractual clauses.
5. How long we keep the data
5.1. We keep data while it is needed for its purpose or while the law requires it, and then delete or anonymise it. Data the law requires us to keep is not deleted before the end of that period, even at your request.
| Data | Period |
|---|---|
| Invoices and other tax documents | until the period under the Bulgarian VAT and Accounting Acts ends, about 10 years |
| Pro forma invoices and bank documents | 5 years |
| Orders, the records of accepting the terms and of early start requests, withdrawals, inquiries, the IP addresses linked to them and the visits linked to them | no fixed period, as customer history and evidence |
| Visits in the statistics | 13 months |
| IP address and city in the statistics, only with the cookie accepted | 90 days |
| Unsent inquiries and orders | 30 days after the last change |
| Account and customer data after the contract ends | up to 5 years, except documents required by law |
| Support requests and messages | up to 24 months after they are closed |
| Emails about the contract | up to 5 years after the contract ends, and those unrelated to a contract up to 2 years |
| Sign-in links and sign-in request records | one day after they expire |
| Access details for your site and server | until the contract ends |
| Copies of your site with us after the contract ends | 30 days |
| History of work on the site and data for defending rights | up to 5 years |
| Requests from authorities | up to 5 years after the request |
| Proof of marketing consent | 12 months after it is withdrawn |
| Server logs and backups | while needed for security, then overwritten in their usual rotation |
| Cookies | as stated in section 10 |
6. Automated decisions
6.1. We do not make decisions that significantly affect you based solely on automated processing. Prices are not personalised. The system flags orders for human review where the country given differs from the country of the IP address or the VAT number is not confirmed, and the decision is always made by a person on our team.
7. Your rights
7.1. You have the right of access to your data and to a copy of it, to ask for inaccurate data to be corrected, for erasure where there is no reason to keep it, for restriction of processing, and to portability of the data you gave us in a machine-readable format. You can withdraw your consent at any time, without affecting the processing before that.
7.2. Right to object. You can object at any time to processing based on our legitimate interest, that is, where the basis in section 2 is point (f). We then stop, unless we have compelling grounds that override your interests or need the data to defend legal claims.
7.3. Send requests to support@wphost.bg. We reply free of charge within one month, and for complex requests this may be extended by two more months, which we will tell you about. If we have reasonable doubts about your identity, we will ask for additional information.
7.4. You can lodge a complaint with the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, kzld@cpdp.bg, https://www.cpdp.bg, within 6 months of learning of the infringement and no later than two years after it occurred. If you live or work in another EU country, you can also turn to the supervisory authority there. You can also seek protection in court, including compensation for damage.
8. Security
8.1. The connection to the website is encrypted. Sign-in links are kept only as an irreversible code, each customer's data is separated from the others', and staff access to accounts is recorded. Copies of the maintained sites are on servers separate from our systems for the website and orders. Only team members who need the data have access to it.
8.2. If a security breach creates a risk to your rights, we notify the Commission for Personal Data Protection within 72 hours, and you when the risk is high.
9. Children
9.1. Our services are for adults and businesses, and we do not knowingly collect children's data. If we learn that we have received a child's data without the necessary consent, we will delete it.
10. Cookies and browser storage
| Name | Purpose | Duration |
|---|---|---|
| wph-cookie-consent | remembers your answer to the banner (necessary) | 180 days after the answer |
| wph-vid | random number to recognise a browser that visited on an earlier day (only after “Accept”) | 180 days, renewed on each visit |
| wph_client | sign-in to the client account (necessary, only after signing in) | up to 24 hours or until sign-out |
10.1. Cloudflare may set its own technical cookies for bot protection, for example __cf_bm or cf_clearance. They are needed for security and are not used for advertising. Details and changing your choice are in the cookie policy.
11. Changes to this policy
11.1. We publish the new version on this page with its date. If a significant change affects you, we tell you by email, and we inform you before processing your data for a new purpose.