Privacy Policy — Atlantide Group

Draft pending legal review. This text was drafted based only on the data actually processed by the site and backend (contact forms, account registration, auction participation), without inventing purposes or third parties not present in the code. It must be verified by a legal counsel/DPO before final publication, in particular the clauses on non-EU data transfers and retention periods.

Last updated: 17 July 2026

1. Data Controller

The Data Controller for data collected through this website is Atlantide Real Estate Investments ("Atlantide Group"), with operating offices at Ulitsa Rakovsky 99, Business Tower, Sofia, Bulgaria. For any request regarding the processing of personal data, please write to info@atlantide-group.eu.

2. What data we collect and why

We collect personal data only when voluntarily provided by the user through the following site features:

Contact forms (consultation request, due diligence, general contact): name, surname, email, phone, message and referring page. Purpose: to respond to the request and, if applicable, prepare a commercial offer.
Account registration / reserved area: name, surname, email, phone, password (stored as a hash, never in plain text). Purpose: create and manage the account, allow access to the reserved area and participation in auctions.
Auction participation: participation request data and, where applicable, the bank transfer receipt file uploaded by the user as a security deposit, or the transfer's CRO/TRN reference. Purpose: manage auction participation and verify the security deposit.
Marketing consent: if the user explicitly opts in on a form, we send commercial communications about properties, auctions and services. Consent is always optional and can be withdrawn at any time.

We do not collect special categories of data (Art. 9 GDPR) and we do not carry out automated profiling.

3. Legal basis for processing

Processing of data needed to respond to a request, manage an account or an auction participation is based on the performance of pre-contractual/contractual measures requested by the data subject (Art. 6.1.b GDPR). Sending marketing communications is based on the user's explicit consent (Art. 6.1.a GDPR), which can be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Who we share data with

Data is not sold or transferred to third parties for their own commercial purposes. It is shared, to the extent strictly necessary, with the following providers acting as data processors on behalf of Atlantide Group:

Resend — sending transactional emails (confirmations, notifications about requests and auctions).
Supabase — database/backend infrastructure used to manage account and auction data.
Website hosting (Netlify or equivalent) — serving the site's static pages.
An external CRM (e.g. HubSpot or Pipedrive), only if and when activated by the Controller to manage commercial contacts. As of this notice, the CRM integration is not active.

Some of these providers may process data on servers located outside the European Union. In that case the transfer relies on the safeguards provided by the GDPR (e.g. European Commission Standard Contractual Clauses). [Point to be verified and completed by legal counsel based on the actual provider configuration.]

5. Data retention

Data is retained for as long as necessary to fulfil the purposes for which it was collected and, afterwards, for the period required by applicable legal obligations (e.g. tax/accounting regulations). Data from an inactive account or a contact request not followed by a business relationship can be deleted at the data subject's request at any time.

6. Data security

We adopt appropriate technical and organisational measures to protect data, including: passwords stored as cryptographic hashes, token-based authentication with expiry, rate limiting on public forms, and encrypted data transmission (HTTPS).

7. Your rights

As a data subject you have the right to request at any time, by writing to info@atlantide-group.eu:

access to your personal data and a copy of it;
rectification of inaccurate or incomplete data;
erasure of data ("right to be forgotten"), within the limits provided by law;
restriction of or objection to processing;
portability of the data you provided;
withdrawal of marketing consent at any time.

You also have the right to lodge a complaint with the competent supervisory authority (in Bulgaria: Commission for Personal Data Protection — cpdp.bg; in your own EU country, the local data protection authority).

8. Minors

The website and its services are not directed at individuals under 18 years of age, and we do not knowingly collect data from minors.

9. Changes to this notice

This notice may be updated to reflect changes in the services offered or in applicable law. The last-updated date is shown at the top of this page.