1. Introduction
NK-GROUP LTD, which provides the Buildinghost platform ("we", "us", "our"), is a controller of personal data within the meaning of Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act.
This Privacy policy describes how we collect, use, store and protect your personal data when you use the Buildinghost platform. It applies to all users of the Platform. By registering or using the Platform, you confirm that you are aware of this Policy.
2. Data controller
Controller details:
- Name:
- NK-GROUP LTD
- Country:
- Republic of Bulgaria
- Email:
- privacy@buildinghost.eu
- Website:
- buildinghost.eu
3. Data we collect
3.1 Data you provide
| Data category | Examples | Required |
|---|---|---|
| Identification data | Email address, password (hashed) | Yes |
| Profile data | Full name, phone, job title | Partly |
| Company data | Name, address, company number, country of establishment | Yes |
| Financial data (projects) | Budgets, costs, wages | Optional |
| Documents and files | Invoices, contracts, photographs | Optional |
| Worker data | Names, hours worked, wages | Optional |
| Communication data | Messages to support | As needed |
3.2 Technical data (collected automatically)
- IP address when accessing the Platform
- Browser type and version
- Operating system
- Date and time of access
- Actions within the Platform (audit log)
- Technical errors and diagnostic logs
3.3 Data provided by third parties
When processing payments, Stripe may give us limited information about the status of a transaction, needed to manage your subscription (for example a status of "active" or "past due"). We do not receive full payment card details.
4. Legal basis
We process your personal data on the following legal bases under the GDPR:
Processing is necessary to provide the services you requested (Art. 6(1)(b) GDPR).
Compliance with tax, accounting and regulatory requirements (Art. 6(1)(c) GDPR).
Improving the services, platform security and fraud prevention (Art. 6(1)(f) GDPR).
For marketing messages, only with explicit consent (Art. 6(1)(a) GDPR).
5. Purposes of processing
We process your data for the following specific purposes:
- Creating and managing your account and verifying identity
- Providing the features of the Platform
- Processing subscription payments and issuing invoices
- Communicating about your account, changes and important notices
- Technical support and troubleshooting
- Keeping the Platform secure and preventing abuse
- Complying with legal obligations (tax, accounting, regulatory)
- Analysing and improving the services (anonymised statistics only)
- Sending technical and administrative notifications
We do not sell, rent or share your personal data with third parties for marketing purposes.
6. Third parties
Buildinghost uses the following categories of trusted processors, each bound by contractual data protection obligations:
| Partner | Role | Location | Purpose |
|---|---|---|---|
| Supabase, Inc. | Database and authentication infrastructure | EU (Ireland region) | Storage of all Platform data |
| Stripe, Inc. | Payment processor | USA / EU | Processing subscription payments |
Where data is transferred outside the EEA, we rely on the Standard Contractual Clauses approved by the European Commission, or on certification under the EU–US Data Privacy Framework.
7. Supabase — infrastructure
Buildinghost uses Supabase as its primary data storage infrastructure. Supabase is built on PostgreSQL and provides the following security guarantees:
Each company accesses only its own data. Reading another company’s data by accident is technically impossible.
Data is encrypted in transit (TLS/HTTPS) and at rest (AES-256) within Supabase infrastructure.
Passwords are not stored in readable form. bcrypt hashing is used. Supabase Auth manages sessions securely.
Supabase performs automatic daily backups of the database.
For more on Supabase’s privacy practices: supabase.com/privacy
8. Stripe — payments
Buildinghost uses Stripe to process payment transactions. Stripe is certified to PCI DSS Level 1 — the highest level of security in the payment card industry.
Important about payment details
Buildinghost never sees, stores or processes your full payment card details. All card data is entered directly into Stripe’s secure forms and stays solely within their infrastructure.
From Stripe, Buildinghost receives only:
- A token identifying the subscription
- Payment status (successful / failed / past due)
- The last 4 digits of the card (for identification)
- The card expiry date
- The cardholder’s email address (if provided)
For Stripe’s privacy policy: stripe.com/privacy
9. Storage and security
We apply technical and organisational measures to protect personal data against unauthorised access, loss, destruction or disclosure:
TLS encryption
All communications are encrypted with TLS 1.3
HTTPS everywhere
The Platform runs exclusively over HTTPS
Audit log
Every action is written to an audit log
Access control
Role-based permissions (RLS) for every user
Backups
Automatic daily backups
Data isolation
Full isolation between companies at the database level
In the event of a personal data breach, Buildinghost is obliged to notify the Commission for Personal Data Protection (CPDP) within 72 hours, and affected users without undue delay.
10. Retention periods
| Data type | Retention period |
|---|---|
| Account data (active user) | Until the account is closed |
| Data after a subscription ends | 6 months read-only, then permanently deleted |
| Financial documents and invoices | 5 years (statutory requirement) |
| Audit log | 2 years |
| Technical logs | 90 days |
| Payment data (via Stripe) | Per Stripe’s policy |
| Data on an account deleted by request | Up to 30 days (for physical deletion) |
When a subscription ends, access to data already entered continues in read-only form. Throughout that period you can export a full archive or request immediate deletion at any time. If no subscription is activated within 6 months, the account and all associated data are permanently deleted. Activating a subscription stops this period.
11. Your rights
As a data subject you have the following rights, guaranteed by the GDPR:
Right of access (Art. 15)
The right to obtain a copy of the personal data we process about you, and information about how it is processed.
Right to rectification (Art. 16)
The right to ask for inaccurate or incomplete personal data to be corrected.
Right to erasure (Art. 17)
The "right to be forgotten" — you may request deletion of the data in certain circumstances.
Right to restriction (Art. 18)
The right to ask for processing of your data to be restricted in certain cases.
Right to portability (Art. 20)
The right to receive your data in a machine-readable format and transfer it to another controller.
Right to object (Art. 21)
The right to object to processing of your data based on legitimate interests.
Right to withdraw consent
Where data is processed on the basis of consent, the right to withdraw it at any time.
Right to complain to the CPDP
The right to lodge a complaint with the Commission for Personal Data Protection (www.cpdp.bg).
To exercise your rights, please send a request to privacy@buildinghost.eu. We will respond within 30 days.
Commission for Personal Data Protection (CPDP)
If you believe your rights have been infringed, you may lodge a complaint with the CPDP:
Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Website: www.cpdp.bg
13. Minors
The Buildinghost Platform is intended solely for people over 18. We do not knowingly collect personal data from anyone under 18. If we have collected a minor’s data by accident, please tell us immediately at privacy@buildinghost.eu and we will delete it without undue delay.
14. Changes to the policy
We may update this Privacy policy from time to time. For material changes affecting your rights we will notify you by email and/or through a message in the Platform. The date of the last update is shown at the top of the document. We recommend checking this page periodically.
15. Contact and DPO
For any question about the processing of your personal data, or to exercise your rights, you can contact us:
Privacy email
privacy@buildinghost.euWebsite
buildinghost.euYou can also use our contact page.
Supervisory authority in Bulgaria
Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Phone: +359 2 915 3518
www.cpdp.bg