Legal information
Privacy policy
Last updated: 10.11.2026
1. Data controller
The controller of personal data collected through this website is:
Business name: New Key Properties
Email: office@newkey.bg
Phone: 0879 826 292
Address: Sofia, Bulgaria
2. What personal data we collect
When you send an inquiry through the contact form on our website, we collect the following personal data:
- Full name - Needed to identify you when we respond
- Phone number - So we can contact you about your inquiry
- Email (optional) - For email correspondence if you prefer it
- Message / description of the property you are looking for - To understand your needs and offer suitable options
In addition to the data above, the website may automatically collect technical data such as IP address and browser type via our hosting provider (Vercel), solely to ensure technical functionality and security.
3. Purpose and legal basis for processing
Your personal data is processed for the following purposes:
Responding to your inquiry
We process your data to respond to your inquiry about buying, renting, or selling a property. The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
Providing property consulting
Data is used to prepare and provide personalized real estate consulting. The legal basis is performance of a contract or taking steps prior to entering into one (Art. 6(1)(b) GDPR).
Legitimate interest
In certain cases we may process data based on legitimate interest (Art. 6(1)(f) GDPR), to maintain the quality of the services we provide.
4. Retention period
Personal data submitted through the contact form is retained only for as long as necessary to process your inquiry. If no contract is concluded between us, the data is deleted no later than 6 months after the last contact. If a contract is concluded, data is retained for the period required by applicable accounting and commercial legislation.
5. Recipients of personal data
We do not sell, rent, or share your personal data with third parties for marketing purposes. Data may only be shared with:
- Resend Inc. - an email service provider used to forward inquiries to us. Resend is certified to data protection standards.
- Vercel Inc. - the hosting provider supporting the website’s infrastructure.
- HubSpot - the customer relationship management (CRM) system where we store inquiries in order to handle them.
- Make.com - an automation platform that passes inquiries from the website forms into HubSpot.
- Meta and Google - only if you have accepted cookies: information that an inquiry was sent, so we can measure how well our ads perform (see section 7).
- Competent public authorities - where required by law.
6. Your rights
Under Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act, you have the following rights:
Right of access
To obtain information about what data we process about you.
Right to rectification
To request correction of inaccurate data.
Right to erasure
To request deletion of your data ("right to be forgotten").
Right to restriction
To request restriction of processing under certain circumstances.
Right to data portability
To receive your data in a structured, machine-readable format.
Right to object
To object to processing based on legitimate interest.
To exercise your rights, please contact us at office@newkey.bg. You also have the right to file a complaint with the Commission for Personal Data Protection (CPDP), Sofia, 2 Prof. Tsvetan Lazarov Blvd., www.cpdp.bg.
7. Cookies and measurement tools
The website uses technical cookies needed for it to work - for example, to remember your choice in the cookie banner and for logging in to admin sections. We also use Vercel Web Analytics, which collects aggregate visit statistics without cookies and without identifying individual visitors. The advertising and analytics tools below load only if you click "Accept" in the cookie banner (Art. 6(1)(a) GDPR - consent). If you click "Decline", they are not loaded. The exception is the Google Ads tag, which loads on every visit in so-called "consent mode" (Google Consent Mode): until you click "Accept", it sets no cookies and sends no information about inquiries or calls - Google receives only anonymous technical signals without cookies (for example, that a page was opened), which it uses for aggregate statistical estimates. You can withdraw your consent at any time by deleting the cookies for newkey.bg in your browser settings - the banner will then appear again. With your consent we use:
- Meta Pixel and Meta Conversions API (Meta) - to measure how well our ads on Facebook and Instagram perform. When you send a form, your email and phone number are sent to Meta in encrypted (hashed) form, together with your IP address.
- Google Ads (Google) - to measure how many visitors from our Google ads send us an inquiry or call us.
- HubSpot - to analyse website visits and link them to the inquiries sent.
8. Changes to this policy
We reserve the right to update this policy in the event of changes in legislation or in how we operate. The current version is always available on this page. The date of the last update is shown at the top of the document.
Questions about privacy?
If you have questions about how we handle your personal data, feel free to reach out: