Privacy Policy

The Data Controller of your personal data is House Cash Flows LTD, registered office in Bulgaria, Sofia, Stolichna, ZIP Code 1797, road Malinova Dolina, bl. 29, ent. 5, fl. 8, ap. 49 · VAT BG207751044. For any communication about your data write to Legal@housecashflows.com.

We collect: (a) data you voluntarily provide via our forms (first name, last name, email, phone, investment preferences, resort of interest); (b) technical data generated by your device (IP address, browser type, user-agent, pages visited, referrer); (c) cookies and identifiers (non-essential ones only with your consent).

We use your data to: (a) respond to your requests and provide our services (contract performance under Art. 6.1.b GDPR); (b) send you marketing communications and newsletters (only with your explicit consent, Art. 6.1.a); (c) aggregated statistical analytics on the site (legitimate interest, Art. 6.1.f); (d) comply with legal obligations (Art. 6.1.c).

We do not sell your data. We share it exclusively with essential technical vendors acting as Data Processors (Art. 28 GDPR): Resend (transactional email and newsletters, US-based, SCCs in place); Vimeo (video streaming); Meta and Google (only if you consented to marketing cookies); Emergent (hosting). Full list available on request.

Some of our vendors (Resend, Meta, Google) host data on US servers. Transfers are covered by the European Commission's Standard Contractual Clauses (Decision 2021/914/EU) and, where applicable, by the Data Privacy Framework.

We retain your data only as long as strictly necessary: (a) active commercial data: for the duration of the contractual relationship + 10 years for tax obligations; (b) marketing contacts: until consent withdrawal; (c) technical logs: 24 months; (d) trashed data: 30 days then final automatic deletion; (e) consent audit trail: 24 months.

At any time you can exercise your rights of: access (Art. 15), rectification (Art. 16), erasure/right to be forgotten (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), consent withdrawal (Art. 7.3). Use the dedicated form or write to Legal@housecashflows.com. We reply within 30 days. If you believe your rights have been violated you can lodge a complaint with the supervisory authority (Garante Privacy in Italy, AEPD in Spain, CPDP in Bulgaria, ICO in UK).

We implement appropriate technical and organizational measures (Art. 32 GDPR): bcrypt-hashed passwords, HTTPS encryption, JWT tokenization, role-based access control, encrypted backups and audit logs.

Our services are not directed to minors under 16. If we discover that we have collected data from a minor without parental consent, we will promptly delete it.

We may update this policy periodically. The current version and last modification date are always shown at the top of the page. Material changes will be communicated via email.