Privacy notice
How Unicorn-EOOD handles information about website visitors, enquiries, bookings and invoice portal users.
Version: 9 October 2026
Who is responsible?
Unicorn-EOOD, Raiko Daskalov 78, 4000 Plovdiv, Bulgaria. EIK/UIC: 206728555. VAT number: BG206728555. Telephone: +359 884 223 438. Email: unicorn-eood@proton.me. Unicorn-EOOD is the controller for enquiries and bookings through this website. Supplier and processing arrangements must be reviewed before public launch.
What information do we process?
For an enquiry, we process your name, email address, optional phone number and company name, selected service and the information you enter in the questionnaire or message. For bookings, this also includes the date, time, meeting format, language and booking status. The application uses a protected, hashed technical identifier to limit abuse. The hosting provider also processes technical request information. Do not submit identity numbers, identity documents, health information, passwords or complete financial files.
Client and employee portal
The portal processes your platform user ID, email address, supplied name and assigned role. It also stores company and contact details, invoices and quotes, payment records, PDF attachments, invoice requests, messages, read status and an activity log. This supports agreed administration and communication. Clients see only their assigned account and published documents; authorised staff see all accounts. Only the owner may assign or revoke roles. Records are held in the server database (D1); PDF attachments are stored in file storage (R2). The portal does not save invoice data in browser storage. Automatic email notifications are not configured. The marketing retention periods of 90 and 180 days do not apply to portal records; Unicorn must separately document and operate retention for the engagement, any applicable legal duties and deletion requests.
Purposes and legal bases
We use enquiry and booking information to contact you at your request, arrange an introduction and prepare a possible engagement. Where you would personally be the contracting party, the basis is taking steps at your request before entering a contract (GDPR Article 6(1)(b)). For business contacts acting on behalf of an organisation, the basis is our legitimate interest in handling business enquiries and appointments (Article 6(1)(f)). Abuse prevention and access protection rely on our legitimate interest in providing a secure service. Optional display preference storage is used only after your choice. A privacy acknowledgement is not marketing consent.
Recipients and service providers
The management dashboard restricts access to enquiries and bookings to the authorised site owner. The website uses Cloudflare hosting and Supabase for account sign-in and a D1 database. If you use email, the email services involved also process the message. No advertising pixels, newsletter subscription, external calendar synchronisation or automatic email service have been added. Separate arrangements on roles, processors and document delivery are required for formal client administration.
Locations and international transfers
Bulgaria and the Netherlands are within the EU. This does not automatically mean all technical suppliers process data exclusively within the EEA. Exclusive EEA storage has not been established for this website. Before public launch, the responsible business must verify actual processing locations, processor arrangements and any transfer mechanisms, and complete this notice accordingly. Transfers outside the EEA require an applicable adequacy decision or appropriate safeguards where required by the GDPR.
Retention in this website
The application deletes enquiries more than 90 days old and bookings whose appointment time was more than 180 days ago at the next processing or management action. This is not a separate daily scheduled task. Technical abuse-prevention keys expire after 24 hours and are removed by the same cleanup. Information required for an agreed engagement or legal obligation may move to a separate client file with a separate retention policy. Email messages, exports, provider logs and backups are not deleted by this application cleanup and must be managed separately by the responsible business.
Your rights and contact
Depending on the circumstances, you may request access, a copy, correction, deletion, restriction, portability or object to processing. Where processing relies on consent, you may withdraw that consent without affecting earlier lawful processing. Email your request to unicorn-eood@proton.me. Appropriate identity verification may be requested, without routinely requiring a complete identity document. Rights requests should generally receive a response within one month; any permitted extension must be explained.
Complaints and automated decisions
You may complain to the competent supervisory authority, including the Bulgarian Commission for Personal Data Protection (CPDP), or the authority where you live or work, such as the Dutch Autoriteit Persoonsgegevens. The website does not make profiling-based decisions producing legal effects. Time slots are checked technically for availability; contact us if you have a question about this.