Privacy Policy

1. Who We Are

This website (home-villa.com) is operated by:

Dee & Lee Limited is the data controller for all personal data collected through this website. We are registered in England and Wales and subject to UK GDPR and the UK Data Protection Act 2018.

Where our services are accessed by users in the European Economic Area (EEA), EU GDPR also applies. Our practices comply with both frameworks.

2. What Personal Data We Collect and Why

We collect personal data only when you actively provide it. We do not collect data through passive tracking beyond standard analytics described below.

2a. Email signup and free guide

When you sign up for our free guide at home-villa.com/free-guide, we collect:

• First name
• Email address
• Consent record (date and time of consent)

Legal basis: Consent (UK GDPR Article 6(1)(a)). You explicitly tick a box to agree. You can withdraw consent at any time.

Purpose: To deliver the free guide and send relevant Bulgaria property updates you have requested.

2b. Village Finder Report and Situation Guide

When you use our personalised tools (the Bulgaria Situation Guide and Village Finder Report), we collect:

• First name and email address
• Nationality
• Situation type (e.g. retired, remote worker)
• Budget range
• Region preference
• Priorities (selected from a list)
• Free-text description of your situation — no character limit, you control what you share
• The AI-generated response provided to you
• Consent record

Legal basis: Consent (UK GDPR Article 6(1)(a)) — you tick a consent checkbox before submitting.

Purpose: To generate and deliver your personalised report and to retain context for any future consultation you may request. The free-text field and AI response are retained so that if you book a 1:1 consultation, we already have your situation on file and can prepare properly. You are informed of this at the point of data collection.

Special note on free-text: You choose what you write in the free-text field. We recommend you share only what is relevant to your Bulgaria property situation. Do not share financial account details, government ID numbers, or sensitive personal information beyond what is needed for your report.

2c. Contact form

When you submit our contact form, we collect your name, email and message.

Legal basis: Legitimate interests (UK GDPR Article 6(1)(f)) — responding to enquiries you initiate.

2d. Analytics

We use Google Analytics 4 to understand how visitors use our site. This collects anonymised, aggregated data including pages visited, approximate location (country/region level), device type and time on site. It does not identify you personally.

Legal basis: Legitimate interests. Google Analytics data is anonymised and used solely to improve site content.

You can opt out of Google Analytics tracking using the Google Analytics Opt-out Browser Add-on.

3. How We Use Your Data

4. Who We Share Your Data With

We never sell, rent or share your personal data with third parties for their own marketing purposes.

We use the following data processors who handle data on our behalf:

Important note on AI processing: When you submit text to our Situation Guide or Village Finder, your text is processed by an AI language model to generate a personalised response. Our AI provider does not retain API inputs for model training purposes. The response is then stored securely in our database under your record. Do not submit sensitive financial, medical or government ID information through the free-text field.

5. Data Security

We take the security of your personal data seriously and implement the following measures:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (HTTPS).
• Encryption at rest: Personal data is encrypted at rest using AES-256 encryption.
• Access controls: Our database uses row-level security. Only authorised personnel can access personal data.
• API security: Third-party service credentials are stored as server-side environment variables and are never exposed in client-side code or public repositories.
• No payment data stored: We never handle or store card numbers or payment account details. All payments are processed directly by our payment processor and never pass through our systems.
• One-report-per-email check: We store email addresses in a separate report_usage table to prevent abuse, processed under legitimate interests.
• Staff access: Personal data is accessible only to the data controller (Dee & Lee Limited) and is not shared with employees or contractors.

Despite our security measures, no internet transmission is completely secure. If you have reason to believe your data has been compromised, please contact us immediately at maldoracreative@gmail.com.

Data breach procedure: In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay, as required under UK GDPR Article 33.

6. Your Rights Under UK GDPR

As a data subject, you have the following rights. To exercise any of them, email us at maldoracreative@gmail.com with the subject line "Data Rights Request".

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) — the UK supervisory authority — at ico.org.uk or by calling 0303 123 1113. EEA residents may contact their local data protection authority.

7. Cookies

We use a small number of cookies. See our Cookie Policy for full details. In summary:

• Essential cookies: Required for the site to function. No consent required.
• Analytics cookies: Google Analytics 4. You can opt out using the GA Opt-out Add-on.
• We do not use advertising, retargeting or social media tracking cookies.

8. AI Processing Disclosure

In compliance with the EU AI Act (effective 1 August 2026) and UK AI governance guidance, we disclose the following about our use of AI:

• Our Bulgaria Situation Guide and Village Finder Report use an AI language model to generate personalised responses.
• The AI processes the text you submit and generates a response. It does not make automated decisions that have legal or similarly significant effects on you.
• The AI responses are informational only — not legal, financial, property or immigration advice.
• All AI output is based on information the author has verified and provided in the system instructions. The author reviews and updates this information periodically.
• Some editorial content on this website was created with AI assistance and reviewed and approved by the human author.
• If you have questions about our AI use, contact us at maldoracreative@gmail.com.

9. International Data Transfers

Some of our data processors are based outside the UK and EEA (notably in the USA). Where data is transferred internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) — approved by the European Commission for transfers to third countries.
• EU-US Data Privacy Framework — for processors certified under this framework.
• UK International Data Transfer Agreement (IDTA) — the UK equivalent for post-Brexit transfers.

10. Children's Privacy

This website is intended for adults. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has submitted data to us, please contact us at maldoracreative@gmail.com and we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of the website after changes constitutes acceptance of the updated policy.

12. Contact Us

This policy was last reviewed and updated on 31 August 2026. It covers all data processing activities on home-villa.com as operated by Dee & Lee Limited.