Privacy Policy

Scope:

Last updated: August 12, 2026

This Privacy Policy explains how BALKAN App collects, uses, stores, shares, and otherwise processes personal data in connection with the BALKAN OrgChart App and related websites, applications, features, and services (collectively, the "Service").

In this Privacy Policy, "BALKAN App", "we", "us", and "our" refer to the provider and operator of the Service, as identified in our Legal Notice.

We take the protection of personal data seriously and process personal data in accordance with applicable data protection laws, including the General Data Protection Regulation ("GDPR") where applicable.

1. Our Role

BALKAN App may process personal data in different capacities depending on the circumstances.

When we process information relating to your BALKAN App account, your use of our website, communications with us, security, or the operation and administration of the Service, BALKAN App generally determines the purposes and means of that processing and acts as a data controller.

When a business or organization using the Service (a "Customer") submits or otherwise processes personal data through the Service as part of its Content Data, BALKAN App generally processes that personal data on behalf of and under the instructions of the Customer. In those circumstances, the Customer acts as the data controller and BALKAN App acts as a data processor, unless otherwise required by Applicable Law.

Where BALKAN App acts as a processor, the processing of personal data is also governed, where applicable, by a Data Processing Agreement between BALKAN App and the Customer.

2. Personal Data We Collect

Depending on how you use the Service, we may collect the following categories of personal data:

Category Examples How it is collected
Account and Identification Data Name, email address, profile or avatar information provided by an authentication provider, account identifiers, and related account information. Provided by you when creating or using an account or received from an authentication provider that you choose to use.
Technical and Usage Data IP address, device and browser information, timestamps, logs, authentication events, and information about interaction with the Service. Collected automatically when you access or use the Service.
Communication Data Information contained in support requests, emails, feedback, and other communications with BALKAN App. Provided by you when you communicate with us.
Content Data Information, records, organizational information, names, positions, photographs, contact information, and other data submitted, entered, uploaded, imported, or otherwise made available through the Service by or on behalf of a Customer. Submitted to or generated through the Service by Customers and their authorized users.

BALKAN App does not need or intend to collect more personal data than is reasonably necessary to provide and operate the Service. Customers are responsible for determining what Content Data they submit to the Service and for ensuring that they have an appropriate legal basis for doing so.

3. Customer Content Data

"Content Data" means information, content, records, files, and other data submitted, entered, uploaded, imported, or otherwise made available to the Service by a Customer, its authorized users, or on its behalf.

BALKAN App processes personal data contained in Content Data primarily on behalf of and according to the instructions of the applicable Customer. BALKAN App generally does not determine why a Customer collects personal data about its employees, contractors, organizational members, or other individuals.

If your personal data appears in Content Data maintained by one of our Customers and you wish to access, correct, restrict, object to, or request deletion of that personal data, you should normally contact the applicable Customer directly. The Customer is responsible for responding to such requests where it acts as the data controller.

Where required by Applicable Law or an applicable Data Processing Agreement, BALKAN App will reasonably assist the Customer in responding to data subject requests.

4. How We Use Personal Data

Depending on the type of personal data and the context in which it is processed, BALKAN App may use personal data to:

  • create, authenticate, administer, and secure user accounts;
  • provide, operate, maintain, and support the Service;
  • enable functionality requested by Customers and authorized users;
  • respond to questions, support requests, and other communications;
  • detect, investigate, prevent, and address fraud, abuse, security incidents, and technical problems;
  • monitor and improve the performance, reliability, usability, and security of the Service;
  • understand how the Service is used and develop or improve its features;
  • send important administrative, account, security, and service-related communications;
  • send marketing communications where permitted by Applicable Law;
  • establish, exercise, or defend legal claims;
  • comply with legal obligations and lawful requests from competent authorities; and
  • carry out corporate transactions such as a merger, acquisition, restructuring, or sale of assets.

5. Legal Bases for Processing

Where the GDPR or another law requiring a legal basis applies and BALKAN App acts as a controller, we process personal data only where an appropriate legal basis exists. Depending on the circumstances, these legal bases may include:

  • Performance of a contract: where processing is necessary to provide the Service or take steps requested by you in connection with the Service.
  • Legitimate interests: where processing is necessary for our legitimate interests, such as securing, maintaining, administering, and improving the Service, preventing abuse, communicating with users, and protecting our legal rights, provided that those interests are not overridden by your rights and interests.
  • Legal obligations: where processing is necessary to comply with Applicable Law or a legally binding request.
  • Consent: where we ask for and rely upon your consent for a particular processing activity. Where processing is based on consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Where BALKAN App acts as a processor of Content Data, the Customer is generally responsible for determining the applicable legal basis for processing that personal data.

6. How We Share Personal Data

BALKAN App does not sell personal data.

We may disclose or make personal data available to third parties where reasonably necessary for the purposes described in this Privacy Policy, including:

  • service providers and subprocessors that provide hosting, authentication, infrastructure, communications, security, analytics, support, or other services used to operate the Service;
  • professional advisers, such as legal or accounting advisers, where reasonably necessary;
  • competent governmental, regulatory, judicial, or law enforcement authorities where disclosure is required or permitted by Applicable Law;
  • parties involved in investigating or preventing fraud, abuse, security incidents, unlawful activity, or violations of our Terms of Service; and
  • an acquiring or successor entity in connection with a merger, acquisition, restructuring, financing, sale of assets, or similar corporate transaction.

Where permitted by Applicable Law, we will take reasonable steps to notify an affected Customer of a legally compelled disclosure of Customer Content Data unless we are prohibited from doing so.

7. Service Providers and Subprocessors

BALKAN App uses third-party providers to help operate and provide the Service. These providers may process personal data on our behalf to the extent necessary to provide their services.

Providers used in connection with the Service may include:

  • Microsoft Azure for cloud infrastructure, hosting, and related services; and
  • Google Firebase Authentication for authentication-related functionality.

BALKAN App may add, replace, or remove service providers as the Service evolves. Where required by Applicable Law or an applicable Data Processing Agreement, BALKAN App will impose appropriate data protection obligations on its processors and subprocessors.

8. International Data Transfers

BALKAN App seeks to use infrastructure located in the European Economic Area ("EEA") where appropriate. However, some service providers or their affiliates may process personal data from locations outside the EEA.

Where personal data is transferred outside the EEA or another jurisdiction that restricts international transfers, BALKAN App will use an appropriate transfer mechanism where required by Applicable Law, such as an adequacy decision, Standard Contractual Clauses, or another legally recognized safeguard.

9. Data Retention

BALKAN App retains personal data only for as long as reasonably necessary for the purposes for which it was collected or processed, including to provide and secure the Service, comply with legal obligations, resolve disputes, and establish, exercise, or defend legal claims.

The applicable retention period depends on factors including the nature of the personal data, the purpose for which it is processed, account status, security requirements, contractual obligations, and applicable legal requirements.

BALKAN App may terminate accounts that have been inactive for a continuous period of one (1) year, as described in the Terms of Service.

Following account termination, Content Data may be deleted in accordance with the Terms of Service, Applicable Law, applicable retention requirements, and any applicable Data Processing Agreement. Some information may remain temporarily in backups or security systems until it is deleted or overwritten in accordance with our normal retention processes.

10. Security

BALKAN App maintains reasonable administrative, technical, and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

No method of transmission over the Internet or method of electronic storage is completely secure. Accordingly, BALKAN App cannot guarantee absolute security.

You are responsible for maintaining the confidentiality and security of your account credentials, devices, systems, and access to the Service. You should not share your account credentials with unauthorized persons.

If you become aware of suspicious or unauthorized activity involving your BALKAN App account, please contact us promptly.

11. Sharing and Public Access to Content Data

The Service may include functionality that allows Customers or authorized users to share, publish, or otherwise make Content Data accessible to other persons, including through a shareable or publicly accessible link.

Content Data made available through a public or shareable link may be accessible to anyone who obtains that link and, depending on the applicable sharing settings, may not require authentication to view.

Customers are responsible for determining whether to use sharing or publishing functionality, selecting appropriate access settings, deciding what personal data is included in shared Content Data, and ensuring that they have an appropriate legal basis for making such personal data available.

You should not make Content Data publicly accessible if it contains information that should remain confidential or that you are not authorized to disclose.

12. Your Data Protection Rights

Depending on your location, the circumstances, and Applicable Law, you may have rights regarding your personal data, including:

  • the right to obtain information about and access to your personal data;
  • the right to request correction of inaccurate or incomplete personal data;
  • the right to request deletion of personal data in certain circumstances;
  • the right to request restriction of processing in certain circumstances;
  • the right to object to certain processing based on legitimate interests;
  • the right to object to processing for direct marketing purposes;
  • the right to data portability where the applicable legal requirements are satisfied;
  • the right to withdraw consent where processing is based on consent; and
  • the right to lodge a complaint with a competent supervisory authority.

These rights are not absolute and may be subject to conditions, limitations, or exceptions under Applicable Law.

13. How to Exercise Your Rights

If BALKAN App acts as the controller of your personal data, you may submit a privacy request using the contact information provided below.

We may need to request information reasonably necessary to verify your identity and determine the personal data to which your request relates before acting on a request.

If your request concerns personal data contained in Content Data controlled by a BALKAN App Customer, you should normally submit your request directly to that Customer. Where BALKAN App acts as a processor, we will assist the Customer as required by Applicable Law and any applicable Data Processing Agreement.

14. Marketing Communications

Where permitted by Applicable Law, BALKAN App may send you information about BALKAN App products, services, or features that may be relevant to you.

You may opt out of marketing communications at any time by using the unsubscribe mechanism provided in the applicable communication or by using our unsubscribe page.

Opting out of marketing communications does not prevent BALKAN App from sending you non-marketing communications that are reasonably necessary for the administration, operation, security, or support of your account or the Service.

15. Cookies and Similar Technologies

BALKAN App may use cookies and similar technologies to operate and secure the Service, maintain sessions and preferences, understand use of our websites and Service, measure performance, and, where applicable and permitted, support analytics or advertising.

Some cookies are necessary for the operation and security of the Service. Other cookies or similar technologies, including certain analytics or advertising technologies, will be used only where permitted by Applicable Law and, where required, subject to your consent.

Where applicable, you can manage non-essential cookies through the cookie preferences or consent controls made available on our website.

Third-party analytics or advertising services may process information in accordance with their own privacy policies. The specific technologies used may change as our website and marketing practices evolve.

16. Third-Party Services

The Service may contain links to or integrate with third-party websites, applications, APIs, or services. BALKAN App does not control the privacy practices of independent third parties.

Where you choose to use or interact with a third-party service, that third party's privacy policy and terms may apply to its processing of your personal data.

17. Automated Decision-Making

BALKAN App does not use personal data processed as a controller to make decisions based solely on automated processing that produce legal effects or similarly significantly affect individuals, unless otherwise disclosed to you or permitted by Applicable Law.

18. Updates to this Privacy Policy

BALKAN App may update this Privacy Policy from time to time to reflect changes to the Service, our data processing practices, or Applicable Law.

If we make material changes, we will provide reasonable notice where appropriate, for example by posting a notice on our website or sending a notification to the primary email address associated with your BALKAN App account.

The "Last updated" date at the top of this Privacy Policy indicates when this Privacy Policy was most recently revised.

19. Contact and Legal Information

In this Privacy Policy, BALKAN App is the trade name used in connection with the Service. Information identifying the provider and operator of the Service is available in our Legal Notice.

For questions regarding this Privacy Policy or to submit a request concerning personal data for which BALKAN App acts as controller, you may contact us at:

Email: legal@balkan.app

Website: https://balkan.app/OrgChartApp

Address: Drugba 284, Sofia 1582, Bulgaria

Phone: +359 878 108 254

20. Right to Lodge a Complaint with a Supervisory Authority

If the GDPR applies to the processing of your personal data, you have the right to lodge a complaint with a competent data protection supervisory authority.

In Bulgaria, the competent supervisory authority is the Commission for Personal Data Protection (CPDP):

Email: kzld@cpdp.bg

Website: https://www.cpdp.bg/en/

Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria

Phone: +359 2 915 3519

You may also have the right to lodge a complaint with another competent supervisory authority, including the supervisory authority in the EU or EEA country of your habitual residence, place of work, or place of the alleged infringement, where applicable.

In this article