PRIVACY POLICY OF THE MAGI PLATFORM
Last updated: 17.06.2026
Version: 1.0
1. WHO WE ARE
Magi MD EOOD, UIC [208824470], with registered office and management address: Ruse, ul. Tsar Shisman 3 ('Magi', 'we', 'us'), is a personal data controller within the meaning of Regulation (EU) 2016/679 (GDPR) with regard to the data of its users.
For contact regarding personal data issues:
Email: [email protected]
Address: Ruse, ul. Tsar Shisman 3
2. WHAT DATA WE COLLECT AND WHY
2.1. Data upon registration
| Data | Purpose | Legal basis |
|---|---|---|
| User’s full names | Identification and communication | Performance of a contract |
| Email address | Account access, notifications | Performance of a contract |
| Name of the organization | Linking the account to the law firm | Performance of a contract |
| UIC of the organization | Invoicing and verification | Legal obligation |
2.2. Data upon payment
Payments are processed entirely by Stripe, Inc. Magi does not store any bank card data. We only receive confirmation of the transaction and an identifier from Stripe.
For information on how Stripe processes data: stripe.com/privacy
2.3. Data while using the platform
| Data | Purpose | Legal basis |
|---|---|---|
| Uploaded accounting files | Generation of SAF-T | Performance of a contract |
| Configured code mappings | Saving of settings | Performance of a contract |
| Generated SAF-T files | Access to history | Performance of a contract |
| Activity logs | Security and diagnostics | Legitimate interest |
| IP address and browser | Account security | Legitimate interest |
2.4. Data in uploaded files
The accounting files uploaded by the User may contain personal data of third parties - employees, counterparties, natural persons. In such cases, Magi acts as a data processor, not as a controller. These relationships are governed by the Data Processing Agreement ('DPA').
2.5. AI-assisted code mapping
The platform offers AI-assisted suggestions for mapping the User's internal accounting codes (accounts, tax codes, document types, units of measure, products) to the official SAF-T nomenclature. For this purpose, Magi sends only short text descriptions of these codes - e.g. an account name, a tax code description, a product description - to the AI providers listed in Section 5. Magi does not send full accounting records, transaction amounts, uploaded files themselves, or personal data of counterparties (names, Bulgarian Personal ID Number, IBAN, addresses) to these providers.
2.6. Cookies
Information about the cookies we use is available in our separate Cookie Policy.
3. HOW WE STORE THE DATA
3.1. Data is stored on servers hosted by Hetzner Online GmbH, located in Germany, EU.
3.2. We apply the following technical security measures:
- Encryption of data in transit (TLS/HTTPS)
- Encryption of data at rest
- Restricted access to data only by authorized personnel
- Regular backups
3.3. In the event of a suspected security breach, Magi undertakes to notify the affected users and the CPDP within 72 hours of its discovery.
4. HOW LONG WE KEEP THE DATA
| Data category | Retention period |
|---|---|
| Account data | Until termination + 30 days |
| Uploaded accounting files | Until termination + 30 days |
| Generated SAF-T files | Until termination + 30 days |
| Payment and invoice data | 5 years (legal obligation) |
| Security logs | 12 months |
| Cookies | In accordance with the Cookie Policy |
4.1. Upon expiry of the retention period, the data is irreversibly deleted or anonymized.
4.2. The user may request early deletion of their data - see section 6.
5. DO WE SHARE DATA WITH THIRD PARTIES
Magi does not sell or disclose personal data to third parties for marketing purposes.
Data may be shared only with:
| Recipient | Purpose | Country |
|---|---|---|
| Stripe, Inc. | Payment processing | USA (with appropriate safeguards) |
| Hetzner Online GmbH | Hosting of the platform | Germany (EU) |
| Brevo (Sendinblue) | Transactional emails | France (EU) |
| Anthropic PBC (Claude AI) | AI-assisted code mapping suggestions (Section 2.5) | USA (with appropriate safeguards) |
| Voyage AI, Inc. | Semantic search for product classification (Section 2.5) | USA (with appropriate safeguards) |
5.1. When transferring data outside the EU, Magi ensures the existence of appropriate protection mechanisms in accordance with the GDPR (standard contractual clauses or adequacy decision).
5.2. Data may be disclosed to competent authorities only when there is a legal obligation.
6. YOUR RIGHTS
Under the GDPR, you have the following rights regarding your personal data:
| Right | What it means |
|---|---|
| Right of access | To receive a copy of the data we process about you |
| Right to rectification | To correct inaccurate or incomplete data |
| Right to erasure | To request the deletion of your data (“right to be forgotten”) |
| Right to restriction | To restrict processing in certain cases |
| Right to data portability | To receive your data in a machine-readable format |
| Right to object | To object to processing based on legitimate interest |
| Right to withdraw consent | Where processing is based on consent |
6.1. Requests should be sent to: [email protected]
6.2. We respond within 30 days from receipt of the request.
6.3. If you believe your rights have been violated, you have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP):
- Website: kzld.bg
- Address: Sofia, 2 Prof. Tsvetan Lazarov Blvd.
- Email: [email protected]
7. CHILDREN
The Magi platform is intended exclusively for professional use by adults. We do not knowingly collect personal data of persons under 18 years of age.
8. CHANGES TO THE POLICY
8.1. Magi may update this Policy in the event of changes in legislation or in the way data is processed.
8.2. In case of material changes, we will notify users by email at least 30 days before they take effect.
8.3. The current version of the Policy is always available at [URL to Privacy Policy].
9. CONTACT US
For all questions related to the processing of personal data:
- Email: [email protected]
- Address: Ruse, ul. Tsar Shisman 3
- Working hours: Monday – Friday, 09:00 – 18:00 EET