Last updated: 1 October 2026
In short. This service allows an accounting firm to receive and keep its clients’ documents in order.
The documents are not stored by us: they remain in the storage the firm chooses — its own Google Drive account, or dedicated space with a European provider. We process the data needed to run the service.
1. Who processes the data
Simonitto EOOD
EIK 207284384
ul. Serdika 23, 1202 Sofia, Bulgaria
privacy@pliko.bg
For requests concerning personal data you may write to that address. We reply within one month, as required by the Regulation.
2. Two different relationships, and why the distinction matters
The service has two kinds of user, and our role changes.
Towards the accounting firm
The firm is our client. We process its data as controller: we decide which data are needed and why.
Towards the firm’s clients
The companies that upload documents to the portal have no relationship with us. Their controller is the firm, and we are the processor — we process those data only on the firm’s behalf and according to its instructions.
This means that if you are a client of a firm and wish to exercise a right over your data, the request goes to the firm. If it reaches us, we forward it and tell you we have done so.
The relationship is governed by a separate agreement, which every firm signs before using the service.
3. Which data we process
Of the accounting firm
| Data | Why |
|---|---|
| Owner’s first and last name | to identify who manages the account |
| access to the service, service communications | |
| Company name, EIK, VAT number, address, MOL | issuing invoices |
| Preferred language | showing the interface in the right language |
| Access and operation logs | security, diagnosing malfunctions |
Of the firm’s clients, on the firm’s behalf
| Data | Why |
|---|---|
| Company name, EIK, VAT number | identifying the company in the portal |
| Contact’s first name, last name, email | access to the portal |
| Address, telephone | registry data managed by the firm |
| Uploaded documents | this is the purpose of the service |
| Upload date and author | showing the firm what has arrived |
Of the clients’ employees, on the firm’s behalf
If the firm uses the payroll module, the system also processes:
- first name, last name, ЕГН (Bulgarian personal number), date of birth
- date of hire, contractual data
- salaries
These are the most sensitive data passing through the system. Only the firm and the operators it has granted access to can see them; we do not consult them.
Technical data
IP address, browser type, date and time of access. They serve to protect the service from unauthorised access and to understand what happened when something fails.
4. Where the documents are
It is the question everyone asks, and the answer depends on what the firm has chosen.
The firm’s Google Drive
The files are in the firm’s Google account. They use its own space, it opens them from drive.google.com without going through our service, and it can revoke our access at any time from its Google account settings.
In this case we keep no copies of the documents.
Storage with a European provider
The firm receives dedicated space with Exoscale, in a data centre of its choosing: Sofia, Geneva, Zurich, Frankfurt, Vienna or Zagreb.
The space is separate from that of every other firm, with credentials valid only for its own — the isolation is enforced by the provider, not by our code. Documents do not leave the chosen country.
The firm’s own storage
A firm may connect its own S3 storage. In that case the documents are wherever it decides, and we have no access beyond what its credentials allow.
5. Who else processes the data
To run the service we rely on third-party providers. Each processes only the data it needs, and none may use them for its own purposes.
| Provider | What it does | Where |
|---|---|---|
| Exoscale | document storage, when chosen | Switzerland, Germany, Austria, Bulgaria, Croatia |
| document storage, when chosen | according to the terms of the firm’s account | |
| ionos.it | service servers | Germania |
| ionos.it | sending communications | Germania |
| Stripe | collecting subscription payments | Ireland / United States |
With Google and with Stripe, the basis for transfer to third countries is the standard contractual clauses approved by the European Commission.
We do not sell data to anyone, and we do not use them for advertising. The service contains no advertising.
6. On what legal basis
Performance of the contract — the data of the firm and its users serve to provide the service it has purchased.
Legal obligation — invoicing data must be kept for as long as Bulgarian law requires.
Legitimate interest — access logs serve to protect the service. We consider this interest to prevail because it concerns the security of everyone’s documents.
On behalf of the controller — the data of the firm’s clients and their employees are processed on the firm’s instruction, not by our decision.
7. For how long
| Data | Retention |
|---|---|
| Account data | as long as the service is active |
| Documents | as long as the firm keeps them in its own storage |
| Invoicing data | 10 years, as required by Bulgarian legislation |
| Access logs | 12 months |
| Prepared exports | 7 days, then deleted automatically |
On termination of the service, the firm has 30 days to export everything. After that, we delete the data we are not required by law to keep.
8. What you can ask for
The Regulation grants you the right to:
- know which of your data we process and obtain a copy
- correct inaccurate data
- erase the data, where we have no obligation to keep them
- restrict processing while a dispute is open
- take away the data in a format readable by another system
- object to processing based on our legitimate interest
On the right to portability one thing is worth saying: you do not need to ask us. The service has an export function available at any time, which produces the documents in their folder structure and everything else in spreadsheets.
If you believe we process your data improperly, you may address the Bulgarian data protection authority — Комисия за защита на личните данни (cpdp.bg) — or the authority of the country where you reside.
9. Security
What we do, concretely:
- connections are encrypted (HTTPS)
- storage access credentials are encrypted before being saved, and are never shown again
- each firm has separate space: one firm’s credentials do not open another’s storage
- access to documents requires authentication on every request, and temporary links expire
- those who work in the firm see only the clients the firm has assigned to them
No measure makes a system impenetrable. Should unauthorised access occur, we inform the authority within 72 hours and the data subjects when the risk requires it.
10. Cookies
The service uses cookies strictly necessary to make it work: keeping the session after sign-in and protecting forms from fraudulent submissions. We do not use profiling or advertising cookies.
Details are on the dedicated cookie page.
11. Minors
The service is intended for professionals and businesses. It is not directed at minors and does not knowingly collect their data.
12. Changes
If we change this policy substantially, we notify active firms by email at least 30 days before the changes take effect. The date at the top indicates the last update.