Privacy & Cookie Policy

1. Who we are

Sovereignty Global (“we”, “us”, “our”) provides residency, tax and banking structuring services focused on Bulgaria and Georgia. For the purposes of data-protection law, we are the controller of the personal data described in this policy.

Sovereignty Global is registered under company number 311454940, with a registered address at 36 Dragan Tsankov Blvd. You can contact us about privacy at legal@sovereigntyglobal.org.

2. The data we collect

Visitors to this website

You can browse the public site without giving us any personal data. We use Cloudflare Web Analytics to understand aggregate traffic and performance; Cloudflare describes this service as cookie-free and says it does not collect or use visitors’ personal data. Our hosting provider also processes standard technical information (such as your IP address and request metadata) to deliver and secure the site. The LinkedIn Insight Tag is separate and loads only after you consent, and never on the contact form, client portal, staff or sign-in areas (see section 4).

People who book a consultation

Consultations are scheduled through Calendly. When you book, Calendly collects the details you provide (such as your name, email address and any notes) and shares them with us so we can prepare for and hold the meeting.

Clients using the secure portal

When we create a client account, and as we work together, we process:

• Account details — your name, email address and a securely hashed password.
• Profile details — where relevant to your matter: phone number, nationality, country of residence, tax residence, address and an internal client reference.
• Documents — files we exchange with you (for example residency, tax and banking paperwork), stored as encrypted-at-rest objects.
• Service records — document requests, their status, and security and activity logs needed to operate the portal safely.

3. Why we use it, and our legal basis

• To provide our services and manage your account and documents — performance of a contract.
• To secure the portal, prevent abuse, rate-limit sign-in attempts and keep audit records — our legitimate interests in protecting the service and our clients.
• To respond to enquiries and schedule consultations — legitimate interests, or steps taken at your request before entering a contract.
• To meet legal and regulatory obligations, including record-keeping and anti-fraud requirements — legal obligation.

We do not use your data for automated decision-making that produces legal or similarly significant effects, and we do not sell your data.

4. Cookies and local storage

We keep browser storage deliberately limited. The secure client portal uses an essential session cookie. Cloudflare Web Analytics is cookie-free. The LinkedIn Insight Tag is an optional advertising and analytics technology that we load only after you press “Accept” in Cookie settings, and it is excluded from the contact form, client portal, staff and sign-in areas.

Name	Type	Purpose	Retention
sg_session	Strictly necessary cookie	Keeps you signed in to the client portal after login. It is HttpOnly, Secure and SameSite=Strict.	Up to 7 days, or until you sign out.
sg-consent	Local storage (not a cookie)	Remembers your cookie choice (accept or decline) so we don’t ask again.	Until you clear your browser storage.
LinkedIn Insight Tag (cookies and related browser technologies set by LinkedIn)	Advertising / analytics — consent required	Loaded only after you accept. It is used to measure LinkedIn campaign performance and may support advertising audiences. See LinkedIn’s Privacy Policy and current Cookie Table.	Varies by LinkedIn technology; current durations are published in LinkedIn’s Cookie Table.

The session cookie is strictly necessary to provide secure sign-in. The LinkedIn Insight Tag is optional: we ask for consent first and load it only after you accept. You can revisit that choice at any time using the Cookie settings control below; choosing Decline prevents the tag from loading on future page views. You can also clear this site’s browser storage.

Cookie settings

5. Fonts and third parties

The site loads typefaces from Google Fonts. To serve them, Google may receive your IP address. We use the following processors and service providers, who act on our instructions:

• Cloudflare — website and application hosting, content delivery, database and file storage, and security.
• Google — delivery of web fonts.
• Calendly — consultation scheduling.

6. International transfers

Delivering our services and coordinating banking may involve transferring personal data outside the European Economic Area — for example to Georgia, and to service providers that operate globally. Where we do this, we rely on an adequacy decision or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

7. How long we keep data

We keep personal data only as long as we need it. Our systems automatically clear operational records on a routine schedule, including:

• Expired portal sessions — removed once expired.
• Failed sign-in records — removed after 24 hours.
• Unused invitations — removed 30 days after they expire.
• Security and activity events — removed after 12 months.
• Sent operational notifications — removed after 90 days.

Client account details and documents are kept for the life of the engagement and for as long afterwards as we are required to for legal, regulatory or legitimate business reasons, after which they are deleted.

8. Your rights

Subject to the conditions in the law, you have the right to: access your data; have it corrected; have it erased; restrict or object to our processing; receive a copy in a portable format; and withdraw consent where we rely on it. To exercise any of these, email legal@sovereigntyglobal.org.

If you believe we have not handled your data properly, you can complain to your local supervisory authority. In Bulgaria this is the Commission for Personal Data Protection (CPDP).

9. Keeping data secure

Passwords are stored using salted PBKDF2 hashing, sessions use signed, HttpOnly cookies over HTTPS, uploads are validated and stored with restricted access, and sign-in attempts are rate-limited. Staff access is protected by an identity provider.

10. Changes to this policy

We may update this policy from time to time. We will change the “last updated” date above and, where changes are significant, take reasonable steps to let affected clients know.

11. Contact

Privacy questions: legal@sovereigntyglobal.org
New enquiries: contact@sovereigntyglobal.org
Existing clients: accounts@sovereigntyglobal.org