Privacy Policy

CYBILAS Ltd. · sell-up.space

1. Data controller

The controller of your personal data is CYBILAS Ltd. (Bulgaria), operator of the SELL UP SPACE platform. Contact: [email protected] · +359 88 500 3940.

2. What we collect

• Account data — name and email; your password is stored only as a secure hash.
• Billing profile — company, VAT number and address, when you choose to provide them for invoices.
• Purchases and licences — ordered products, order references, download tokens and download counts.
• Seller and affiliate data — uploaded products, payout details, referral codes and commission records.
• Services marketplace content — service listings, job posts and proposals you publish.
• Technical and security logs — IP address, browser data, login history and audit records used to protect the platform.
• Cookies — language, currency, cart and session cookies, plus a referral cookie valid for 90 days.

3. Payments

Card payments are processed by Stripe. Your card details are sent directly to Stripe and never reach or get stored on our servers. Stripe processes them under its own privacy policy.

4. Purposes and legal bases

• Contract — delivering purchases and downloads, running seller, affiliate and services accounts, paying out earnings.
• Legal obligation — accounting, tax and consumer-protection requirements.
• Legitimate interest — security, fraud prevention, personalised watermarking of files, audit logs and service improvement.
• Consent — optional communications; you may withdraw consent at any time.

5. Sharing

We share data only with processors needed to run the platform: payment processing (Stripe), EU-based hosting and email delivery. We do not sell personal data. Disclosures to authorities happen only where the law requires it.

6. Retention

Account data is kept while your account exists. Order and accounting records are retained as required by Bulgarian law (up to 10 years). Security logs are kept for shorter periods and backups rotate automatically.

7. Your rights

Under the GDPR you may request access, rectification, erasure, restriction and portability, object to processing, and withdraw consent. Write to [email protected]; you can also delete your account from your profile page. You may lodge a complaint with the Bulgarian Commission for Personal Data Protection (cpdp.bg).

8. International transfers

Data is stored in the EU. Where a processor such as Stripe transfers data outside the EEA, safeguards such as standard contractual clauses apply.

9. Children

The platform is not directed at children under 16.

10. Changes

We may update this policy. The current version is always available on this page.