Privacy Policy

Last updated 9 November 2026 · Leer en español

Who we are

The controller of your personal data (in El Salvador’s law, the responsable del tratamiento) is Invest Bulgaria Group EOOD, a company registered in Bulgaria, which publishes the InvestSalvador.com website and business directory. InvestSalvador.com is independent and is not a government website.

Company number (EIK)

131238011

Registered address

5 Hristo Kovachev Str., Sofia 1527, Bulgaria

Privacy contact

contact@investsalvador.com

We have not appointed a data protection officer. If the rules in El Salvador or the EU come to require one for a publisher like us, we will name the officer here. For any question about this policy or your data, contact us at contact@investsalvador.com or through the contact form, in English or Spanish.

Which laws apply

Because the publisher is established in Bulgaria, we follow the EU General Data Protection Regulation (GDPR) and the Bulgarian Personal Data Protection Act for everyone who uses the site.

For visitors in El Salvador we also follow the Ley para la Protección de Datos Personales (Legislative Decree No. 144, approved on 12 November 2024). Among other things it gives you the ARCO-POL rights described below, requires us to answer requests within 20 business days, and makes the Agencia de Ciberseguridad del Estado the supervisory authority. Where the two laws differ, we apply the rule that protects you more.

Data we collect

When you send us a message

The contact form asks for:

• your name and email address;
• optionally, your company and country;
• the topic you choose and the message you write.

Please do not include sensitive information, such as health data or identity documents, in your message.

When you create an account

We ask for your name, email address and a password. We store the password only in scrambled (hashed) form, so nobody at InvestSalvador.com can read it.

When you contact a company through the directory

The enquiry form asks for your name, email address, optionally your country, and your message.

When you ask to manage a listing or report one

We record your role at the company and anything you tell us to show you represent it. A report can include your email address if you would like a reply.

When you buy a membership or an advert

We ask for the billing details needed for an invoice: the company name, address, country, tax or VAT number, and the name and email address of the person ordering.

When you subscribe to The El Salvador Investor Briefing

We ask only for your email address.

When you visit the website

Like any website, our server processes technical data needed to deliver pages and keep the site secure: your IP address, browser type, the pages requested and the time of the request. We use your IP address to limit repeated form submissions and protect against abuse.

We do not use analytics, advertising or social media tracking. Fonts, maps and images are served from our own website, so loading a page does not send your data to third-party font or content providers. Videos are only loaded from YouTube when you press play (see Cookies).

Why we use it

• Replying to your message, for example about a directory listing, a membership or advertising. The legal basis is your consent, given when you submit the form (GDPR Article 6(1)(a)), and, where you ask about our paid services, taking steps at your request before entering into a contract (Article 6(1)(b)).
• Sending The El Salvador Investor Briefing, if you subscribe. The legal basis is your consent (Article 6(1)(a)).
• Providing accounts, listings and memberships. The legal basis is the contract with you (Article 6(1)(b)).
• Running and securing the website, including preventing spam and abuse. The legal basis is our legitimate interest in operating a secure website (Article 6(1)(f)).
• Meeting legal obligations, such as keeping invoices and accounting records (Article 6(1)(c)).

Under El Salvador’s law, where we rely on your consent it must be free, specific, informed and unambiguous, and you can withdraw it at any time with the same ease with which you gave it. We do not sell your personal data, and we do not use it for automated decision-making or profiling.

The El Salvador Investor Briefing

If you subscribe, we use your email address only to send The El Salvador Investor Briefing, an email with news and data for investors. You can unsubscribe at any time by replying to any issue or through the contact form, and we will stop sending it and delete your address from the list.

Member accounts

Companies create a free account to add or update their directory listing and publish investment offers. We use your account details to sign you in, to email you about your listings (for example when a change is approved or a membership is due for renewal) and to reset your password. You can change your details in your account settings, or ask us to close the account.

The business directory

The directory shows information about companies: their name, description, address, phone number, website and, where the company provides it, the name of its manager. We do not publish personal email addresses.

Listings prepared by our editors. Some listings are written by our editors from the company’s own website and other public business sources. Business contact details may still relate to a person; we keep them to run the directory, based on our legitimate interest in maintaining an accurate business directory (Article 6(1)(f)). If you are named in a listing, you can ask us to correct or remove your details at any time.

Enquiries. When you use the form on a company’s page, we email your name, email address, country and message to that company, so it can reply to you directly. We keep a record of the enquiry for 24 months to deal with abuse. The legal basis is your consent, which you give by ticking the box on the form.

Managing a listing. To confirm you represent a company, we either email a link to an address on the company’s website or listing, or our team checks the details you give us. We keep a record of the request and the decision.

Payments and invoices

Card payments are handled by Stripe and PayPal payments by PayPal. You enter your card or PayPal details on their pages; we never see or store card numbers. They tell us whether a payment succeeded and give us a reference, the amount and the last digits of the card. For bank transfers we see the payer details shown on the bank statement.

We keep invoices and payment records for as long as Bulgarian accounting and tax law requires.

The site assistant

The help bubble in the bottom corner of the site (Ask InvestSalvador.com) answers questions about investing, living and doing business in El Salvador and links to the relevant pages and directory listings. Its answers are written by an AI model, can be wrong and are not legal, tax or financial advice.

What is sent. When you ask a question, our server sends the text of your question, the title of the page you are on, the site language and your previous few questions and answers in the same conversation to DeepSeek, the AI provider that writes the answer. We do not send your name, email address, IP address or account details. Please do not type personal details into the assistant.

Where it is processed. DeepSeek is operated by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and processes data in the People’s Republic of China. Using the assistant is optional: if you prefer that your question is not sent there, please use the site search or contact us instead.

What we keep. We keep a log of the questions, the language and the suggested links for 30 days, without IP addresses, to check the answers and prevent abuse. Your IP address is used only briefly to limit the number of questions per visitor. The conversation is stored in your browser for the current tab and is deleted when you close it or press Start again. The legal basis is our legitimate interest in helping visitors find information on the site (Article 6(1)(f)).

Who receives it

• Our team, who read and answer messages and review listings.
• Service providers who host the website, deliver email, process payments (Stripe, PayPal) and translate listing texts, acting on our instructions under data processing agreements.
• Directory companies, such as lawyers or accountants, but only when you send them an enquiry through the directory or ask us to pass on your message.
• Our accountant, for invoices and payment records.
• Public authorities, only where the law requires it.

International transfers

We are based in Bulgaria and our website is hosted in the United Kingdom, which the European Commission recognises as giving personal data adequate protection (the adequacy decision was renewed in December 2025 until December 2031). If you are in El Salvador, using the site means your data is sent to and processed in Europe; we tell you this here so that your consent is informed, as El Salvador’s law requires. When data goes to other countries, for example to a payment provider or to the site assistant described above, we use appropriate safeguards such as an adequacy decision or standard contractual clauses, and we only send what the service needs.

How long we keep it

• Messages: up to 24 months after our last contact with you, unless the message leads to a contract.
• Briefing subscriptions: until you unsubscribe.
• Accounts: until you ask us to close the account, or after three years without signing in, when we email you first.
• Invoices and payment records: as long as Bulgarian accounting and tax law requires.
• Directory enquiries and reports: up to 24 months.
• Requests to manage a listing: for as long as you manage the listing, and up to 24 months after a request is declined.
• Server and security logs: only as long as needed to operate and protect the website.
• Site assistant questions: 30 days, without IP addresses.
• Session cookies: deleted automatically, as described below.

Security and breaches

We protect your data with encrypted connections (HTTPS), hashed passwords, restricted staff access and regular backups. If a security incident puts your data at risk, we notify the competent authority within 72 hours of becoming aware of it, as both the GDPR and El Salvador’s law require: in the EU the Bulgarian Commission for Personal Data Protection, and for people in El Salvador the Agencia de Ciberseguridad del Estado and the Attorney General’s Office (Fiscalía General de la República). We also tell the people affected without undue delay, and for people in El Salvador within the same 72 hours.

Cookies

We only use cookies that are strictly necessary for the website to work. They do not track you across other sites, and because they are essential, they do not require consent. We list them here, as El Salvador’s law asks privacy notices to do.

The site assistant keeps your conversation in your browser’s session storage for the current tab only; this is not a cookie and is deleted when you close the tab. Videos play from YouTube in privacy-enhanced mode (youtube-nocookie.com): nothing is loaded from YouTube and no YouTube cookies are set until you press play. Payment pages run on Stripe’s and PayPal’s own websites, under their cookie policies.

You can delete or block cookies in your browser settings, but the forms on this site may not work without them.

Your rights

Under the GDPR, and under El Salvador’s law (the rights known there as ARCO-POL), you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate data or complete incomplete data;
• cancel or erase your data, for example when it is no longer needed;
• object to processing, including processing based on our legitimate interests;
• receive your data in a portable format and have it sent to another provider;
• be forgotten, meaning outdated or no longer relevant information about you is removed from the site and its search;
• restrict how we use your data in certain circumstances;
• withdraw your consent at any time, without affecting processing that took place before you withdrew it.

To exercise any of these rights, contact us as described in Who we are. Exercising them is free. We will reply within 20 business days; if a request is complex we may extend this once by up to 20 business days and will tell you why. We may ask you to confirm your identity first.

Complaints

If you believe we have not handled your data properly, please tell us first so we can put it right. You also have the right to complain to a data protection authority:

• in El Salvador, the Agencia de Ciberseguridad del Estado (ACE), the authority under the Personal Data Protection Law;
• in Bulgaria, the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, kzld@cpdp.bg;
• or the data protection authority of the EU country where you live or work.

Changes to this policy

We may update this policy when our services or the law change. The date at the top of this page shows when it was last revised; we email account holders about significant changes.