GDPR & Your Data Rights

We only process personal data where Article 6 GDPR gives us a lawful basis:

• Performance of a contract (Art. 6(1)(b)) — to take your order, generate the reports you purchase, and deliver them to you by email and on this website.
• Legitimate interest (Art. 6(1)(f)) — to produce your free preview from the intake data you voluntarily submit, and to improve report quality using aggregated, anonymized patterns.
• Legal obligation (Art. 6(1)(c)) — to keep accounting and payment records for the period required by Bulgarian tax and accounting law.
• Consent (Art. 6(1)(a)) — where we ask for it explicitly, for example before setting any non-essential cookies. You can withdraw consent at any time.

Under Chapter III of the GDPR (Articles 15–22) and the ZZLD, you have the right to:

• Be informed — about how your data is used (this page and our Privacy Policy).
• Access (Art. 15) — get a copy of the personal data we hold about you.
• Rectification (Art. 16) — have inaccurate or incomplete data corrected.
• Erasure / “right to be forgotten” (Art. 17) — have your data deleted, subject to records we must keep by law.
• Restriction (Art. 18) — limit how we use your data in certain situations.
• Data portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format.
• Object (Art. 21) — object to processing based on legitimate interest, including any marketing emails.
• Withdraw consent — at any time, without affecting processing carried out before you withdrew it.

Email sophie@mycareershift.ai from the address you used to order, and tell us which right you want to exercise. We may ask a question or two to confirm your identity before acting, so we do not disclose data to the wrong person.

We will respond within one month of receiving your request, as required by Article 12(3) GDPR. If a request is especially complex we may extend this by up to two further months and will tell you why. Exercising your rights is free of charge.

Some of the processors we rely on (for AI generation, payment, email delivery, and hosting) are based outside the European Economic Area. Where that is the case, transfers are protected by Chapter V GDPR safeguards — the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. The full list of processors is in our Privacy Policy.

If you believe we have mishandled your personal data, please contact us first — we want to put it right. You also have the right under Article 77 GDPR to lodge a complaint with a supervisory authority. In Bulgaria this is:

If you live in another EU/EEA country, you may instead complain to the data protection authority where you reside or work.