Privacy Policy

Last updated: 19 October 2026

1. Introduction

TouchPoint EOOD (“TouchUp”, “we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, disclose, and protect personal data when you visit our website at https://touchupapp.com or use the TouchUp software platform and its related services (collectively, the “Service”).

TouchUp is a software-as-a-service (SaaS) platform that enables businesses, freelancers, agencies, and teams to create, customize, manage, share, and track professional business proposals and quotations.

This Privacy Policy applies to:

Visitors to our website.
Individuals who contact us with enquiries.
Registered users of the TouchUp platform.
Individuals whose personal data is included in proposals or other content created by TouchUp users.

Please read this Privacy Policy carefully to understand our data practices and your rights.

2. Who We Are

The data controller responsible for personal data processed for our own business purposes is:

Company name: TouchPoint EOOD (Тъчпойнт ЕООД)

Registered address: 6 Breza Street, Floor 5, Apartment 25, Sofia, Bulgaria

Correspondence address: Energy Tower, 57 Cherni Vrah Boulevard, Floor 7, 1407 Sofia, Bulgaria

Telephone: +359 2 447 5122

Website: https://touchupapp.com

Email: info@touchupapp.com

Company registration number: 202771018

For personal data included in proposals and other information uploaded by our business customers, our role may differ depending on the circumstances. See Section 5 for further details.

3. Personal Data We Collect

The types of personal data we collect depend on how you interact with TouchUp.

3.1 Information You Provide Directly

When you create an account, use the platform, or contact us, we may collect:

Identity information: Name and surname.
Contact information: Email address, telephone number, and other contact details you choose to provide.
Account information: Username, account identifier, authentication information, account preferences, and subscription plan.
Business information: Company name, business address, role, and other business details.
Proposal information: Proposal titles, descriptions, services, deliverables, timelines, prices, payment terms, and other commercial information.
Client information: Names, business contact details, company information, and other information about clients that you choose to include in proposals.
Branding preferences: Brand colours, typography preferences, visual styles, and other customization settings.
Support communications: Messages, enquiries, feedback, and information you provide when contacting our support team.
Billing information: Subscription details, transaction references, billing history, and relevant invoicing information.

We do not intentionally collect more personal data than is reasonably necessary for the relevant purposes.

3.2 Information Collected Automatically

When you visit our website or use the platform, we may collect certain technical and usage information, including:

IP address.
Browser type and version.
Device type and operating system.
Date and time of access.
Pages and features accessed.
Usage events and interactions with the Service.
Referring website or source.
Technical logs and diagnostic information.
Security-related events and error reports.

The precise information collected depends on the technologies and services implemented on our website and platform.

3.3 Cookies and Similar Technologies

We may use cookies and similar technologies to support essential website functionality, maintain sessions, remember preferences, analyze usage, and support marketing activities where applicable.

Strictly necessary cookies may be used where required to operate the website or provide a service you have requested.

Non-essential analytics, advertising, or tracking technologies will be used only where the required consent has been obtained, as applicable under relevant law.

For more information, please refer to our Cookie Policy, if published.

3.4 Information Received from Third Parties

We may receive personal data from third parties where necessary to operate the Service, including:

Payment providers, regarding transaction status and subscription payments.
Authentication providers, if third-party sign-in is available.
Analytics and website performance providers.
Business customers who enter information about their clients into TouchUp.

Where we obtain personal data indirectly, we will provide the information required by applicable data protection law.

4. How We Use Personal Data

We may process personal data for the following purposes:

4.1 Providing the Service

To create and maintain accounts, authenticate users, generate proposals, store and organize information, enable proposal sharing, and provide the features associated with your subscription.

4.2 Managing Subscriptions and Payments

To administer subscriptions, process payments through applicable payment providers, manage invoices, monitor transactions, and address billing enquiries.

4.3 Communicating with You

To respond to questions, provide customer support, send important service notifications, and communicate information concerning your account or subscription.

4.4 Maintaining Security

To protect accounts, prevent fraud and unauthorized access, identify technical issues, investigate security incidents, and maintain the integrity of the Service.

4.5 Improving the Service

To understand how users interact with the platform, diagnose errors, improve usability, develop features, and assess service performance.

Where appropriate, we may use aggregated or anonymized information for statistical and analytical purposes.

4.6 Marketing Communications

Where permitted by applicable law, we may use your contact information to send product updates, company news, or marketing communications.

You may opt out of marketing emails at any time by using the unsubscribe mechanism provided or by contacting us.

Opting out of marketing communications will not prevent us from sending essential service-related messages.

4.7 Legal and Regulatory Compliance

To comply with applicable legal obligations, respond to lawful requests from public authorities, maintain required business records, and establish, exercise, or defend legal claims.

5. Our Role: Data Controller and Data Processor

TouchUp may act as either a data controller or a data processor, depending on the personal data involved and the purpose of processing.

5.1 When We Act as Data Controller

We act as a data controller when we determine the purposes and means of processing personal data for our own business activities, such as:

Managing user accounts.
Administering subscriptions and payments.
Providing customer support.
Maintaining platform security.
Managing our business communications.
Complying with legal obligations.

5.2 When We Act as Data Processor

When our business customers upload or enter personal data about their own clients into TouchUp, we may process that data on behalf of the relevant customer.

In these circumstances, the customer generally determines why the data is collected and how it is used, while we process it to provide the Service according to the customer’s instructions and applicable contractual arrangements.

The customer is responsible for ensuring that they have a valid legal basis for collecting and processing the personal data they enter into the platform, including any necessary notices or permissions.

Where required, a separate Data Processing Agreement (DPA) will govern the processing of personal data on behalf of business customers.

If you are an individual whose personal data has been entered into a TouchUp proposal by one of our customers, please contact that customer first regarding the purpose of the processing and your data protection rights. You may also contact us where appropriate.

6. Legal Bases for Processing

Where the General Data Protection Regulation (GDPR) applies, we process personal data only where an appropriate legal basis exists.

Depending on the circumstances, these bases may include:

Performance of a contract: Processing necessary to create your account, provide the Service, administer your subscription, and fulfil our contractual obligations.

Legitimate interests: Processing necessary for our legitimate business interests, such as securing the platform, preventing fraud, responding to business enquiries, and improving our services, provided those interests are not overridden by your rights and interests.

Legal obligation: Processing necessary to comply with applicable accounting, tax, regulatory, or other legal requirements.

Consent: Processing based on your consent, where required, including certain non-essential cookies and marketing activities.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

7. Artificial Intelligence and Automated Processing

TouchUp may provide AI-assisted features that help users draft, refine, or improve business proposals.

Where such features are used, the relevant information may include proposal descriptions, service details, commercial terms, and other content submitted for processing.

[Confirm the AI provider, the information transmitted to it, and whether submitted data is used for model training before publishing this section.]

Depending on the technical implementation, AI-related processing may involve third-party service providers acting on our behalf or independently under their own terms.

We will use appropriate contractual and technical safeguards where required.

AI-generated content may contain inaccuracies or omissions. Users remain responsible for reviewing and approving proposals before sending them to clients.

TouchUp is not intended to make decisions about individuals that produce legal effects or similarly significant effects solely through automated processing.

If this changes, we will provide any additional information and safeguards required by applicable law.

8. Sharing Personal Data

We do not sell personal data to third parties.

We may disclose personal data to the following categories of recipients where necessary and lawful:

8.1 Service Providers

Third-party providers that help us operate TouchUp, including:

Website and application hosting providers.
Cloud storage and infrastructure providers.
Payment processing providers.
Email delivery and communication providers.
AI service providers, where applicable.
Security, monitoring, and error-reporting providers.
Analytics providers, where applicable.
Customer support and business administration providers.

These providers may process personal data only under the applicable contractual arrangements and instructions, where they act as our processors.

8.2 Business Customers and Proposal Recipients

When a TouchUp user chooses to share or publish a proposal, the information contained in that proposal may become accessible to the intended recipient.

Users are responsible for checking the content and recipient details before sharing proposals.

8.3 Professional Advisers and Authorities

We may disclose personal data to lawyers, accountants, auditors, insurers, regulators, courts, or public authorities where necessary to comply with legal obligations or protect our rights.

8.4 Business Transfers

If TouchPoint EOOD undergoes a merger, restructuring, sale, or transfer of business assets, personal data may be transferred where legally permitted and subject to appropriate safeguards.

9. International Data Transfers

Our business is established in Bulgaria, within the European Economic Area (EEA).

Depending on the service providers we use, personal data may be processed or accessed outside the EEA.

Where personal data is transferred to a country that does not benefit from an applicable adequacy decision, we will implement an appropriate transfer mechanism where required, such as the European Commission’s Standard Contractual Clauses, together with any supplementary measures required by applicable law.

Information about relevant international transfers and safeguards may be provided upon request where required by law.

[Before publication, identify the countries in which relevant hosting, AI, analytics, payment, and other service providers process data.]

10. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, subject to applicable legal requirements.

Retention periods depend on the type of information and the reason for processing.

In general:

Account information: Retained while your account remains active and for a reasonable period afterward where necessary for account administration, dispute resolution, or legal compliance.
Proposal and client information: Retained according to the applicable account settings, customer instructions, contractual arrangements, and legitimate operational requirements.
Billing and transaction records: Retained for the periods required by applicable accounting, tax, and financial regulations.
Customer support communications: Retained for as long as necessary to address the enquiry and maintain relevant business records.
Technical and security logs: Retained for a period appropriate to security, troubleshooting, and operational needs.
Marketing preferences: Retained as necessary to manage subscriptions, consent, and opt-out requests.

When personal data is no longer necessary, we will delete it or anonymize it, unless we are legally required or permitted to retain it for longer.

[Define the actual retention periods, including the deletion schedule for account data, backups, proposals, and technical logs.]

11. Data Security

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction.

Depending on the nature of the processing and the risks involved, these measures may include access controls, authentication mechanisms, secure communications, system monitoring, backups, and other safeguards.

However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

You are responsible for keeping your account credentials confidential and notifying us promptly if you suspect unauthorized access to your account.

In the event of a personal data breach, we will take the measures required by applicable law, including notifying the relevant supervisory authority or affected individuals where legally required.

12. Your Data Protection Rights

Where the GDPR applies, you may have the following rights concerning your personal data:

Right of access: Request confirmation of whether we process your personal data and obtain a copy of it.

Right to rectification: Request correction of inaccurate or incomplete personal data.

Right to erasure: Request deletion of your personal data where the applicable legal conditions are met.

Right to restriction: Request that we restrict processing in certain circumstances.

Right to data portability: Receive certain personal data in a structured, commonly used, machine-readable format and transmit it to another controller where the legal conditions are met.

Right to object: Object to processing based on our legitimate interests in circumstances provided by law. You may object to direct marketing at any time.

Right to withdraw consent: Withdraw consent where processing is based on consent.

Rights concerning automated decision-making: Benefit from applicable safeguards where decisions are based solely on automated processing and produce legal or similarly significant effects.

These rights are subject to applicable legal conditions and exceptions.

To exercise your rights, contact us using the details in Section 2.

We may need to verify your identity before responding to a request. We will respond within the period required by applicable law.

Where a request is manifestly unfounded or excessive, we may take the measures permitted by law.

If you are a client of a business using TouchUp and your data has been entered into a proposal, we may direct your request to the relevant business customer where that customer is the data controller.

13. Right to Lodge a Complaint

If you believe that our processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority.

In Bulgaria, the supervisory authority is:

Commission for Personal Data Protection (CPDP)

Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria

Website: https://www.cpdp.bg/

You may also contact the supervisory authority in the EU Member State where you live, work, or where the alleged infringement occurred, where applicable.

We encourage you to contact us first so that we can attempt to address your concerns, but you are not required to do so before lodging a complaint.

14. Children’s Privacy

TouchUp is intended for business and professional use and is not designed to be directed at children.

We do not knowingly collect personal data directly from children in violation of applicable law.

If you believe that a child has provided personal data to us inappropriately, please contact us so that we can assess the situation and take appropriate action.

15. Third-Party Websites and Services

Our website or platform may contain links to third-party websites, services, or integrations.

We do not control the privacy practices of independent third parties. Their collection and use of personal data are governed by their own privacy policies and terms.

We encourage you to review the relevant policies before providing personal data to those services.

16. Cookies and Website Technologies

We may use cookies and similar technologies to support the functionality, security, and performance of our website and platform.

Depending on their purpose, these technologies may be used to:

Maintain sessions and essential website functionality.
Remember preferences.
Measure website traffic and performance.
Understand user interactions.
Support advertising or marketing activities, where applicable.

Where required by law, we will obtain consent before using non-essential cookies or similar technologies.

You may manage your preferences through the cookie settings available on our website, where implemented, or through your browser settings.

Disabling certain cookies may affect the availability or functionality of some features.

Further details about the cookies we use, their purposes, and their retention periods should be provided in our Cookie Policy or cookie preference interface, as applicable.

17. Marketing Communications

We may send service announcements and administrative messages necessary for the operation of your account.

Where permitted by applicable law, we may also send marketing communications about TouchUp, new features, updates, or related services.

You may unsubscribe from marketing communications at any time using the unsubscribe link included in the relevant message or by contacting us.

Unsubscribing from marketing communications will not affect essential communications relating to your account, security, billing, or the provision of the Service.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business, the Service, our data processing practices, or applicable legal requirements.

The latest version will be published on our website, together with the updated “Last updated” date.

Where required by law, we will provide additional notice of material changes.

We encourage you to review this Privacy Policy periodically.

19. Contact Us