In short: Every company website has to show who stands behind it: name, address, phone and email, registration details, and the supervisory body where the activity is regulated. If you sell online, add the final price including taxes, delivery and payment terms, a 14 day right of withdrawal and a route for complaints. The rest is not required by law, but it decides whether a visitor contacts you: clear service pages, an explanation of how the price is formed, proof of work, and a form that works.
The details below are as of 16 September 2026 and refer to Bulgarian law, which follows the EU rules. This is general information, not legal advice: check your own case with a lawyer.
What information is mandatory on every company website?
The starting point is the Bulgarian Electronic Commerce Act. Article 4(1) requires an information society service provider to give recipients and the competent authorities unobstructed, direct and permanent access to the following:
- Name: the name of the person or company behind the site.
- Address: the permanent address or the registered seat and management address, plus the trading address if it differs.
- Contact details: a telephone number and an email address for direct and timely contact with you.
- Registration: the entry details in the commercial register or another public register.
- Supervisory body: the authority that supervises the activity, where it is subject to notification, registration or licensing.
- Regulated profession: the chamber you belong to, your professional title, the country where it was granted, and a reference to the applicable rules.
- VAT: a statement that you are VAT registered, where that applies.
Paragraph 2 adds a rule on prices: where shown, they must be clear and understandable, and you must state whether they include the taxes, fees and costs that make up the final price.
None of this is limited to shops. A dental practice, a construction firm, an accountancy office and a manufacturer with a brochure site fall under the same text. Points 6 and 7 are missed most often, and they are exactly what tells a visitor there is a verified business at the other end.
Breaches of Article 4 are sanctioned under Article 23: companies and sole traders face a financial penalty, and repeat breaches carry higher amounts. The statements of finding are drawn up by the Consumer Protection Commission.
ScaleLab tip: Put the mandatory details in the footer of every page and repeat them on the contact page. That meets the permanent access requirement whichever page the visitor landed on, instead of relying on someone digging through the terms.
What does selling online add?
Here the Consumer Protection Act applies. Article 47(1) lists twenty items of pre contractual information a trader owes, clearly and understandably, before the consumer is bound by a distance contract. These are the ones that get missed:
- Final price: including all taxes and fees, or how it is calculated when it cannot be worked out in advance. Transport and delivery costs are part of it, or you must say such costs may apply.
- Delivery and payment: the terms of payment, delivery and performance, and the date by which you undertake to deliver.
- Complaints: the arrangements you offer for handling consumer complaints, where applicable.
- Right of withdrawal: the conditions, the time limit and how to exercise it, plus the standard withdrawal form set out in the act.
- Return costs: the fact that the consumer bears the cost of returning the goods, if that is the case.
- When there is no withdrawal: the cases in which the right does not apply.
- Statutory conformity: a reminder that the goods must conform to the sales contract.
Under Article 50 the withdrawal period is 14 days from receipt of the goods, or from conclusion of the contract for services. That is where the risk sits: under Article 51, if you never gave the information about the right of withdrawal, the period becomes one year and 14 days.
Article 49 covers the order itself. The main characteristics, the final price and the contract term must appear clearly right next to the order button, and the button must legibly read only “order with obligation to pay” or another unambiguous wording. If that is not respected, the consumer is not bound by the order. Delivery restrictions and accepted means of payment belong at the start of the ordering process.
One duty has gone the other way: the link to the European online dispute resolution platform. Regulation (EU) 2024/3228 repealed the earlier regulation, the platform stopped accepting complaints on 20 March 2025 and closed on 20 July 2025. If that link is still in your footer, it leads nowhere. How the rest of a shop’s pages are arranged is covered on our page about e-commerce marketing.
What do GDPR and the cookie rules require?
If you have a form, a chat or a newsletter, you process personal data and you owe information. The European Commission’s own guidance sets the minimum: who you are, why you process the data, what the legal basis is and who will receive it, in clear and plain language. Depending on the case you add the data protection officer’s details, the legitimate interest pursued, the storage period, the individual’s rights, how to withdraw consent and the right to complain to a supervisory authority.
Cookies are a separate matter. Article 4a of the Electronic Commerce Act allows storing information on a visitor’s device, or accessing it, only where the visitor has clear and comprehensive information under Article 13 GDPR and the option to refuse. There is an exemption for what is technically necessary to transmit the communication or to provide a service the visitor explicitly requested. In practice that means a banner that does not load analytics and advertising scripts before the choice is made, and a refuse option that works. How the banner, GA4 and the ad accounts fit together is set out in our Consent Mode and GA4 checklist.
With health data and other sensitive categories, be careful what you collect at all. A booking form needs a name and a phone number, not a diagnosis. We describe the same approach on our page about dental clinic marketing.
Who do the accessibility rules apply to?
Since 28 June 2025 the accessibility requirements for products and services have applied, covering e-commerce and several other sectors, while microenterprises providing services are out of scope. The scope, deadlines and technical check are set out in our article on website and online store accessibility. For a site still being built, it is cheaper to design the requirements in than to retrofit them.
Which pages actually earn enquiries?
The mandatory part keeps you in order. Enquiries come from the structure. Here is a page by page checklist.
| Page | What the law requires | What earns enquiries |
|---|---|---|
| Home | Access to the Article 4 details, usually via the footer | One sentence on who you are and who you work for, and a path to the services |
| Service or product | A clear price or the way it is calculated | A separate page per service with the problem, the solution and the next step |
| Prices | A statement on whether taxes and fees are included | A range, or an explanation of how a quote is formed when there is no price |
| Proof of work | Registration and supervisory details in regulated activities | Photos of finished work, reviews, certificates, sites and projects |
| Contact | Address, phone, email, complaints address for online sales | A short form, a tappable phone number, a map and opening hours |
| Legal pages | Terms, privacy, cookies, right of withdrawal | Reassurance for a visitor who pays in advance |
Three points deserve attention:
- Locations: with more than one site, give each its own page with address, opening hours and phone. People search for the town, not for the company.
- Frequently asked questions: collect what your team answers on the phone. It takes work off your staff and often shows up in search results.
- Forms: ask only for the fields you will genuinely use. Every extra field reduces the number of enquiries.
ScaleLab tip: Before launch, send a test enquiry from a phone and follow it: does it reach the right mailbox, is it recorded as an event, and does someone reply the same day. A site that looks good and loses enquiries costs more than one that is not finished yet.
What should you do now?
1. Collect the company details on one sheet
Name, company number, registered seat, trading address, phone, email, registrations and supervisory bodies. That is your footer and contact page.
2. Walk through your own checkout
If you sell online, place an order yourself: price with taxes, delivery, button wording, confirmation, withdrawal form. Every gap here is both a legal and a commercial problem.
3. Check the forms and the banner
One sentence under each form about what the data is used for. A banner that waits for the choice. A privacy policy that says who receives the data and how long it is kept.
4. Arrange the pages around one step
For a manufacturer or a professional firm that is usually a request for a quote, for a clinic a booked appointment, for a shop an order. What a site looks like when booking is the main action is covered in our article on a service business website with online booking.
Which tool should carry that site is covered in our article on choosing a platform. Which tool should carry that site is covered in our article on choosing a platform. In website development the pages are arranged so that each one leads to that action, and tracking is set up before the site goes live.
Frequently asked questions
Do I have to publish my address and registration details on the site?
Yes. Article 4 of the Electronic Commerce Act requires permanent and direct access to the name, address, contact details and register entry. It applies to a site that only presents the company as well.
Do I need a privacy policy if I only have a contact form?
Yes. As soon as the form collects a name, a phone number or an email address you process personal data, and you owe information about who you are, why you process it, on what legal basis and who receives it.
Do I need a cookie banner if I only use analytics?
Analytics scripts do not fall within the Article 4a exemptions, which cover transmitting the communication and a service the visitor explicitly requested. The standard approach is information and a choice before they load, with the set-up described in our Consent Mode and GA4 article.
Does my shop still have to link to the online dispute resolution platform?
No. Regulation (EU) 2024/3228 repealed the earlier regulation, the platform stopped taking complaints on 20 March 2025 and closed on 20 July 2025. The link can go, while your complaint handling arrangements stay part of the Article 47 information.
How many pages should a company website have?
There is no number in the law. The practical minimum is a home page, a page per service, a proof of work page, contact with a form, and the legal pages. After that you add locations and questions according to what your customers ask.
Sources
- Ministry of Economy and Industry: Electronic Commerce Act, Articles 4, 4a and 23 (in Bulgarian)
- State Agency for Metrological and Technical Surveillance: Consumer Protection Act, Articles 47, 49, 50, 51 and 204 (in Bulgarian)
- Your Europe: E-commerce and distance selling
- Your Europe: Data protection under GDPR, what information you must give
- European Parliament: Discontinuation of the European ODR Platform, Regulation (EU) 2024/3228 (30 December 2024)