Privacy Policy

1. Data Controller

The data controller, meaning the entity that determines the purposes and means of processing personal data through the Website https://dasautoservice.com/, is KUALITAT AUTO EOOD (КУАЛИТАТ АУТО ЕООД) (the "Company"/the "Controller"), registered under UIC (company registration number) 205081517, with its registered office and business address at: Sofia, postcode 1309, Sveta Troitsa residential district, Block 145, Entrance D, Apartment 100

All information and personal data you provide through the website https://dasautoservice.com/, hereinafter referred to as the "Website", will be processed lawfully, fairly and transparently. The Controller will comply with internationally recognised principles of personal data processing, including purpose limitation, storage limitation, data minimisation, accuracy, integrity and confidentiality of personal data.

2. Types of Personal Data Processed

When you use the Website, the Controller may collect and process information that, either on its own or in combination with other information previously collected, makes it possible to identify you. Information relating to a third party may also be processed if a Website user chooses to provide such information.

Information that makes it possible to identify a specific individual is classified by law as "personal data". Personal data may be collected through the Website, for example when you use specific services that require registration or the provision of contact details, or through programmes that analyse user behaviour (e.g. cookies).

When you complete enquiry forms, registration forms, customer satisfaction surveys or any contact form, you may be asked to provide contact details such as your name, email address, telephone number, vehicle details or information about the service you have used in connection with your enquiry. Data may be collected through cookies whenever you use the Website. Up-to-date information about data processing through cookies is available on the Website and via the link in the cookie notice displayed to users on their first visit to the Website.

Certain forms on the Website may contain free-text fields where you can choose to provide information that may constitute personal data relating to you or a third party. As providing such information is not mandatory, any personal data for which the Controller has no legal basis for processing will be deleted within 1 month of receipt.

3. Purposes of Processing

To provide services through the Website, including verifying the identity of the person requesting a service, creating a subscription, account or registration for a specific service or event, sending you any information you have personally requested through the contact forms and/or providing any other services that a user may request through the Website;
To carry out direct marketing by email or mobile phone and conduct customer satisfaction surveys regarding products and services, including through contact forms and surveys on the Website.

4. Legal Bases for Processing and Whether Processing Is Mandatory or Voluntary

4.1. Provision of Services: Processing for these purposes is necessary to provide services requested by a user through the Website. The legal basis for processing is Article 6(1)(b) of the General Data Protection Regulation (GDPR) – performance of a contract to which the data subject is a party or taking steps at the request of the data subject prior to entering into a contract. Providing data for these purposes is not mandatory, but if you do not provide the data, the Controller will be unable to provide the service you have requested.

4.2. Marketing: Processing for these purposes is based on consent – Article 6(1)(a) of the GDPR. You are not required to consent to the use of your personal data for these purposes, and there will be no consequences for you if you choose not to give such consent. Any consent given may subsequently be withdrawn by making an explicit statement to the Controller.

4.3. Certain personal data may be processed in the context of fulfilling a legal obligation of the Controller. This may include retaining and reporting personal data to public authorities to comply with tax, customs, procedural or other legal obligations.

5. Recipients of Personal Data

5.1. Persons engaged as IT service providers (for example, hosting providers or email platform providers);

5.2. Persons authorised to provide technical support (including maintenance of network equipment and electronic communications networks);

5.3. Companies authorised to represent and sell the Controller's products and services, such as dealers, service centres and marketing companies;

5.4. Public bodies/authorities to which personal data may be disclosed in accordance with applicable legislation or binding orders issued by those bodies/authorities;

6. Transfers of Personal Data to Third Countries or International Organisations

Given the international presence of the products and services presented through this Website, personal data may be transferred to recipients located in different countries. The Controller implements appropriate safeguards to ensure the lawfulness and security of these personal data transfers and will transfer personal data only where a legal basis exists, such as European Commission adequacy decisions, standard contractual clauses for data protection adopted by the European Commission, or other safeguards or conditions considered adequate for the relevant data transfer.

7. Retention of Personal Data

Personal data that enables the identification of a specific individual is retained for no longer than necessary to fulfil the purposes for which it was collected, unless there is a valid legal basis for longer processing or retention. The criteria used to determine personal data retention periods include the duration of our ongoing relationship, our legal obligations or our legal position (for example, in relation to legal disputes and/or regulatory investigations).

8. Rights of Data Subjects

You have the right to receive all necessary information relating to the processing of your personal data, including information about the purposes, legal bases and retention periods of processing, as well as the Controller's intention to process your data for purposes other than those originally stated.
You have the right to request that the Company provide access to, rectify or erase your personal data, or restrict the processing of your personal data, where the relevant conditions are met.
You have the right to object to the processing of your personal data, including where processing is carried out for direct marketing purposes, and to have such processing stopped immediately.
You have the right to withdraw your consent to the processing of your personal data at any time where the data was provided on the basis of consent, without affecting the lawfulness of processing carried out before its withdrawal.
You have the right to receive the personal data concerning you that you have provided to the Controller in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller without hindrance from the Controller.
You have the right not to be subject to a decision based solely on automated processing, including profiling, and the right to be informed of the existence of automated decision-making, including profiling. You also have the right to meaningful information about the logic involved, the significance and the consequences of such data processing – at least where automated decision-making produces legal effects concerning you or similarly significantly affects you.
You have the right to lodge a complaint with the Commission for Personal Data Protection and the competent court if you believe that your data has been processed unlawfully and your rights under the GDPR have been violated.

Requests for information about data processing, copies of data, erasure of personal data, data portability, rectification of data and withdrawal of consent must be made in writing, signed by the data subject and sent to the Controller at the address specified in this Policy.

The Company provides reasoned responses to requests from data subjects, fulfilling them where the relevant grounds exist or issuing a reasoned refusal where grounds for refusal exist. The Company also informs data subjects of their right to lodge a complaint with the Supervisory Authority (Commission for Personal Data Protection) and the competent court.

9. Amendments

This Privacy Policy has been in effect since 1 October 2023.

The Controller reserves the right to amend the Privacy Policy in part or in full, including to comply with requirements arising from future changes to applicable legislation. The Controller will inform data subjects of changes to the Policy through the Website. Such changes will become binding on the specified effective date, but no earlier than the date of their publication on the Website.