Personal Data Privacy Policy pursuant to the European Data Protection Regulation (GDPR)

I. Mandatory information on the persons’ rights under the European Data Protection Regulation (GDPR)

General information on the Regulation

As of May 25, 2018, a new data protection regulation (General Data Protection Regulation – (EU) 2016/679), adopted by the European Union, enters into force. The regulation aims to establish a single framework for regulating the collection, processing and administration of data of natural persons from the European Union.

Best Cars Ltd., as a data controller for the provision of a car lease service, meets all the requirements of the Regulation by collecting the minimum necessary data for the natural persons, which are required to provide the service. The data is processed and stored in accordance with the guiding principles established by the Regulation – in a manner that is responsible, technically and procedurally secured and lawful.

Information about the Data Controller

Name: Best Cars Ltd.

UIC/BULSTAT: 200482470

Headquarters and management address: Sofia, 1373, Krasna Polyana region, “Zapaden Park” district, block 60, ent.1, floor 7, ap.28

Address for conduct of the activity: Sofia, 1000, 100, James Bourchier Str.

Mailing address: Sofia, 1000, 100, James Bourchier Str.

E-mail: info@travelbyelectric.com

Telephone number: +359 876 09 1000

Information on the competent supervisory authority

Name: Personal Data Protection Commission

Headquarters and management address: Sofia, 1592, 2, Prof. Tzvetan Lazarov Str.

Correspondence data: Sofia, 1592, 2, Prof. Tzvetan Lazarov Str.

Telephone number: 02 91-53-555 , 02 915 3 518

Email: kzld@cpdp.bg

Website: www.cpdp.bg

Best Cars Ltd. operates in accordance with the Law of the Republic of Bulgaria and Regulation (EU) 2016/679 of the European Parliament on the protection of personal data that personalise and/or identify citizens of the European Union.

Reasons for collecting, processing and storing your personal data under GDPR

Best Cars Ltd. collects and processes personal data in connection with the provision of the following basic services: Lease of cars, signing agreements with the company under Regulation (EC) 2016/679, and in particular on the basis of the following:

1. Your explicit consent as a Client received by us.

2. Implementation of the obligations of Best Cars Ltd. under an agreement signed with you.

3. Compliance with a legal obligation that applies to Best Cars Ltd.

4. For the purposed of the legitimate interest of Best Cars Ltd.

Best Cars Ltd. is a personal data controller with respect to your data as a user of our services. With respect to the personal data you process, using our services, Best Cars Ltd. acts in the capacity of a personal data processor.

Objectives and principles of collecting, processing and storing your personal data

Best Cars Ltd. collects and processes the personal data you provide to us in connection with the use of our services to enter into an agreement with the company, including for the following purposes:

1. To create an account and to provide full functionality in the provision of our services.

2. To individualise a party to an agreement with Best Cars Ltd.

3. For the accounting purposes of Best Cars Ltd.

4. For internal statistical purposes.

5. To maintain and secure a high level of information security.

6. To ensure performance under an agreement to which Best Cars Ltd. is a party.

7. To send information messages, service change announcements, service improvement recommendations, new services. etc.

8. To improve and personalise the services offered by Best Cars Ltd. by making offers that are relevant to you for other products and services that may be of interest to you:

Best Cars Ltd. complies with the following principles when processing your personal information:

1. Transparency, good faith and lawfulness.

2. Consistency with the purposes of processing and minimisation of collected data.

3. Accuracy and appropriateness of the data;

4. Restriction of the storage in order to achieve the objectives.

5. Integrity and confidentiality of the processing.

6. Ensuring an adequate level of personal data security.

When processing and storing personal data, Best Cars Ltd. may process and store personal data in order to protect the following legitimate interests:

Implementation of its obligations to the National Revenue Agency, the Ministry of Interior and other state and municipal authorities.

Types of transactions with personal data:

1. Registration of a user on the website www.travelbyelectric.com and performance of a car lease agreement or other services – the purpose of this operation is to create an account linked to the used/selected service and to allow the registered user alone to manage their services through the established administrative panel. Conclusion of the Impact Assessment: On the basis of the impact assessment referred to above, the Data Protection Officer considers that the operation „Conclusion of a service agreement – a car lease“ is admissible for implementation and provides sufficient guarantees to protect the rights and legitimate interests of the data subjects in accordance with the GDPR requirements.

2. Conclusion and execution of a trade deal with a client or a partner – the purpose of this operation is to conclude and execute an agreement with a commercial partner or client and its administration.

3. Sending information messages – the purpose of this activity is administering the process of sending messages to customers regarding improvements or changes in services, changed/exceeded parameters, outgoing services, open maturity proformas, etc. under the service provision agreement.

4. Send an information bulletin (newsletter) – the purpose of this operation is to administer the bulletin sending process to customers that have declared their wish to receive them.

Best Cars Ltd. processes the following categories of personal data and information for the following purposes and on the following grounds:

1. Data: Your personalising data (name and surname, e-mail, country, phone)

2. Purpose, for which the data is collected:

– User registration

– Making a connection with the user and sending information to them, including in case of an expressed desire – for sending newsletters and advertising messages;

Reason for processing your personal information – By accepting the general terms and conditions and registering on the website between Best Cars Ltd. and you a contractual relationship is created, based on which we process your personal data.

Additional data provided by you – If you wish to add your account, you can fill in it the address details and an email for technical contact.

Purpose, for which the data is collected: Adding user information to his/her user account, execution of the car lease agreement.

Other data that Best Cars Ltd. processes – When you sign in to our website or into you account, Best Cars Ltd. collects data about the IP address you are using.

Purpose, for which the data is collected: Improving service security and interface localisation, statistical and marketing research.

Grounds for data processing: Processing is necessary to execute an agreement, under which the data subject is a party.

Until a user profile is created, the IP address is collected based on: Implementing the legitimate interests of the Controller;

Your data for issuing an invoice to a natural person – If you would like an invoice to be issued to you as a natural person, you should provide your single personal identification number (single civilian number).

Purpose, for which the data is collected: Issuing an invoice for making payments under a service provision agreement.

Reason for processing your personal information – By accepting the general terms and conditions of registration of the website or upon concluding a written agreement between Best Cars Ltd. and you, a contractual relationship is created, on which basis we process your personal data.

Best Cars Ltd. DOES NOT collect or process any personal data related to the following:

– revealing racial or ethnic origin;

– disclosing political, religious or philosophical beliefs, or membership in trade unions

– genetic and biometric data, health data or sexual life or sexual orientation data.

Personal information has been collected by Best Cars Ltd. through the persons, to whom it relates.

Best Cars Ltd. does not make automated decision making using data.

Best Cars Ltd. does not provide your data to third parties without your explicit consent. Best Cars Ltd. can provide your data only to the competent authorities, including the authorities of Traffic Police and the Traffic Control Authority (KAT), if this is necessary for the purpose of implementing the car lease agreement, for which you are informed and agree by accepting this Policy.

Period of storage of your personal data

Best Cars Ltd. stores your personal data for a period not longer than the duration of your website account. Upon expiration of this period, we take the necessary care to erase and destroy the information without undue delay.

Best Cars Ltd. keeps the personal data it needs to keep under the applicable law for the applicable duration, which may exceed the duration of your registration.

Transmission of your personal data for processing

Best Cars Ltd. will not transmit your data and will warn you and will obtain the necessary consent (if it has not been properly collected), if it intends to submit your data in compliance with the requirements of Regulation (EC) 2016/679.

Withdrawal of consent for processing of your personal data

If you do not want all or part of your personal data to continue to be processed by Best Cars Ltd. for any particular or for any processing purpose, you may at any time withdraw your consent to processing by filling out the form in your account or by requesting it in a free text.

By withdrawing the consent for processing personal data required to create and maintain your service use registration, your account will become inactive.

Right of access

You have the right at any time to request and obtain from Best Cars Ltd. confirmation whether personal data related to you is being processed.

You have the right to access the data relating to you, as well as the information relating to the collection, processing and storage of your personal data.

Best Cars Ltd. provides you, upon request, with a copy of your personal data processed in an electronic or other appropriate form.

Providing access to the data is free, but Best Cars Ltd. reserves the right to charge an administrative fee in case of repeatability or excessive requests.

Right to adjust or complete

You can correct or fill in the inaccurate or incomplete personal data associated with you directly through your website account or by submitting a request to Best Cars Ltd.

Right to delete (“to be forgotten”)

You have the right to ask Best Cars Ltd. to delete your personal data related to Best Cars Ltd., and Best Cars Ltd. has the obligation to delete it without undue delay, when one of the following reasons exists:

– personal data is no longer necessary for the purposes, for which it was collected or otherwise processed;

– you withdraw your consent, on which the processing of the data is based and there is no other legal basis for the processing;

– you object to the processing of personal data related to you, including for direct marketing purposes, and there are no legitimate grounds for processing that have a priority;

– personal data has been processed unlawfully;

– personal data shall be deleted to comply with a legal obligation under EU law or the law of a Member State that applies with respect to Best Cars Ltd.;

– personal data was gathered in connection with the provision of information society services.
Best Cars Ltd. is not obliged to delete personal data, if it stores and processes it:

– to exercise the right of freedom of expression and the right of information;

– for compliance with a legal obligation requiring processing provided in the EU law or in the law of the Member State, which applies to the Controller, or for the accomplishment of a task in the public interest or in the exercise of official powers granted thereto;

– for reasons of public interest in the field of public health;

– for purposes of archiving in the public interest, for scientific or historical research or for statistical purposes;

– for the establishment, exercise or protection of legal claims.

In order to exercise your right „to be forgotten“, you have to file a request through the option in your account or a written request sent to Best Cars Ltd., as well as to certify your personality and identity with the person, to whom the data relates.

Best Cars Ltd. does not delete the data it has a legal obligation to store, including for protection against court claims brought against it or a proof of its rights.

Right of limitation

You have the right to request from Best Cars Ltd. to restrict the processing of your related data when:

– you contest the accuracy of the personal data for a period allowing Best Cars Ltd. to verify the accuracy of the personal data;

– the processing is illegal, but you do not want your personal data to be erased but only to limit its use.

– Best Cars Ltd. no longer requires personal data for processing purposes, but you require it to establish, exercise or protect your legal claims.

Right of portability

You may download at any time the data that is stored and processed for you in relation with the use of the services provided by Best Cars Ltd. directly through your account or by an email request.

You can ask Best Cars Ltd. to transfer your personal data directly to a Controller you appoint when it is technically feasible.

Right to receive information

You may ask Best Car Ltd. to inform you of all recipients that have been disclosed the personal data, for which correction, deletion or limitation of the processing has been requested. Best Cars Ltd. may refuse to provide this information, if this turns out to be impossible or would require disproportionate efforts.

Right of objection

You may object at any time to the processing of personal data that applies to you by Best Car Ltd., including whether it is processed for profiling or direct marketing purposes.

Your rights in breach of the security of your personal data

If Best Cars Ltd. detects a data privacy breach that may pose a high risk to your rights and freedoms, we will notify you without undue delay of the breach and of the measures that have been taken or that are going to be taken.

Best Cars Ltd. is not obliged to notify you, if it:

– has taken appropriate technical and organisational measures to protect the data affected by the security breach;

– has subsequently taken measures to ensure that the breach will not lead to a high risk for your rights;

– The notification would require disproportionate efforts.

Persons, to whom your personal information is provided

The Controller does not transfer your data to third countries.

Other provisions

In case of breach of your rights under the above or the applicable data protection laws, you have the right to file a complaint with the Personal Data Protection Commission, as follows:

Name: Personal Data Protection Commission

Headquarters and management address: Sofia, 1592, 2, Prof. Tzvetan Lazarov Str.

Correspondence data: Sofia, 1592, 2, Prof. Tzvetan Lazarov Str.

Telephone number: 02 91-53-555 , 02 915 3 518

Email: kzld@cpdp.bg

Website: www.cpdp.bg

You can exercise all of your rights to protect your personal data through the forms enclosed with this information. Of course, these forms are not mandatory and you can make your claims in any form that contains a statement about it and that identifies you as the data holder.

When you assign to Best Cars Ltd. to process personal data to a third person for the purpose of using the service, Best Cars Ltd. acts as a personal data processor.