Privacy Policy

1. Data controller

The controller is AUTOIMPORT BG OOD, UIC 203763394, VAT No. BG203763394, registered office and management address: 14 Mladen Stoyanov St., entrance A, apartment 14, 2300 Pernik, Bulgaria.

Questions and requests concerning personal data should be sent to [email protected].

2. Personal data we process

Depending on how the website and services are used, we may process:

• name, email address, telephone number if voluntarily provided, and preferred contact method;
• vehicle criteria, budget, listing links and correspondence;
• order, invoicing and payment data; full payment-card details are not stored by us;
• account information, if an account is created;
• IP address, browser, device, access date and time, system logs and essential cookies;
• transaction-related document data only where required for the selected service.

We do not request special categories of personal data. Please do not send more information than is necessary.

3. Purposes and legal bases

• Enquiries and consultation: response, analysis and preparation of a specific proposal — steps before entering into a contract and/or performance of a contract.
• Orders and performance: sourcing, checks, seller communication, inspection, transport and document coordination — performance of a contract.
• Invoicing and records: compliance with accounting, tax and other legal obligations.
• Security and protection of interests: fraud prevention, website protection and the establishment or defence of legal claims — legitimate interests.
• Marketing: only on a valid legal basis and, where required, with prior consent that may be withdrawn at any time.

4. Sources of data

We normally receive data directly from you. During service delivery we may receive limited information from sellers, transport or diagnostic partners, public registers and lawful vehicle-history sources. Where data comes from another source, the information required by applicable law is provided.

5. Recipients

Access is limited to people and providers who need the information:

• hosting and technical-support providers;
• email, accounting and administrative service providers;
• the payment operator when online payments are activated;
• sellers, carriers and diagnostic centres where necessary for the ordered service;
• public authorities where disclosure is required by law.

Personal data is not sold or provided for another party’s marketing. Data processors are required to maintain appropriate contractual and technical safeguards.

6. Transfers outside the EEA

Transfers outside the European Economic Area are not planned as part of the core service. If a technical provider processes data in a third country, processing takes place only on an applicable legal basis and with appropriate safeguards, such as an adequacy decision or standard contractual clauses.

7. Retention periods

• enquiry data without a subsequent contract — up to 12 months after the last substantive communication, unless earlier deletion is requested and no other retention basis applies;
• order and contract data — for the service period and then for applicable limitation and statutory periods;
• accounting and tax documents — for the periods required by law;
• account data — until the account is closed, unless another lawful basis requires retention;
• technical logs — for a limited security period set by the provider, or until an incident is resolved.

After the relevant period, data is deleted, anonymised or access is restricted.

8. Your rights

Subject to the conditions of the General Data Protection Regulation, you may request:

• information and access;
• correction of inaccurate or incomplete data;
• deletion or restriction of processing;
• data portability where applicable;
• objection to processing based on legitimate interests;
• withdrawal of consent without affecting prior lawful processing.

Send requests to [email protected]. Reasonable information may be requested to verify identity. Responses are provided without undue delay and within the applicable legal period.

You may lodge a complaint with the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria.

9. Cookies and technical data

The website uses essential cookies for core functionality, security and, where applicable, account sign-in and cart preservation. Essential cookies are not used to build advertising profiles.

If analytical or advertising cookies are introduced, this information will be updated and prior choice will be requested where required by law. Browser settings allow cookies to be restricted or deleted, though some functions may be affected.

10. Accounts and guest checkout

When online ordering is activated, guest checkout and voluntary account creation may be offered. Only data necessary for access to orders and communication will be stored in the account. Passwords are stored securely and are not visible to us.

11. Automated decision-making

We do not make decisions producing legal or similarly significant effects on clients solely through automated processing or profiling.

12. Security

Appropriate organisational and technical measures are applied, including restricted access, protected administrative accounts, encrypted connections and backups. No system is entirely risk-free; any identified incident is handled in accordance with applicable law.

13. Changes to this policy

This policy may be updated when services, providers or law change. The current version and effective date are always shown on this page. Material changes will be communicated appropriately.

14. Related documents

For service and ordering rules, see the Terms and Conditions and How it works.