Privacy Policy

Data controller

The controller of your personal data is ХИТ 11 ЕООД, registered in the Commercial Register under company ID BG208206883, with registered office and address of management: гр. Бургас, жк. Братя Миладинови, ул. Одрин 2;гр. София бул. „Ломско шосе“ 148.

What personal data we collect

We only collect the data necessary to deliver our services. Depending on how you contact us, this may include:

• Full name and/or username
• Phone number
• Email address
• Location (where required)
• Details of the desired vehicle (make, model, budget)
• Technical data when using the site - IP address, browser type, pages visited (only via cookies, with your consent)

We do not collect sensitive personal data such as your national ID number, health information or financial documents, unless this is expressly necessary and you have given explicit consent.

Purpose of data processing

We process your personal data only for the following purposes:

• Responding to enquiries - to get in touch with you and provide information about the requested service
• Performance of a contract - when concluding a contract for the import, sale or maintenance of a vehicle
• Sending offers - only at your explicit request
• Improving the site - analysing how the site is used (only with consent for cookies)
• Legal obligations - where compliance with statutory requirements is necessary

Legal basis for processing

We process your personal data on the following legal grounds:

• Performance of a contract (Art. 6(1)(b) GDPR) - when you are our client and processing is necessary to fulfil our commitments
• Legitimate interest (Art. 6(1)(f) GDPR) - when handling enquiries and communicating with prospective clients
• Consent (Art. 6(1)(a) GDPR) - when using cookies for analytics purposes
• Legal obligation (Art. 6(1)(c) GDPR) - for obligations under tax and accounting legislation

Sharing with third parties

We do not sell or disclose your personal data to third parties for commercial purposes. Your data may only be shared in the following cases:

• Logistics partners - where needed to arrange transport (only to the extent required)
• Accounting and legal services - to fulfil legal obligations
• Government authorities - under an explicit legal obligation or an official request
• IT service providers - hosting and technical services to maintain the site, under a data processing agreement

All parties processing data on our behalf are bound by contractual obligations to protect confidentiality.

Data retention period

We store your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Enquiries without a concluded contract — up to 12 months from receipt of the enquiry
• Data under a concluded contract — 5 years after performance of the contract (in line with accounting legislation)
• Cookie data — for the lifetime of the specific cookie (see Section 8)

Once the period expires, the data is deleted or anonymised.

Your rights

Under the GDPR you have the following rights regarding your personal data:

• Right of access - to learn whether and what data we process about you
• Right to rectification - to request correction of inaccurate data
• Right to erasure ("the right to be forgotten") - to request deletion of your data under certain conditions
• Right to restriction - to request restriction of processing under certain conditions
• Right to data portability - to receive your data in a machine-readable format
• Right to object - to object to processing in certain circumstances
• Right to withdraw consent - when processing is based on consent

You also have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP) - www.cpdp.bg, 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia.

Cookies

The site uses cookies to provide core functionality and (with your consent) to analyse traffic.

• Essential cookies - required for the site to work. No consent needed.
• Analytics cookies - we use Google Analytics to analyse visits. They are activated only with your consent.
• Third-party cookies - when content from Facebook or Google Maps is embedded, cookies from those platforms may be loaded.

You can manage cookies through your browser settings or via the consent banner shown on your first visit.

Data security

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or destruction:

• SSL encryption of all communications with the website (HTTPS)
• Restricted data access limited to authorised staff only
• Regular reviews of system security

In the event of a data security breach, we will notify the affected individuals and the CPDP within the timeframes prescribed by law.

Changes to this policy

We may update this policy if the way we process data changes, or if applicable legislation changes. The date of the last update is shown at the top of the document.

For material changes, we will notify you via a visible notice on the site or by email, if we have your details.

Contact about privacy matters

For any questions, comments or requests relating to the processing of your personal data, you can contact us: