TOP ENDURO BULGARIA EOOD is a company registered under the Commercial Law of the Republic of Bulgaria, with UIC: 207809273, headquartered at 16 Kniaz Alexander Batenberg Street, Bansko, Bulgaria.

Legal Grounds for Data Processing
We process your personal data based on the following legal grounds:

• Contractual Obligations: To fulfill our obligations under a contract with you.
• Consent: Based on your explicit consent for specific purposes.
• Legal Obligations: As required by applicable laws and regulations.

The sections below provide detailed information about the processing of your personal data according to the respective legal grounds.

1. Data Processing for Contractual Obligations or Pre-Contractual Relations

We process your personal data to fulfill our contractual and pre-contractual obligations and to exercise our rights under contracts concluded with you.

Purpose of Processing:

• To verify your identity.
• To manage and process your requests and fulfill contractual obligations.
• To prepare proposals for contract conclusion.
• To issue invoices for the services you use.
• To provide full support and collect due payments.
• To maintain correspondence regarding orders, requests, or issues.
• To notify you about matters related to the services you use.
• To detect and prevent unlawful actions or breaches of our terms.

Data Processed Under This Ground:

• Contact details (email address, phone number, etc.).
• Identification data (name, delivery address, email address).
• Feedback and interactions with our website.

Disclosure to Third Parties:
We may share your personal data with:

• Postal and courier services.
• Providers maintaining software, hardware, or equipment used for data processing.
• Consulting service providers in various fields.

Data Retention:
Data processed under this ground is retained for five years after the termination of the contractual relationship.

2. Data Processing for Legal Obligations

We process your personal data when required by law, such as:

• Compliance with anti-money laundering legislation.
• Fulfillment of obligations under consumer protection laws.
• Provision of information to the Commission for Consumer Protection or similar authorities.
• Compliance with accounting and tax legislation.

Data Retention:
Data is retained until the statutory obligation for storage expires, e.g., 11 years for accounting purposes or five years for court proceedings.

Disclosure to Third Parties:
We may provide your data to government bodies or authorized entities as required by law.

3. Data Processing Based on Consent

We process your personal data based on your explicit, unambiguous, and voluntary consent.

Purpose of Processing:
To provide tailored product or service suggestions, supported by detailed analyses of your data using statistical models and anonymized insights.

Data Processed:

• Email address.
• Name.
• Address.
• Phone number.
• IP address.

Disclosure to Third Parties:
With your consent, we may share your data with marketing agencies, Facebook, Google, or similar platforms.

Withdrawal of Consent:
You can withdraw your consent at any time. This will not affect the lawfulness of processing before withdrawal.

Data Retention:
Data is deleted upon your request or six months after its initial collection.

4. Anonymized Data Processing

We use anonymized data for statistical purposes. Anonymization ensures that no individual can be identified. This alternative to deletion allows us to retain useful insights without holding personal data.

5. Use of Automated Algorithms

We use partially automated algorithms to improve our services and tailor them to your needs. This includes profiling to analyze trends and statistics without adverse effects on your rights or freedoms.

6. Data Security Measures

We take all necessary organizational and technical measures, including encryption and pseudonymization, to ensure the security and confidentiality of your personal data.

7. Rights of Data Subjects

You have the following rights concerning your personal data:

• Right to Information: About data processing activities.
• Right to Access: Your personal data.
• Right to Rectification: Correct inaccurate data.
• Right to Erasure: Request deletion under specific conditions.
• Right to Restrict Processing: Under certain circumstances.
• Right to Data Portability: Receive your data in a structured, commonly used format.
• Right to Object: To data processing, particularly for direct marketing.

To exercise these rights, contact us via our website or email.

Complaint to Supervisory Authority:
You can file a complaint with the Commission for Personal Data Protection or a competent court if your rights are violated.

8. Record of Processing Activities

We maintain a record of processing activities that includes:

• Controller’s name and contact details.
• Purposes of processing.
• Categories of data subjects and personal data.
• Data retention periods.
• Technical and organizational security measures.

Effective Date: This Privacy Policy is effective as of May 1, 2024.