1. Who processes your data
The controller of your personal data is „Пал Карс“ ООД ("Pal Cars" Ltd., "we", "us"), a private limited company registered in the Republic of Bulgaria under company number (ЕИК) 208899416, with its registered address at 21 Kamen Andreev St., bl. 21, ent. 1, fl. 2, ap. 6, 1303 Sofia, Vazrazhdane district, Bulgaria.
For anything concerning your personal data, write to info@palcars.eu or call +359 888 722 626.
2. Data protection officer
We have not appointed a data protection officer. We are not required to under Art. 37 GDPR: we are not a public authority, our core activities do not involve regular and systematic monitoring of data subjects on a large scale, and we do not process special categories of data on a large scale. Data protection enquiries are handled directly by the company's managing director at the address above.
3. What data we collect
| Category | Specifically |
|---|---|
| Contact details | Name, email address, phone number |
| Enquiry content | Make, model, year, maximum mileage, budget, and the free text you enter yourself in the "Other" field (colour, options, condition, timelines) |
| Correspondence | Emails, Viber and social media messages, notes from phone calls |
| Contract and accounting data | Details from a signed contract, invoices, payment records, vehicle and import details |
| Consents | Whether you agreed to marketing messages and whether you accepted cookies, together with the date of that choice |
| Technical data | IP address and browser details recorded by our hosting provider in standard log files. If you accepted analytics or marketing cookies, also the data described in our Cookie Policy |
We do not collect and do not ask for special categories of personal data (health, ethnicity, political opinions, biometrics and the like). Please do not enter such data in the free-text field of the form.
4. Where we get it from
- Directly from you — through the enquiry form on this site, by email, by phone, on Viber, or in a message on our social media.
- From Meta (Facebook and Instagram) — if you fill in a lead form in one of our ads, Meta passes your answers to us.
- From public registers and third parties — for a specific transaction we may receive vehicle data from the seller, the transporter or the customs agent.
5. What we use it for, and on what basis
We process your data only for the purposes below and only on the stated legal basis under Art. 6 GDPR.
| Purpose | Legal basis | Explanation |
|---|---|---|
| Responding to your enquiry, preparing a quote, pre-contract discussions | Art. 6(1)(b) — steps prior to entering a contract at your request | Without contact details we cannot reply to you |
| Performing the contract — sourcing, inspection, purchase, transport, import, registration | Art. 6(1)(b) — performance of a contract | |
| Accounting, invoicing, tax reporting | Art. 6(1)(c) — legal obligation | Bulgarian Accountancy Act, VAT Act, Tax and Social Insurance Procedure Code |
| Maintaining an internal record of enquiries (our CRM) and tracking which client asked for what | Art. 6(1)(f) — legitimate interest | Our interest is not losing enquiries and serving clients properly. We consider this does not override your rights: the data is minimal and expected |
| Preventing abuse and spam through the form | Art. 6(1)(f) — legitimate interest | |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) — legitimate interest | |
| Web analytics (Google Analytics) | Art. 6(1)(a) — your consent | Only if you gave it in the banner. You can withdraw it at any time |
| Marketing and ad measurement (Meta Pixel) | Art. 6(1)(a) — your consent | Only if you gave it in the banner |
| Sending offers and news by email | Art. 6(1)(a) — your consent | Only if you ticked the separate box on the form. You can unsubscribe at any time |
6. Who else has access
We do not sell your personal data. We do not pass it to third parties for their own purposes, except where this is necessary to deliver the service or required by law.
We use the following providers, who process data on our behalf as processors under an Art. 28 GDPR agreement:
| Provider | What for | Where |
|---|---|---|
| Netlify | Website hosting and receiving the enquiry form | USA / EU |
| Supabase | The database behind our internal CRM, where enquiries are stored | EU |
| Zoho | Our business email (@palcars.eu) | EU |
| Cloudinary | Storing and serving the vehicle photos in our listings | EU / USA |
| The spreadsheet in which we maintain available vehicles. The request is made by our server, not by your browser, so your IP address does not reach Google when you browse the site | EU / USA | |
| Google Analytics | Web analytics — only after your consent | EU / USA |
| Meta Platforms | Lead forms in ads (Lead Ads) and ad measurement via Meta Pixel — the pixel runs only after your consent | EU / USA |
We may also disclose data to our accountants, a lawyer, a licensed customs agent, a transport company, an insurer, and to competent authorities (the National Revenue Agency, the Customs Agency, the traffic police, the courts) where necessary for a specific transaction or required by law. Those parties act as independent controllers within their own obligations.
7. Transfers outside the EU and EEA
Some of our providers are established in the USA or may process data outside the European Economic Area. Where that happens, the transfer is protected by one of the mechanisms in Chapter V GDPR — the European Commission's Standard Contractual Clauses and/or the provider's certification under the EU–U.S. Data Privacy Framework.
If you would like a copy of the relevant safeguards, write to info@palcars.eu.
8. How long we keep it
| Data | Period | Why |
|---|---|---|
| An enquiry that did not lead to a contract | 24 months from our last contact with you | Clients often come back to the same search later. After that period the record is deleted |
| Client data under a signed contract | 5 years after the contract ends | The general limitation period under Art. 110 of the Bulgarian Obligations and Contracts Act |
| Accounting and tax documents | 11 years | Art. 12 of the Bulgarian Accountancy Act |
| Marketing consent | Until withdrawn, after which we keep only the fact of the opt-out | So we do not write to you again by mistake |
| Cookie choice | 12 months, after which we ask again | Stored locally in your own browser |
| Hosting server logs | Per Netlify's standard periods, typically up to 30 days | Security and diagnostics |
9. Automated decisions and profiling
We do not take decisions about you based solely on automated processing, and we do not carry out profiling within the meaning of Art. 22 GDPR. Every quote is reviewed and prepared by a person.
10. Your rights
In respect of your personal data you have the following rights:
- Access (Art. 15) — to obtain confirmation of whether we process your data, and a copy of it.
- Rectification (Art. 16) — to have inaccurate data corrected or incomplete data completed.
- Erasure (Art. 17) — the "right to be forgotten", where there is no longer a basis for keeping the data. We cannot delete documents we are legally required to keep (invoices, for example).
- Restriction of processing (Art. 18) — to "freeze" processing while a dispute about accuracy or legal basis is resolved.
- Portability (Art. 20) — to receive the data you provided to us in a structured, machine-readable format and transfer it to another controller.
- Objection (Art. 21) — to object to processing based on legitimate interest. If you object to direct marketing, we stop immediately and unconditionally.
- Withdrawal of consent (Art. 7(3)) — at any time, as easily as you gave it. Withdrawal does not affect processing carried out before it.
To exercise any of these rights, write to info@palcars.eu. We reply within one month. For complex or numerous requests the period may be extended by a further two months, and we will tell you if that happens. The service is free; a fee or a refusal is possible only for manifestly unfounded or excessive requests.
We may ask for additional information to make sure the request comes from you — that is a protection of your data, not an obstacle.
Your cookie consent can be changed straight away, without writing to us:
11. Complaints to the Bulgarian DPA
If you believe we process your data unlawfully, you have the right to lodge a complaint with the supervisory authority:
Commission for Personal Data Protection (КЗЛД)
2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
Phone: +359 2 915 3518 · Email: kzld@cpdp.bg · www.cpdp.bg
We would be glad if you came to us first — most questions are resolved with a single email.
12. Whether you have to provide data
Not by law. But to answer an enquiry we need your name and email address — that is a contractual requirement. If you do not provide them, we simply cannot prepare a quote or get back to you. Phone, budget and the remaining fields are optional and their absence does not stop us working on your enquiry.
13. Security
We apply appropriate technical and organisational measures under Art. 32 GDPR: an encrypted connection (HTTPS) across the whole site, access to our internal CRM only with an individual account and mandatory two-factor authentication, access limited to the people who need it, and confidentiality agreements with our providers.
14. Changes to this policy
We may update this policy when we change our services, providers or tools. The current version is always published at this address, with the date of the last update at the top. If a change is significant, we will notify you in an appropriate way.
Related documents: Cookie Policy · Terms & Conditions