Privacy and reporting

PRIVACY AND PERSONAL DATA PROTECTION POLICY

“MODUL” EOOD respects the right to privacy and processes personal data in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (“GDPR”), the Bulgarian Personal Data Protection Act and other applicable legislation.

The protection of personal data is part of the proper and secure provision of our services. We process personal data only where this is necessary for a specific, clearly defined and lawful purpose, and we limit the information used to what is necessary for that purpose.

This information applies to the services provided by “MODUL” EOOD, as well as to the use of the Company’s websites, applications, customer accounts and other electronic services.

WHAT PERSONAL DATA WE MAY PROCESS

Depending on the specific service and the way in which you interact with us, we may process information relating to:

• your identity and the necessary data from documents presented by you;

• your entitlement to drive a motor vehicle;

• address, telephone number, email address and other contact details;

• reservations, contracts and services used;

• payments, deposits and payment transactions;

• handover and return of the vehicle;

• damage, accidents, insured events and claims;

• driving violations and requests from competent authorities;

• customer service, complaints, objections and correspondence;

• customer accounts and use of electronic services;

• marketing preferences and choices made in relation to communications;

• technical and online data when you use our electronic services.

In certain cases, location and telematics data, video images and recordings of telephone calls may also be processed.

We do not create a copy or image of an identity card or passport solely as a result of carrying out identification, unless there is a lawful necessity and an applicable legal basis in the specific case.

WHAT WE USE PERSONAL DATA FOR

Personal data may be processed for:

• accepting and managing reservations;

• taking steps prior to entering into a contract;

• identifying the customer and drivers;

• verifying the required entitlement to drive;

• entering into, performing and completing a vehicle rental agreement;

• providing additional services;

• administering payments, deposits and refunds;

• customer service and communication in relation to a specific case;

• establishing and handling damage and accidents;

• handling complaints, objections and claims;

• establishing, exercising and defending legal claims;

• complying with legal obligations and lawful requests from competent authorities;

• protecting persons, property and vehicles;

• providing and protecting electronic services and customer accounts;

• preventing unauthorised access and misuse;

• marketing communications and personalisation where the necessary consent has been provided.

Processing is not necessarily based on consent.

Depending on the specific purpose, personal data may be processed:

• in order to take steps prior to entering into a contract;

• for entering into and performing a contract;

• for compliance with a legal obligation;

• for the purposes of the legitimate interests pursued by “MODUL” EOOD or a third party;

• on the basis of consent provided, where such consent is necessary.

Consent is used mainly for optional activities, such as certain marketing communications, personalisation and the use of non-essential technologies.

CALL RECORDINGS, VIDEO SURVEILLANCE AND GPS/TELEMATICS

Certain telephone calls with “MODUL” EOOD may be recorded for the purpose of monitoring and improving the quality of service. Before recording begins, the individual is informed in an appropriate manner.

Video surveillance is carried out at the premises of “MODUL” EOOD and the areas adjacent to them for the purpose of security and the protection of customers, employees, other persons, property and vehicles. Access to video recordings is restricted to authorised persons.

The vehicles of “MODUL” EOOD are equipped with location and telematics systems. Data from these systems may be used for the protection and security of the vehicle, fleet management, determining the vehicle’s location where necessary, preventing and detecting improper or unauthorised use, establishing relevant circumstances in the event of an incident or dispute, and protecting legal rights and interests.

Data from these systems is not used arbitrarily, and access to it is restricted according to the specific business need and purpose.

WHO PERSONAL DATA MAY BE DISCLOSED TO

Personal data is not disclosed to other persons without an applicable legal basis.

Where this is necessary for a specific lawful purpose, personal data may be disclosed, for example, to:

• competent state and administrative authorities;

• law enforcement and judicial authorities;

• banks and payment institutions;

• insurers;

• repair service providers and experts;

• professional advisers and persons involved in the protection of rights and claims;

• reservation intermediaries and partners;

• other recipients where the disclosure is necessary and lawful.

The disclosure of personal data does not require consent in every case. Where another applicable legal basis exists, personal data may be disclosed to the extent necessary for the respective purpose.

RETENTION PERIODS

“MODUL” EOOD does not apply a single retention period to all personal data.

The retention period depends on the purpose of the processing, the nature and duration of the relationship, applicable statutory requirements and the need to establish, exercise or defend rights and claims.

The main retention periods most directly related to customers are:

• cancelled and unfulfilled reservations – up to 2 years;

• vehicle rental agreements and the related contractual documentation – up to 5 years from the final completion of the contractual relationship;

• documentation relating to damage, accidents, violations, complaints, objections and other specific customer cases – as a rule, up to 5 years from the final completion of the relevant case, unless ongoing proceedings or another applicable basis requires longer retention;

• video recordings – up to 30 days. Where a specific recording is necessary in connection with an incident, inspection, claim or proceedings, it may be isolated and retained until the need for its retention ceases;

• recordings of telephone calls – up to 2 months;

• customer accounts – up to 5 years of inactivity;

• marketing data – until consent is withdrawn or until the purpose ceases earlier.

Where, before the expiry of the relevant period, a dispute, claim, inspection, administrative, judicial or other proceedings arise, the relevant data may be retained until the final completion of the case and for the applicable subsequent period.

After the purpose has ceased and the applicable period has expired, personal data is erased, destroyed or irreversibly anonymised, unless another legal basis exists for its further retention.

Detailed information on the retention periods for the individual categories of data is provided in the Privacy and Personal Data Protection Policy.

COOKIES AND SIMILAR TECHNOLOGIES

The websites, applications and other electronic services of “MODUL” EOOD may use cookies and similar technologies.

They are mainly divided into:

• essential technologies;

• analytics and improvement technologies;

• marketing and personalisation technologies.

Essential technologies ensure the basic functioning of electronic services, reservation processes, user sessions, account login, security, prevention of misuse and retention of selected settings.

Where consent is required for the use of analytics, marketing or personalisation technologies, those technologies are not activated before consent has been provided.

You may accept or reject non-essential technologies, make choices by category and subsequently change your choices through “Privacy Settings”.

Technology settings and communication preferences are separate.

For example, rejecting marketing cookies does not mean that you will not receive an electronic communication necessary for the confirmation or management of a reservation, contract, payment, security or other service.

MARKETING COMMUNICATIONS

Where you have provided the relevant consent, we may use the contact details provided by you to send information about services, special offers, promotions, campaigns and other marketing communications.

Consent is voluntary and may be withdrawn at any time.

Withdrawal of consent does not affect communications that are necessary for the performance of a reservation, contract, payment, security or other service.

RIGHTS IN RELATION TO PERSONAL DATA

Subject to the conditions and limitations of the GDPR, individuals have the right:

• to access their personal data;

• to obtain a copy of the personal data being processed;

• to request rectification of inaccurate or incomplete data;

• to request erasure of their personal data where the legal conditions are met;

• to request restriction of processing;

• to data portability where the legal requirements are met;

• to object to processing based on legitimate interests;

• to object at any time to processing for direct marketing purposes;

• to withdraw their consent where processing is based on consent;

• to lodge a complaint with the competent supervisory authority and to seek judicial protection.

The right to erasure is not absolute. Certain data may continue to be retained where this is necessary for compliance with a legal obligation, for the establishment, exercise or defence of legal claims, or where another applicable legal basis exists.

Requests relating to personal data may be sent to: customer.service@topmobility.eu

The Company provides information on the action taken without undue delay and, as a rule, no later than one month from receipt of the request.

Where necessary, taking into account the complexity or number of requests, the period may be extended by up to two additional months, and the individual will be informed of this within the initial period.

Detailed information on the categories of personal data processed, the purposes and legal bases, recipients, retention periods, technologies used and the manner in which rights may be exercised is available in: Privacy and personal data protection policy.

VEHICLE RENTAL SERVICE POLICY

“MODUL” EOOD provides the “vehicle rental” service in compliance with the General Terms and Conditions, applicable safety requirements, contractual terms and objective criteria for the provision of the service.

The purpose is for the service to be provided in a consistent, safe and lawful manner, taking into account the interests of the customer and the need to protect the vehicles, property and the legal rights and interests of “MODUL” EOOD.

MAIN CONDITIONS FOR THE PROVISION OF THE SERVICE

Before providing a vehicle, circumstances relating to the following may be verified:

• the validity and compliance of the required documents;

• the identity and entitlement of the driver to drive;

• consistency between the data provided and the reservation made;

• compliance with the applicable financial conditions;

• the ability to provide the required deposit;

• applicable insurance conditions;

• the existence of conditions for the safe provision and use of the vehicle;

• the existence of outstanding contractual obligations;

• relevant circumstances from previous contractual relationships.

POSSIBLE DECISIONS

Depending on the specific case, “MODUL” EOOD may:

• provide the service under the standard terms;

• determine additional conditions or restrictions where this is justified;

• offer an appropriate alternative;

• refuse to provide the service where the applicable conditions are not met.

Decisions are based on objective circumstances relevant to the specific case and on the conditions for the provision of the service.

Where there are circumstances that require an assessment, the decision is made individually on the basis of the specific facts.

“MODUL” EOOD does not make decisions to provide or refuse the service solely on the basis of automated processing where such a decision produces legal effects concerning the individual or similarly significantly affects them.

The conditions for the provision of the service are applied without discrimination and in accordance with applicable legislation.

This information applies together with the General Terms and Conditions of “MODUL” EOOD.

REPORTS UNDER THE BULGARIAN PROTECTION OF PERSONS REPORTING OR PUBLICLY DISCLOSING INFORMATION ON BREACHES ACT

INTERNAL REPORTING CHANNEL

“MODUL” EOOD maintains an internal reporting channel under the Bulgarian Protection of Persons Reporting or Publicly Disclosing Information on Breaches Act.

The internal channel is intended for the submission of reports concerning breaches falling within the scope of the Act where the information about them became known to the reporting person in connection with their work or professional activity.

SUBMITTING A REPORT

A report may be submitted in writing or orally.

A written report may be submitted:

• by email: signal@topmobility.eu

• or to the business correspondence address: 269 Tsar Osvoboditel Blvd., Floor 3, Varna

An oral report may be submitted by telephone to the persons designated by “MODUL” EOOD as responsible for receiving and handling reports.

Person responsible for receiving and handling reports:

Plamen Danielov Peev

Tel.: +359 893 049 996

CONTENT OF THE REPORT

In order for a report to be reviewed, it should contain sufficient information enabling the nature of the alleged breach to be established and the necessary action to be taken.

Where applicable, the report may contain:

• details of the reporting person;

• details of the person or persons against whom the report is submitted, where known;

• a description of the breach or the actual risk of its occurrence;

• the place and period in which the breach occurred, where known;

• other specific circumstances that may assist the investigation;

• date of submission;

• contact details of the reporting person.

Documents, correspondence or other sources of information supporting the allegations made may be attached to the report.

Where the report is submitted orally, its content is documented in accordance with the established procedure.

RECEIPT AND HANDLING OF THE REPORT

Receipt of the report is acknowledged within 7 days of its receipt.

After receipt, it is checked whether the report falls within the scope of the Act and whether it contains the information necessary for its handling.

Where the report contains remediable irregularities or does not contain sufficient information for its handling, the reporting person may be informed that the necessary additional information should be provided within the period laid down by law.

During the handling of the report, additional information, documents and other relevant information necessary to establish the facts may be collected.

Reports are handled by the designated persons in compliance with the principles of objectivity, impartiality and confidentiality.

PROTECTION OF THE REPORTING PERSON AND CONFIDENTIALITY

The identity of the reporting person, the persons concerned and the other persons referred to in the report is protected in accordance with the requirements of applicable legislation.

Access to the report and the information related to it is restricted to the persons for whom this is necessary in connection with its receipt, handling and the taking of follow-up action.

Information that may directly or indirectly reveal the identity of the reporting person is not disclosed to other persons except in the cases provided for by law.

Personal data contained in the report and related documentation is processed only for lawful purposes relating to the receipt, handling and follow-up action concerning the report.

FOLLOW-UP ACTION

Where the circumstances set out in the report require an investigation, relevant documents, information and other evidence may be collected and assessed.

Where this is necessary for the objective establishment of the facts, information, explanations or evidence may be requested from the persons concerned or other persons, while respecting the protection of the reporting person.

Where, as a result of the investigation, information indicating a breach is established, “MODUL” EOOD takes the relevant follow-up action within the scope of its competence.

Where action by a competent state authority is necessary for the handling of the case or for bringing the breach to an end, the report or the relevant information may be provided or referred in accordance with the procedure laid down in applicable legislation.

FEEDBACK

The reporting person is provided with feedback on the action taken within the period provided for in the Bulgarian Protection of Persons Reporting or Publicly Disclosing Information on Breaches Act.

Where the handling of the report is discontinued or no follow-up action can be taken through the internal channel, the reporting person is informed in the cases provided for by law.

EXTERNAL REPORTING CHANNEL

The reporting person may also use the external reporting channel to the competent national authority in accordance with the Bulgarian Protection of Persons Reporting or Publicly Disclosing Information on Breaches Act.

The use of the internal channel does not restrict the reporting person’s rights to use an external channel or public disclosure where the conditions laid down by law are met.

ADDITIONAL INFORMATION

The detailed internal procedure for registering, documenting, handling and taking follow-up action on reports is applied by the persons designated for this purpose.

Information on the processing of personal data in connection with reports is provided in accordance with the applicable personal data protection rules.