“MODUL” EOOD respects the right to privacy and processes the personal data of natural persons in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”), the Bulgarian Personal Data Protection Act and other applicable legislation.
This Privacy Policy aims to provide clear and accessible information about:
• what personal data “MODUL” EOOD processes;
• the sources from which such data may be obtained;
• the purposes for which such data is used;
• the legal basis on which the processing is carried out;
• when the provision of data is necessary;
• to whom the data may be disclosed;
• whether the data may be transferred outside the European Economic Area;
• how long the data is retained;
• how the data is protected;
• what rights individuals have and how they may exercise them.
The Policy applies to the processing of personal data in connection with all services and activities of “MODUL” EOOD, regardless of the manner in which the interaction with the individual takes place – at Company premises, by telephone, by email, through a website, mobile application, customer account, booking intermediary, corporate customer or in another manner.
This Policy applies to customers, potential customers, drivers, additional drivers, users of electronic services, representatives and contact persons of corporate customers and counterparties, purchasers, lessees, cardholders and other natural persons making payment for a service, visitors to the Company’s premises and other natural persons whose personal data is processed in connection with the Company’s activities.
Separate or additional information, reflecting the specifics of the respective processing, is provided to workers and employees, job applicants and persons whose data is processed in connection with the internal reporting channel under the Bulgarian Protection of Persons Reporting or Publicly Disclosing Information on Breaches Act.
The data controller is:
“MODUL” EOOD
UIC: 103846775
Registered office and management address: Aksakovo, Chanlaka locality, Property ID 00182.45.47
“MODUL” EOOD has appointed a Person Responsible for Personal Data Protection.
For matters relating to the processing and protection of personal data, as well as the exercise of rights under the GDPR, individuals may contact the Person Responsible for Personal Data Protection at:
Email: signal@topmobility.eu
Correspondence address: 269 Tsar Osvoboditel Blvd., Floor 3, Varna
When processing personal data, “MODUL” EOOD complies with the principles of:
• lawfulness, fairness and transparency;
• purpose limitation;
• data minimisation;
• accuracy and keeping data up to date;
• storage limitation;
• integrity and confidentiality;
• accountability.
Personal data is collected and used only for specified, explicit and lawful purposes and is not processed in a manner incompatible with those purposes.
The Company seeks to process only personal data that is necessary and relevant to the specific service, legal relationship or other lawful purpose.
The specific type and volume of personal data depend on the service, the legal relationship and the manner in which the individual interacts with “MODUL” EOOD.
The Company may process the following main categories of personal data:
Names, date of birth, nationality and the necessary data from an identity document, including the type of document, number, expiry date, issuing authority and other data necessary to identify the individual.
The Company does not create a copy or image of an identity card or passport solely for the purpose of identification, unless there is a lawful necessity and an applicable legal basis in the specific case.
Data from a driving licence, including information necessary to establish the identity of the driver, the validity of the document, the categories of vehicles the person is entitled to drive and the existence of the required driving entitlement.
Address, telephone number, email address and other contact details provided.
Information relating to:
• a reservation made;
• selected vehicle or category;
• rental period and location;
• selected services and additional conditions;
• price;
• reservation status;
• changes, cancellation or no-show;
• channel or intermediary through which the reservation was made;
• other information necessary for the performance of the reservation.
Information relating to:
• the concluded agreement;
• the vehicle used;
• period and conditions of use;
• drivers;
• handover and return of the vehicle;
• mileage;
• fuel or charge level;
• additional equipment;
• selected services and coverages;
• handover and return documentation;
• amounts charged and other circumstances relating to the performance of the agreement.
Information relating to:
• payments made and amounts due;
• deposits;
• payment authorisations;
• refunds;
• bank transfers;
• invoices and other payment documents;
• status and references of payment transactions;
• limited data relating to the payment instrument used where this is necessary in connection with a specific transaction or agreement.
Data relating to:
• the condition of the vehicle upon handover and return;
• identified missing items or damage;
• photographs;
• reports;
• damage assessment;
• repairs carried out;
• relevant documents and correspondence.
Information relating to:
• a road traffic accident or other accident;
• date, place and circumstances;
• participants and witnesses;
• vehicles;
• reports;
• photographs;
• insurance claims;
• correspondence with insurers, repair service providers, experts and competent authorities;
• other relevant information.
Where the specific case contains health data or other special categories of personal data, such data is processed only to the extent necessary and where an applicable legal basis exists.
Information relating to:
• a specific vehicle;
• the period during which it was used;
• the person who drove it;
• an established or alleged violation;
• a request or act received from a competent authority;
• the response provided and the related documentation.
Contractual, payment, identification and other relevant data in connection with:
• complaints and objections;
• disputed payment transactions;
• receivables;
• voluntary or compulsory collection of amounts;
• judicial and out-of-court disputes;
• protection of the rights and legitimate interests of the Company or the individual.
Vehicles may generate data relating to:
• location;
• date and time;
• movement;
• vehicle identification;
• other telematics parameters depending on the functionality of the system used.
Where a telephone call is recorded, the voice and content of the conversation, telephone number, date, time and other related technical information may be processed.
In the course of video surveillance, video images, the date and time of the recording and other technical information generated by the system are processed.
Information about the signatory, the document, the date and method of signing, as well as technical data necessary to verify the signing performed and the integrity of the document.
Information relating to:
• registration and user account;
• identification and login;
• reservations and services used;
• preferences and settings;
• actions performed within the account;
• communications through the electronic service;
• other data necessary for the provision and protection of the account.
IP address, technical and online identifiers, device identifiers, browser and operating system information, data from cookies and similar technologies, system and security logs and other technical information.
Information relating to:
• consent provided;
• date and method of provision;
• selected communication channel;
• preferences;
• subsequent change;
• refusal or withdrawal of consent;
• objection to direct marketing.
The content of enquiries, requests, complaints, objections and other communications, including communications and information provided during the reservation process, as well as documents provided in connection with them.
In most cases, personal data is obtained directly from the individual.
Depending on the specific service or legal relationship, data may also be obtained from:
• a person who has made a reservation on behalf of another driver;
• a corporate customer or its representative;
• a booking intermediary, travel agent or other partner;
• an insurer;
• a repair service provider or expert;
• a bank or payment institution;
• a competent state, administrative, police or judicial authority;
• vehicle location and telematics systems;
• websites, mobile applications and other electronic services;
• other lawful sources.
Where personal data has not been obtained directly from the individual, “MODUL” EOOD provides the required information regarding the processing in the cases and within the time limits provided for by applicable legislation.
The data is processed for:
• accepting and managing the reservation;
• providing information about the requested service;
• verifying whether the applicable conditions can be met;
• preparing the provision of the service;
• communicating with the individual before entering into the contract.
Legal basis: Article 6(1)(b) GDPR – taking steps at the request of the individual prior to entering into a contract.
Where the reservation is completed, the relevant information becomes part of the documentation relating to the contractual relationship.
Where the reservation is cancelled or is not completed, limited information may be retained in order to establish the actions taken and for protection in the event of potential claims.
Legal basis for subsequent retention: Article 6(1)(e) GDPR – the Company’s legitimate interest in establishing and proving the pre-contractual steps taken and protecting its rights in the event of a dispute.
The data is processed for:
• identifying the customer and the driver;
• establishing the required driving entitlement;
• entering into the agreement;
• providing the vehicle;
• administering additional services;
• performing the agreed conditions;
• accepting the vehicle following completion of the rental;
• determining the parties’ final obligations;
• communication in connection with the performance of the agreement.
Legal basis: Article 6(1)(b) GDPR – performance of a contract.
Following the final completion of the agreement, the necessary documentation may be retained for protection against subsequent claims.
Legal basis for subsequent retention: Article 6(1)(e) GDPR – legitimate interest in the establishment, exercise and defence of legal claims.
Personal data is processed for:
• payment for the agreed services;
• receiving and identifying payments by bank transfer;
• administering online payments made by third parties;
• carrying out payment authorisations;
• securing the agreed deposit;
• subsequent release or collection of amounts where a contractual basis exists;
• refunding amounts;
• verifying the transactions carried out.
“MODUL” EOOD processes only the payment information necessary for the respective transaction and contractual relationship.
Legal basis: Article 6(1)(b) GDPR – performance of a contract.
Where the cardholder is a party to the agreement, Article 6(1)(b) GDPR – performance of a contract – applies to the processing of the data necessary for payment.
In the case of an online payment made by another natural person who is not a party to the agreement, the necessary data of the payer is processed on the basis of Article 6(1)(e) GDPR – legitimate interest in receiving, identifying and administering the payment.
Where payment documentation is required to be retained for accounting or tax purposes, the processing is carried out for compliance with a legal obligation.
Personal data is processed where this is necessary for the performance of the Company’s obligations under applicable legislation, including in connection with:
• accounting;
• invoicing;
• taxation;
• financial control and inspections;
• provision of information required by law to competent authorities;
• other statutory obligations.
Legal basis: Article 6(1)(c) GDPR – compliance with a legal obligation.
The data is processed for:
• establishing the condition of the vehicle;
• documenting missing items and damage;
• determining contractual liability;
• determining amounts due;
• processing the necessary documentation relating to the case.
Legal basis: Article 6(1)(b) GDPR – performance of a contract.
Where a dispute or claim arises, the relevant information may additionally be processed for the protection of the parties’ legal rights.
Legal basis: Article 6(1)(e) GDPR – legitimate interest.
Data may be processed for:
• establishing the circumstances of the accident;
• documenting the event;
• communication with insurers;
• communication with repair service providers, experts and other participants;
• making and handling claims;
• protecting rights in connection with the event.
Legal basis: Article 6(1)(e) GDPR – legitimate interest in establishing the circumstances and protecting the Company’s legal rights and property interests.
Where the law requires a specific action or the provision of information, the processing is carried out on the basis of compliance with a legal obligation.
Upon receipt of a lawful request from a competent authority, “MODUL” EOOD may process and disclose the necessary data in order to identify the person who drove a specific vehicle during the relevant period.
Only the data that is relevant and necessary for the fulfilment of the specific request is disclosed.
Legal basis: Article 6(1)(c) GDPR – compliance with a legal obligation.
Personal data is processed for:
• answering questions;
• assistance with a reservation;
• servicing an existing agreement;
• providing information about the service;
• resolving a specific issue;
• subsequent communication regarding the case.
Where the communication relates to a reservation or agreement, the legal basis is Article 6(1)(b) GDPR – performance of a contract.
Where a complaint, objection or other claim is submitted, all relevant data and documents necessary for the following may be processed:
• establishing the facts;
• carrying out an investigation;
• providing a response;
• protecting the rights and legitimate interests of the parties.
Legal basis: Article 6(1)(e) GDPR – legitimate interest.
Where specific legislation provides for a particular obligation to review or retain certain information, the respective legal basis also applies.
Data may be processed in connection with:
• disputed payment transactions;
• proving the basis and amount of a payment made;
• establishing outstanding obligations;
• voluntary collection of receivables;
• judicial or enforcement proceedings;
• protection against claims by a customer or third parties.
Legal basis: Article 6(1)(e) GDPR – legitimate interest in the establishment, exercise and defence of legal claims and receivables.
Certain telephone calls with “MODUL” EOOD are recorded for the purposes of monitoring and improving the quality of service.
Before recording begins, the individual is informed that the call is being recorded.
Legal basis: Article 6(1)(e) GDPR – legitimate interest in monitoring and improving the quality of service.
The recordings are not used for activities incompatible with this purpose unless there is a separate applicable legal basis.
Video surveillance is carried out at the premises of “MODUL” EOOD and the areas adjacent to them for:
• protection of customers, employees and other persons;
• protection of property;
• protection of vehicles;
• prevention and detection of incidents and unlawful actions.
Video surveillance is not used for purposes incompatible with the stated security purposes.
Only authorised persons have access to the recordings.
Legal basis: Article 6(1)(e) GDPR – legitimate interest in ensuring the security of persons and property.
The Company’s vehicles are equipped with location and telematics systems.
The data may be used for:
• protection and security of the vehicle;
• fleet management;
• determining the location of a vehicle where necessary;
• detecting improper or unauthorised use;
• establishing relevant circumstances in the event of an incident or dispute;
• protecting the Company’s legal rights and property interests.
Legal basis: Article 6(1)(e) GDPR – legitimate interest.
Location data is not used arbitrarily and access to it is restricted according to the business need and the specific purpose.
When an agreement or another document is signed electronically, the data necessary for the following is processed:
• identifying the signatory;
• carrying out the signing;
• linking the signature to the relevant document;
• verifying the time and method of signing;
• protecting the integrity and evidential value of the signed document.
Legal basis: Article 6(1)(b) GDPR – performance of a contract where the signing forms part of entering into or performing that contract.
Where the specific method used involves processing special categories of personal data, such processing is carried out only where the applicable additional legal requirements and safeguards are in place.
When creating and using a customer account, personal data is processed for:
• creating and managing the account;
• providing requested functionalities;
• managing reservations;
• accessing information about services used;
• retaining settings;
• protecting the account;
• preventing unauthorised access and misuse.
Processing necessary for the provision of the requested electronic service is carried out on the basis of Article 6(1)(b) GDPR – performance of a contract.
Processing necessary for the protection of information security is carried out on the basis of Article 6(1)(e) GDPR – the Company’s legitimate interest in protecting its electronic services and user accounts.
Where the agreement is concluded with a legal entity, personal data may be processed relating to:
• legal or authorised representatives;
• contact persons;
• employees;
• drivers;
• other natural persons designated by the corporate customer.
The data is used for establishing, maintaining and performing the contractual and business relationship with the corporate customer.
Legal basis: Article 6(1)(e) GDPR – the parties’ legitimate interest in carrying out the relevant contractual and business relationship.
Where a natural person is a party to an agreement, the legal basis for performance of a contract applies.
Personal data of natural persons who are counterparties, as well as of representatives and contact persons of legal entities, may be processed for entering into, performing and managing the respective contractual and business relationships.
Where the natural person is a party to an agreement:
Legal basis: Article 6(1)(b) GDPR – performance of a contract.
For representatives and contact persons of legal entities:
Legal basis: Article 6(1)(e) GDPR – legitimate interest in carrying out the contractual and business relationships.
When a vehicle is leased or sold, identification, contact, contractual, payment and other data necessary for the following may be processed:
• preparing the transaction;
• entering into and performing the agreement;
• making payments;
• transferring rights;
• complying with legal obligations;
• proving and protecting the rights of the parties.
The legal basis is determined according to the specific purpose – performance of a contract, compliance with a legal obligation or legitimate interest in the defence of legal claims.
The websites, mobile applications and other electronic services of “MODUL” EOOD may use cookies and similar technologies, including SDKs, pixels, local storage, device identifiers and other technical means.
They may enable information to be stored on or retrieved from the device used, recognition of a browser, device or user session, and the collection of information regarding actions performed while using the electronic service.
Where the information obtained constitutes personal data, it is processed in accordance with this Policy.
The technologies used are mainly divided into:
• essential cookies and similar technologies;
• analytics and improvement technologies;
• marketing and personalisation technologies.
Essential technologies are used to ensure:
• the technical functioning of the service;
• maintenance of a user session;
• reservation functionalities;
• login and authentication;
• security;
• prevention of misuse;
• retention of settings;
• retention of the privacy choices made;
• other functions expressly requested by the user.
Prior consent is not required for strictly necessary technologies where the applicable legal conditions are met.
Where personal data is processed through such technologies, the applicable legal basis under the GDPR is determined according to the specific purpose.
Where the necessary consent has been provided, technologies may be used for:
• measuring the use of the services;
• analysing interaction with functionalities;
• identifying technical problems;
• analysing effectiveness;
• creating statistical information;
• improving electronic services.
Legal basis: Article 6(1)(a) GDPR – consent.
Where consent has been provided, technologies may be used for:
• personalising content;
• personalising offers;
• analysing interests and interactions;
• measuring the effectiveness of advertising campaigns;
• providing more relevant marketing information;
• other specifically described marketing functions.
Legal basis: Article 6(1)(a) GDPR – consent.
These technologies are not activated before the necessary consent has been obtained.
The user may:
• accept optional technologies;
• reject them;
• select individual categories;
• change the choices made;
• withdraw consent.
Rejecting optional technologies does not prevent the use of the core functionalities for which they are not necessary.
Up-to-date information is maintained for the specific cookies and similar technologies used, containing, where applicable:
• name;
• category;
• purpose;
• provider;
• duration or retention period;
• other information necessary for an informed choice.
The current technical list of cookies and similar technologies used is provided through “Privacy Settings” and contains, where applicable, the name, category, purpose, provider and duration or retention period.
Where the individual has provided the relevant consent, “MODUL” EOOD may use their contact details to send information concerning:
• services;
• special offers;
• promotions;
• campaigns;
• new products and services;
• other marketing information.
Legal basis: Article 6(1)(a) GDPR – consent.
Consent is voluntary and may be withdrawn at any time.
Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Where the individual objects to processing for direct marketing purposes, their personal data is no longer processed for that purpose.
Messages that are necessary for a reservation, performance of a contract, payment, security or other service do not constitute marketing communications solely because they are sent by email, SMS, mobile application or another electronic channel.
Where data is necessary for taking steps prior to entering into a contract, entering into or performing a contract, or complying with a legal obligation, failure to provide such data may result in it being impossible:
• to make or fulfil a reservation;
• to establish the identity or driving entitlement of the driver;
• to enter into an agreement;
• to provide a vehicle;
• to carry out a payment transaction;
• to provide a requested additional service;
• to fulfil a statutory obligation of the Company.
Where processing is based on consent, the provision of data for the respective purpose is voluntary.
Refusal or withdrawal of consent does not affect the provision of a service for which the respective processing is not necessary.
Personal data is not disclosed to other persons without a legal basis.
Where an applicable legal basis exists and to the extent necessary for the respective purpose, data may be disclosed to:
• state and administrative authorities;
• authorities of the Ministry of Interior;
• courts and other judicial authorities;
• tax and other supervisory authorities;
• banks and payment institutions;
• insurers;
• repair service providers and experts;
• lawyers;
• enforcement agents;
• auditors and other professional advisers;
• booking intermediaries;
• corporate partners;
• providers of information and communication services;
• providers of hosting and technical infrastructure;
• electronic signature service providers;
• other persons where this is necessary for a specific lawful purpose.
Where an external party processes personal data on behalf of and according to the instructions of “MODUL” EOOD, that party acts as a data processor.
Where the recipient independently determines the purposes and means of processing, it may act as a separate data controller.
Disclosure of personal data does not require consent in all cases. The specific disclosure must be based on an applicable legal basis under the GDPR.
Where, in connection with a provider, partner or technical service used, personal data is transferred outside the European Economic Area, “MODUL” EOOD applies the requirements of Chapter V of the GDPR.
Transfers are carried out only where an applicable international transfer mechanism and the necessary safeguards are in place.
Where applicable, the individual may obtain information about the transfer mechanism used and the relevant safeguards.
“MODUL” EOOD does not apply a single retention period to all personal data.
The retention periods are determined according to:
• the purpose of the processing;
• statutory retention periods;
• the duration of the contractual relationship;
• the need to establish and protect rights and claims;
• the duration of any proceedings;
• the principle that personal data should not be retained for longer than necessary.
The main retention periods are:
| Category of data/documents | Retention period |
|---|---|
| Completed reservations | According to the retention period applicable to the related contractual documentation |
| Cancelled and unfulfilled reservations | 2 years |
| Rental agreements and related contractual documentation | 5 years from the final completion of the contractual relationship |
| Payment and authorisation documentation forming part of the agreement | According to the retention period applicable to the contractual documentation, unless a longer statutory period applies |
| Accounting and tax documentation | According to the applicable statutory retention periods |
| Damage, accidents and insurance events | 5 years from the final completion of the case, unless proceedings are ongoing |
| Violations and correspondence with competent authorities | 5 years from completion of the case, unless the proceedings require longer retention |
| Disputed payments, receivables and legal claims | Until the final completion of the case and expiry of the applicable subsequent period |
| Complaints and objections | 5 years from the final completion of the case |
| Video recordings | Up to 30 days |
| Separate video recording relating to a specific incident | Until the final completion of the case and until the need for retention ceases |
| Recordings of telephone calls | 2 months |
| Customer accounts | 5 years of inactivity |
| Correspondence and customer service relating to a reservation or agreement | Retained for the period applicable to the respective reservation or contractual documentation |
| Marketing data | Until withdrawal of consent or earlier termination of the purpose |
| Data relating to marketing consent given or withdrawn / opt-out | 5 years after termination of the respective marketing processing |
| Data and documents relating to electronic signing | According to the retention period applicable to the document to which they relate; technical data – according to the method used and the purpose |
| Essential cookies and similar technologies | According to the duration of the specific technology |
| Cookies and technologies for analytics, marketing and personalisation | According to the duration of the specific technology or until withdrawal of consent, where applicable |
| GPS and telematics data | For a period determined according to the purposes of the processing and the technical configuration of the system |
| System and security logs | For a predetermined period according to the specific system and information security needs |
| Corporate customers, suppliers and other contractual relationships | 5 years from the final completion of the respective legal relationship, except for documents subject to a longer statutory period |
| Leasing and sale of vehicles | 5 years from the final completion of the legal relationship, except for documents subject to a longer statutory period |
Where, before expiry of the applicable period, a dispute, claim, inspection, administrative, judicial or other proceedings arise, the relevant data may be retained until the final completion of the case and for the applicable subsequent period.
Once the purpose has ceased and the applicable retention period has expired, personal data is erased, destroyed or anonymised, unless another legal basis exists for its retention.
The principle of storage limitation is one of the fundamental requirements of the GDPR.
“MODUL” EOOD does not make decisions to provide or refuse a service solely on the basis of automated processing where such a decision produces legal effects concerning an individual or similarly significantly affects them.
When assessing the conditions for the provision of a service, objective circumstances relating to the following may be taken into account:
• the specific reservation;
• compliance with the conditions for provision of the service;
• the ability to provide the required deposit;
• outstanding obligations;
• previous contractual relationships;
• established violations or damage;
• other objective circumstances relevant to the specific case.
Where these circumstances are used in making a decision, an individual assessment is carried out.
If a system for automated decision-making within the meaning of Article 22 GDPR is introduced, affected individuals will be provided with the additional information and safeguards provided for by applicable legislation.
“MODUL” EOOD applies appropriate technical and organisational measures taking into account:
• the nature of the data processed;
• the volume of processing;
• the purposes;
• the technologies used;
• the likelihood and severity of the risks to individuals.
The measures include, where applicable:
• restricting access to personal data;
• individual access rights;
• user authentication;
• protection of information systems and devices;
• protection of electronic communications;
• protection of premises and documents;
• control over the disclosure of data;
• backup and recovery;
• logging and tracking of actions, where applicable;
• procedures for managing personal data breaches;
• employee training and confidentiality obligations;
• periodic review of the measures applied.
Access to personal data is provided only to persons who need it for the performance of their functions and only to the necessary extent.
Detailed technical configurations and measures, the public disclosure of which could reduce the level of security, are not published.
Rights are exercised subject to the conditions and limitations laid down in the GDPR and applicable legislation.
The individual has the right to obtain confirmation as to whether “MODUL” EOOD processes their personal data and, where this is the case, to obtain access to such data and to the information regarding the processing provided for by law.
The individual also has the right to obtain a copy of the personal data undergoing processing, subject to the rights and freedoms of other persons.
The individual has the right to request the rectification of inaccurate personal data and the completion of incomplete data.
Where necessary to verify the requested change, appropriate additional information may be requested.
The individual may request the erasure of their personal data where the conditions provided for by law are met.
The right to erasure is not absolute.
Data is not erased where its retention is necessary, for example:
• for compliance with a legal obligation;
• for the establishment, exercise or defence of legal claims;
• where another applicable legal basis exists.
Where the legal requirements are met, the individual has the right to request restriction of the processing of certain personal data.
Where processing is based on consent or a contract and is carried out by automated means, the individual may, subject to the conditions laid down by law, receive the data they have provided in a structured, commonly used and machine-readable format.
Where technically feasible, the individual may request that the data be transmitted directly to another controller.
Where processing is based on a legitimate interest, the individual may object to such processing on grounds relating to their particular situation.
In such a case, processing is discontinued unless the Company demonstrates compelling legitimate grounds for continuing the processing or the data is necessary for the establishment, exercise or defence of legal claims.
The individual may at any time object to the processing of their personal data for direct marketing purposes.
Where such an objection is made, the data is no longer processed for that purpose.
Where processing is based on consent, consent may be withdrawn at any time.
Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Where the rules on automated individual decision-making apply, the individual has the rights and safeguards provided for by the GDPR, including, where applicable, the right to obtain human intervention, to express their point of view and to contest the decision.
The individual has the right to lodge a complaint with the competent supervisory authority and to seek judicial remedy in accordance with the procedure provided for by law.
A request relating to personal data may be submitted to “MODUL” EOOD or to the Person Responsible for Personal Data Protection.
Email: customer.service@topmobility.eu
Email of the Person Responsible for Personal Data Protection: signal@topmobility.eu
Correspondence address: 269 Tsar Osvoboditel Blvd., Floor 3, Varna
Use of a specific form is not mandatory for exercising rights.
The request must make it possible to establish which right the individual wishes to exercise and the processing to which the request relates.
Where there are reasonable doubts concerning the identity of the applicant, “MODUL” EOOD may request additional information necessary to confirm their identity.
The Company provides information on the action taken without undue delay and no later than one month from receipt of the request.
Where necessary, taking into account the complexity or number of requests, this period may be extended by up to two additional months. The individual is informed of the extension and the reasons for it within the initial one-month period.
Where “MODUL” EOOD does not take action on the request, the individual is informed of the reasons and of the possibility of lodging a complaint with the competent supervisory authority and seeking judicial remedy.
The time limits and general rules for communication when exercising rights are laid down in Article 12 GDPR.
The exercise of rights is free of charge. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, “MODUL” EOOD may, subject to the conditions of applicable legislation, charge a reasonable fee taking into account the administrative costs or refuse to act on the request.
Where the request is submitted electronically, the information is provided electronically where possible, unless the individual has requested another means of delivery.
Where an individual considers that the processing of their personal data infringes applicable legislation, they have the right to lodge a complaint with:
COMMISSION FOR PERSONAL DATA PROTECTION
as well as to use the applicable means of judicial remedy.
This Policy is reviewed and updated where necessary, including where there is a change in:
• applicable legislation;
• the services and activities of “MODUL” EOOD;
• the purposes of processing;
• the legal bases;
• the categories of personal data processed;
• the technologies used;
• the categories of recipients;
• international transfers;
• retention periods;
• other circumstances affecting the processing of personal data.
Where a material change is made, the updated information is provided in an appropriate manner.