Privacy policy

The data controller is EVO LAKSHARI OOD (trade name: EVO LUXURY OOD; in Bulgarian: „ЕВО ЛАКШЪРИ“ ООД), UIC (ЕИК) 208565345, with its registered office at 3 Brashlyan Street, 1619 Sofia, Bulgaria, hereinafter “EVO LUXURY”. For any question about your data: [email protected] or +359 87 982 6819.

EVO LUXURY has not appointed a data protection officer; the question has been submitted to our lawyer.

• Booking: surname and first name, email address, phone number, contact language, handover location and details (address, hotel, flight number), vehicle, dates, amounts, payment and deposit methods, and proof of your acceptances (version of the general terms and conditions, language, date and time, text of the boxes ticked).
• Client account: email address, name, phone number, contact language, favourite vehicles, history of your rentals and, if you have given it, your consent to receive our offers, with its date. The login code is stored only in hashed form, for 10 minutes at most.
• Payment: card payment goes through Stripe Payments Europe; we do not receive your full card details, only the result of the payment.
• Vehicle handover: we check the originals of your driving licence and identity document and record only the necessary information and the result of the check, without copies. The only exception: a copy of the licence, made solely to declare the driver in the event of an electronic fine, as provided by law (Article 189(4) of the Bulgarian Road Traffic Act); it is encrypted, access to it is restricted and it is kept for a short time.
• Inspection reports: time-stamped photos and videos of the vehicle, at handover and at return.
• Communications: your messages by email, phone, WhatsApp or Viber.
• Browsing: your IP address and technical connection data (browser, pages requested), processed by our hosting provider and by Cloudflare to route and protect the website’s traffic.
• Vehicle location: if a vehicle is equipped for it, its position is consulted only in the event of reported theft, late return or a border crossing, never continuously or to measure your speed. No camera or microphone in the passenger compartment.

The website uses no audience measurement or advertising tools (section 8).

• To conclude and perform the rental contract: booking, payment, handover and return, deposit, cancellation, complaints (Article 6(1)(b) GDPR).
• To comply with our legal obligations: accounting and tax, declaring the driver in the event of a fine, responding to the authorities (point (c)).
• To manage your client account and the loyalty discount, which you request by creating your account (point (b)).
• To send you our offers by email, only with your consent, which you can withdraw at any time (point (a)).
• To prove and defend our rights (inspection reports, proof of your acceptances, disputes), to secure the website and your account (single-use codes, limited number of attempts) and to protect our vehicles (location only in the cases set out in section 2): legitimate interest of EVO LUXURY (point (f)).

Your name, email address and phone number are required to book: without them, booking is not possible. Everything else is optional.

No decision producing legal effects concerning you is taken solely on the basis of automated processing: the loyalty discount follows a public rule, the same for everyone, and the recipients of our offers are chosen by a person.

• the members of the EVO LUXURY team who need it, including the delivery driver who hands the vehicle over to you;
• our processors, bound by contract and only for their task: Fly.io (hosting of the website and database, in a data centre located in Paris, in the European Union), Cloudflare (DNS, encrypted HTTPS connection, caching and traffic protection) and Brevo (Sendinblue SAS, France; sending of emails: login codes, confirmations, cancellations);
• Stripe Payments Europe, for card payments; Stripe acts in part as an independent controller, under its own privacy policy;
• our accountant and our lawyer, bound by confidentiality, and the vehicle’s insurer in the event of an incident;
• public authorities (police, tax administration, courts), where required by law.

If you write to us via WhatsApp or Viber, or if you choose to collect the vehicle (we then send you the address on WhatsApp, to the number given when booking, unless you prefer a text or an email), these services also process your messages, under their own rules. We never sell your data.

Your data is hosted in the European Union, in a Fly.io data centre located in Paris; Brevo is a French company. Fly.io and Cloudflare are US companies: data they process may be accessed from, or pass through, the United States, under the EU–US Data Privacy Framework or standard contractual clauses. Stripe Payments Europe may transfer payment data to the United States under the Data Privacy Framework.

• Booking and contract: during the rental, then 5 years after it ends (limitation period, Article 110 of the Bulgarian Obligations and Contracts Act); accounting documents (invoices, receipts), for the periods set by Article 12 of the Bulgarian Accountancy Act.
• Login code: 10 minutes at most, single-use.
• Copy of the licence (electronic fine): 30 days after the end of a rental without incident; longer only as long as a fine or a dispute remains possible.
• Client account and rental history: deleted 3 years after your last activity (last login or last rental), except the booking data the law requires us to keep; you may request the deletion of your account at any time, with the same exception.
• Consent to receive our offers: valid only once you have confirmed your email address (link sent by email); kept until it is withdrawn, then for as long as needed to prove that it was given.
• Cookies: the periods in section 8.

At the end of these periods, the data is deleted or anonymised.

You may request access to your data, its rectification, its erasure, the restriction of its processing and its portability, and object to processing based on our legitimate interest. You may withdraw your consent to receive our offers at any time, from your client account or by a simple message, without effect on the prior period.

Write to us at [email protected]: we verify your identity, then reply within one month, which may be extended by two months for a complex request (Article 12(3) GDPR).

You may also refer the matter to the Commission for Personal Data Protection (КЗЛД): cpdp.bg.

The website uses only cookies that are strictly necessary for it to function; it contains no audience measurement tool, no advertising and no third-party content that tracks you. Fonts are served by the website itself.

• evx_lang: the language you have chosen, for the duration of the visit;
• evx_session: your login to the client account, until the browser is closed, or 30 days if you choose to stay signed in;
• evx_favs: the vehicles added to favourites without being logged in, 30 days; they are transferred to your account when you log in.
• Cloudflare security cookie (for example __cf_bm): it may be set to tell visitors apart from bots; it expires after 30 minutes of inactivity and is not used for tracking.

If an audience measurement tool is ever added, it will only work with your prior consent.

The website uses an encrypted connection; login codes are stored only in hashed form; access to the data is restricted to the people who need it.

Each version of this policy has a number and a date; in the event of a significant change, we will inform you.