Privacy Policy

1. Data Controller

"Auto Aleya" Ltd., Company No. 204751128, Sofia, 21-vi vek St. 23, fl. 1, ap. 3, is the data controller within the meaning of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"). For questions regarding your personal data, you can contact us at office@autoaleya.bg or by phone at 0886 303 333.

2. What Data We Collect

• First and last name
• Date of birth (to verify the minimum driver age for rental)
• Email address and phone number
• Booking details: selected vehicle, dates, and pickup/return location
• Flight information and booking notes (if provided by the customer)
• Payment information — processed directly by the bank providing the payment service; the Company does not have access to your full card number
• Technical data collected when visiting the website (e.g. via cookies — see our Cookie Policy)

3. Purposes of Processing

• Performance of the car rental agreement and processing of your booking
• Communication regarding your booking (confirmation, changes, support)
• Compliance with legal obligations (accounting, taxation)
• Improving our website and services

4. Legal Basis

We process your personal data on the basis of contract performance (Art. 6(1)(b) GDPR), legal obligation (point (c)), and in certain cases — your explicit consent (point (a)), for example when consenting to cookies other than strictly necessary ones.

5. Retention Period

Data related to bookings and payments is retained for the period required by Bulgarian accounting and tax legislation (typically 10 years), after which it is deleted or anonymized.

6. Disclosure to Third Parties

Your personal data may be shared with: the bank processing payments (solely for payment-processing purposes); the Company's website hosting provider; the Company's accounting service provider. We do not sell or rent your personal data to third parties for marketing purposes.

7. Your Rights

Under the GDPR, you have the right to:

• access your personal data;
• correct inaccurate data;
• request erasure of your data ("right to be forgotten"), to the extent this does not conflict with a legal retention obligation;
• restrict processing;
• data portability;
• object to processing;
• withdraw any given consent at any time.

To exercise these rights, contact us at office@autoaleya.bg. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP, cpdp.bg).

8. Cookies

Our website uses cookies to improve functionality and analyze traffic. For details, please see our Cookie Policy.