Privacy Policy

1. Data Controller

"Auto Aleya" Ltd., Company No. 204751128, Sofia, 21-vi vek St. 23, fl. 1, ap. 3, is the data controller within the meaning of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"). For questions regarding your personal data, you can contact us at office@autoaleya.bg or by phone at 0886 303 333.

2. What Data We Collect

• First and last name
• Date of birth (to verify the minimum driver age for rental)
• Email address and phone number
• Booking details: selected vehicle, dates, and pickup/return location
• Flight information and booking notes (if provided by the customer)
• Messages you write to the AI chat assistant on the website (we recommend not entering personal or card details in the chat)
• Payment information — processed directly by the bank providing the payment service; the Company does not have access to your full card number
• Technical data collected when visiting the website (e.g. via cookies — see our Cookie Policy)

3. Purposes of Processing

• Performance of the car rental agreement and processing of your booking
• Communication regarding your booking (confirmation, changes, support)
• Compliance with legal obligations (accounting, taxation)
• Answering your questions and helping you choose a car through the AI chat assistant
• Improving our website and services

4. Legal Basis

We process your personal data on the basis of contract performance (Art. 6(1)(b) GDPR), legal obligation (point (c)), and in certain cases — your explicit consent (point (a)), for example when consenting to cookies other than strictly necessary ones. Your messages to the AI chat assistant are processed at your request for information before entering into a contract (point (b)) and on the basis of our legitimate interest in answering customers' questions quickly (point (f)).

5. Retention Period

Data related to bookings and payments is retained for the period required by Bulgarian accounting and tax legislation (typically 10 years), after which it is deleted or anonymized. Messages sent to the AI chat assistant are not saved in the website's database.

6. Disclosure to Third Parties

Your personal data may be shared with: the bank processing payments (solely for payment-processing purposes); the Company's website hosting provider; the Company's accounting service provider; the AI service provider (Anthropic), to which messages written in the website chat are sent solely to generate a reply (the provider may process data outside the European Economic Area). We do not sell or rent your personal data to third parties for marketing purposes.

7. Your Rights

Under the GDPR, you have the right to:

• access your personal data;
• correct inaccurate data;
• request erasure of your data ("right to be forgotten"), to the extent this does not conflict with a legal retention obligation;
• restrict processing;
• data portability;
• object to processing;
• withdraw any given consent at any time.

To exercise these rights, contact us at office@autoaleya.bg. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP, cpdp.bg).

8. Cookies

Our website uses cookies to improve functionality and analyze traffic. For details, please see our Cookie Policy.