Privacy Notice

Privacy Statement

This Privacy Statement outlines how we gather, utilize, and safeguard your information. It also provides guidance on how to reach out to us should you have any inquiries; we are always eager to assist! If you’re curious about our use of cookies and related technologies, please check out our Cookie Policy.

We may update this Notice periodically, so we encourage you to review it regularly to remain informed.

Our platform delivers a variety of online transportation solutions, including products and services, via our official websites, mobile apps, emails, and SMS messaging (‘platforms’). We extend these services through our partners’ websites, social media, and other channels. This Notice applies to all personal information gathered during our service interactions or when you contact us via email, chat, phone, or mail.

Our business partners can also refer to our Privacy and Cookie Policy section to understand how personal data is handled in our business collaborations.

Personal Data You Provide

To assist you with your order or provide a quote, we need specific details. When you initiate an order or make a request, we will ask for essential information to facilitate your desired service. This information typically includes your name, age, date and place of birth, as well as contact details (email, mailing address, and phone number). Additionally, you may need to share your passport, ID, driver’s license details, loyalty program ID, and payment information.

Moreover, we gather data from your device when you access our platforms, even if you do not place an order. This data can include your IP address, browser type, and language preferences. There are instances where we might obtain information from third-party sources or automatically collect other types of data. This constitutes the core set of data we collect. Would you like to learn more?

We store and utilize the information you provide. During your order process, we will need to collect your name, email address, and payment details. Additional requests may include your home address, phone number, date of birth, and names of other drivers, if applicable.

If you reach out to us—via phone, email, or social media—we will also gather information about you.

After your booking is finalized, we may solicit your feedback to enhance our services and ensure that future clients enjoy an excellent experience.

There are various ways to provide us with information. For example, if you browse using a mobile device, sharing your current location helps us deliver superior service. To streamline your service experience, you may create a user account, allowing you to track and manage your orders, save personal preferences, and facilitate future bookings.

Personal Data of Others You Provide

You have the option to add another driver or place an order on behalf of someone else, such as a friend, family member, or colleague. By doing this, you must ensure that the individual is aware of this action, understands, and consents to our use of their information (as detailed in this Notice). This responsibility rests with you.

Automatically Collected Personal Data

When you place an order, we record which platform you used and how you accessed it (e.g., through another site).

Even without a booking, we may automatically collect information when you explore our platforms. This could encompass your IP address, the pages visited, the browser employed, and data regarding clicks and viewed pages. We also gather details about your operating system, application version, language preferences, device settings, and characteristics that identify your device.

If you are using a mobile device, we may collect location data as well. We can assess and process the basic data linked to the apps on your device (like name, description, and category).

Personal Data From Other Sources

We might receive information regarding you from social networking sites, our business associates, subsidiaries within the avacar.bg group, and other external parties. For example:

• We partner with affiliated businesses to provide our services on alternate platforms. When you place a booking on one of these platforms, we may share your personal details with them, which they may then share with us.
• Agencies that provide services booked through our platforms may be required to share your information with us—for instance, if your booking leads to an insurance claim or customer dispute.
• Our business partners may also provide us with your information so we can present you with relevant advertisements.

We can merge this data with what you provide directly.

For further details, please consult the section, “What Purposes Do We Collect and Utilize Your Personal Data?”

Purposes for Collecting and Using Your Personal Data

We gather your personal information to facilitate your car rental (and additional services tied to your booking) and guarantee you receive quality service. We also utilize this data to reach out to you with information regarding our latest offerings and transactions. These serve as key purposes for which we collect your personal data, among others. Interested in more specifics?

How We Utilize Your Personal Data

Your personal information may be utilized in the following situations:

1. Bookings: We primarily use your personal details to process and manage your bookings and relay necessary information to the car rental company (or other services such as insurance) you’ve requested. This includes sending you messages related to your booking, like confirmations, updates, and reminders.
2. Customer Assistance: We offer around-the-clock international customer support in 40 different languages. Our global customer service team requires your information to assist with your order or answer any inquiries you may have before, during, or after your booking.
3. Feedback Collection: We may use your contact information to invite you to participate in a brief survey about your car rental experience. Your feedback is invaluable in helping us enhance our services and those provided by our partners.
4. Account Management: To enhance your user experience on our site, you have the option to create an account. We utilize the data you supply to manage your account, allowing you access to helpful features. You can oversee bookings or purchases, make use of special offers, and alter personal settings. This streamlines the process for future orders.
5. Marketing Initiatives: We also leverage your personal data for marketing objectives, which might include:
   • Contacting you via mail, phone, email, or SMS (based on the contact details you provided), with updates on our latest news, special promotions, discounts, and other developments encompassing our products and services (including those from affiliated companies). You can easily opt out of these marketing communications by clicking the “unsubscribe” link within any email or visiting our Data Request Portal.
   • Contacting you by phone, email, or SMS with information about additional insurance products that were not specified during booking.
   • Displaying current offers on our platforms or on external sites, such as social networking sites, and inviting participation in promotional activities (like referral programs or contests).
6. Communication: There might be situations when we reach out to you through phone, email, or SMS. These communications may arise for various reasons, including:
   • Addressing and managing any inquiries you’ve made.
   • If your online booking is incomplete, we might remind you to finalize it. We believe this additional prompt will assist you in completing your booking without needing to search again or re-enter your personal information.
   • Once you utilize our services, we could send you a questionnaire or an invitation to share your rental experience.
   • We’ll send you additional information related to your booking, such as how to reach us (or another company) if you require assistance.
   • Furthermore, we provide summaries of your past orders.
   • Additional administrative notifications that might include security alerts, even if you don’t have an active booking.
7. Market Research: We might invite you to participate in market research. Any extra information you provide during this research will only be utilized with your permission.
8. Fraud Prevention: To ensure secure and reliable service, we use your personal data to identify and deter fraudulent activities or other illegal actions. We may also engage your data for risk assessment and security measures, which can include user verification and bookings, potentially leading to the suspension of some orders.
9. Enhancing Our Services: We analyze personal data for the purpose of improving the functionality and quality of our online platforms and enriching the overall user experience. We are continuously striving to make our platforms more user-friendly and enjoyable.
10. Customer Input: Following your booking, we may invite you to evaluate our services or those of our partners. Your insights will assist future customers in making informed decisions and will provide valuable input to our business partners for service enhancements. By providing feedback, you consent to its publication as described in our Terms. You can submit a review anonymously or indicate your name and country.
11. Call Monitoring: We may record calls or permit other staff members to listen for the purpose of employee training and ensuring quality service. Recorded calls are maintained for a limited duration and deleted automatically unless there is a legal reason to retain them longer (such as to investigate fraud).
12. Legal Matters: In certain cases, we might require your personal data for managing and resolving legal disputes, as well as to comply with authority requests and applicable regulations, thereby ensuring that our terms are accurate.

Your provision of personal data to our organization is optional. However, if you wish to access specific types of services, it necessitates the submission of certain personal data. For instance, we cannot process your booking without your name and contact details.

In circumstances where we utilize automated means of gathering personal data that could have legal effects or significant implications for you, we will enforce appropriate measures to safeguard your rights and freedoms, including your right to intervention.

Legal Bases for Processing Information

• Contract Fulfillment: We depend on your personal data to fulfill any agreements you have with us. For example, when you book a vehicle, we need to share your booking information with the rental company to ensure your car is ready on time.
• Legitimate Interests: We may utilize your information to pursue our “legitimate interests,” which involves actions we deem vital for the effective functioning of our business while respecting your rights and complying with the law. This includes providing you with relevant content on our platforms, including our emails and newsletters; improving and promoting our products and services; as well as administrative activities.
• Consent: We may rely on your consent to use your personal information in specific scenarios, such as for direct marketing endeavors. You can withdraw your consent at any time through our Data Request Portal or by sending an email to info@avacar.bg with “Privacy” in the subject line.

Third-Party Data Transfers and Their Purposes

We involve various business partners in the services we offer, and under particular circumstances, we share your personal information with third parties. In most instances, we simply relay your booking details to the business partners aiding us in delivering your requested service. We may also share your data with additional third parties, including payment service providers, advertising partners, affiliates of the avacar.bg corporate group, and sometimes governmental authorities. Here are the primary reasons for sharing your personal data. Would you like further insights?

• Car Rental Suppliers: To process an order, we must send pertinent details to the companies providing your vehicle and/or other related services (such as insurance) that you’ve requested. This information could consist of your name, age, contact details (email, home address, phone number), date and place of birth, passport details, driver’s license information, and any preferences shared at booking time. Should there be a dispute regarding your booking, insurance coverage, or any other customer service concern, we will be required to convey relevant information regarding your booking process, which may include copies of booking confirmations and any details associated with your complaint. Please note that the information you share directly with the car rental providers will be governed by their respective privacy notices and practices.
• Business Partners: We collaborate with business partners globally. Some partners promote or advertise our services and assist others in marketing their own rental industry-related services (including insurance). When you book on a partner’s platform, we receive some personal information you provided to them. Likewise, we share booking-related personal data with our partners to assist them in analyzing their businesses or managing loyalty programs. They may also send you tailored offers, provided you have given consent. If a partner is responsible for customer support, we will forward your booking details to them to ensure you receive necessary assistance. In all these scenarios, the processing of your personal information is governed by the privacy policies of our partners. When placing an order on a partner’s website, please take the time to review their privacy policy to understand how they manage your data. When you acquire products or services from our partners, we transmit the personal information they need to deliver those services. We might also share user information with partners for fraud detection/prevention, but only at their explicit request.
• Authorities: We may transfer your personal information to authorities or investigative bodies in compliance with legal obligations (or other legal requirements). These obligations can encompass court orders, subpoenas, and requests stemming from legal or criminal inquiries. We might also disclose personal information if needed to forestall, detect, or prosecute criminal activities. Additionally, we may share personal details with authorities to protect our rights, as well as the rights of our business partners or property.
• Third-Party Service Providers: We may engage third-party service providers to process your personal data on our behalf and assist in delivering our services. These providers may help us contact you, relay booking information from transportation service partners, or manage our website, call centers, or marketing initiatives. We might also use third-party service providers for market research and fraud prevention, including anti-fraud measures. These providers are bound by confidentiality agreements and cannot use your personal data for purposes other than those specified above.
• Advertising Partners: We may share your email address and other personal information with third-party advertising partners to ensure you receive relevant advertising while we market our services through third-party partners. We also collaborate with advertising networks to promote services on alternate platforms and engage third-party agencies for analytical research. We maintain strict confidentiality agreements with all such parties to prevent the use of your personal information beyond the outlined purposes. For more information regarding personalized ads and your choices, see “How and Why We Use These Technologies?” and “Your Choice: Accept or Reject” found in our Cookie Policy.
• Payment Service Providers: We may work with third-party payment service providers to ensure payments are processed securely. Should you (or the cardholder used during booking) seek a refund, we may need to furnish certain booking details to the payment provider and the relevant financial institution. This might include a copy of your booking confirmation or the IP address utilized to place the order. We may also share relevant information with financial entities to help detect or avert fraud.

The transfer of personal data in accordance with this privacy notice may occur internationally, potentially in locations where personal data protection laws differ from those in the UK or the EU. When required by UK regulations, we only transfer personal data to recipients who offer reliable protection. This involves entering agreements to confirm that the protection of your personal data meets UK and EU standards. You can request copies of these agreements by contacting us using the details provided below.

Mobile Device Usage

We provide free applications for various mobile devices, along with optimized versions of our standard website for mobile and tablet users. These tools gather and process your personal data in the same manner as our other platforms; they facilitate locating nearby car rental locations based on your current position. Would you like more information?

If you consent, we can send push notifications directly to your mobile device to keep you updated about your bookings. Additionally, if you agree to provide us access to your device’s location or contact details, we can offer enhanced services upon your request. Instructions for enabling push notifications and granting us access to this data are available on your mobile device.

To improve service quality and deliver more relevant marketing, we might utilize a method known as “cross-device tracking.” This allows us to assess how you engage with our platforms across multiple devices; for example, we could mix data from your smartphone and desktop. This practice pertains to cookie usage (for more information on cookies and similar technologies, please refer to our Cookie Policy).

To ensure you find the newsletter offers most pertinent to you, we analyze your search behavior and booking activities across connected devices after logging into your account. If you prefer to opt out, simply log out of your account before browsing or unsubscribe from our newsletter.

Cross-device tracking can also lead to personalized ads appearing on a single device, based on your actions across connected devices. Opting out of the NAI behavioral advertising program can stop this process (further instructions can be found in our Cookie Policy under the “Your Choice: Accept or Reject” section). Please note: logging out of your account does not halt this tracking.

Security Measures for Your Personal Information

Our organizational systems and protocols are designed to guarantee comprehensive protection of your personal data against misuse or unauthorized access in alignment with UK and European data protection regulations. We implement specific procedures and security measures (both technical and physical) that limit access to and use of any personal data we retain. Access to personal data is restricted to authorized personnel, and even then, solely for valid, legitimate purposes.

We will keep your data for as long as deemed necessary for Service utilization, to provide you with services, maintain your account (if any), adhere to applicable laws, resolve disputes among parties, etc., as well as to conduct our business, including fraud detection or prevention of illegal activities. This privacy statement encompasses all personal data we collect.

Children’s Personal Data

We do not extend services to anyone under the age of 18, and we reserve the right to erase any information received from individuals below this age. We may come across children’s information in specific scenarios, such as in insurance matters or customer service disputes. In these instances, we will only collect and utilize such information with the consent of the child’s parent or guardian.

Managing Your Personal Information

You possess the right, subject to certain legal stipulations, to access, correct, or delete any personal information we hold about you. You can utilize our Data Objects Access Portal to exercise any of these rights. When you do so, we will require additional information to verify your identity to ensure security, processing your requests in accordance with applicable UK data protection laws. You can update or delete your account at any time by logging into our site.

During the ordering process, we inquire whether you wish to receive marketing communications. You may opt out at any given moment by clicking the “unsubscribe” link in any of these marketing emails or adjusting your email preferences within your user account.

Data Controller Information

Avacar 2000 Ltd. is responsible for the processing of personal data on its platforms. Avacar 2000 EOOD is a limited liability company formed according to Bulgarian legislation, with its offices located at Varna G. Popov 23. For any inquiries, concerns, or complaints regarding our operations or this privacy notice, please email info@avacar.bg, specifying “Privacy” in the subject. We are always ready to listen and respond promptly. You may also contact your local data protection authority.

Privacy Notice for Avacar 2000 EOOD

• Essential information

How We Utilize Your Personal Information

This privacy notice outlines how we gather, utilize, transmit, and safeguard your personal data. Should there be any changes to this notice in the future, we will promptly inform you through our website.

Your Rights Regarding Your Personal Data

In line with Bulgarian legislation, you hold various rights concerning the personal data processed by Avacar 2000 EOOD:

• Access and receive a copy of your personal data handled by Avacar 2000 EOOD;
• Rectify any inaccuracies or complete any lacking information in your personal data;
• Request the deletion of your data under the applicable conditions;
• Demand restrictions on the handling of your personal data where legally permitted;
• Object to the processing of your personal data under certain legal grounds;
• Enjoy your right to data portability by requesting your data in a structured, commonly used, and machine-readable format;
• If processing is based on your consent, you may withdraw that consent at any time without incurring any costs;
• File a complaint with the Commission for Personal Data Protection.

For detailed information about how to exercise your rights, please refer to the “Policy for the Exercise of the Rights of Personal Data Subjects” by Avacar 2000 EOOD, available on our website and in our offices.

How to Reach Us?

Feel free to contact us at our address: Varna, Mladost 109 Email: info@avacar.bg

1. Handling of your personal data

Making Reservations (via the office, phone, or online):

What personal data do we collect?

• Your full name
• Contact number
• Email address
• Date of birth
• Residential address
• Company or organization name (if billing is required)
• Details of your bank card – card number and CVV (if opting for prepaid or full online payment)
• Other information as provided in the “Comment” section (if ordering the service online).

Reasons for collecting your personal data

We gather information to deliver the most tailored and optimal service possible, along with adhering to legal obligations dictated by Bulgarian law. Your personal information may be maintained and utilized for the following purposes:

• To facilitate car rentals – whether through our office, over the phone, or via online platforms.

What is the legal basis for collecting your personal data?

• Your consent for processing your personal data in relation to your car rental.
• Our legitimate interest in sharing data with contractual partners for the maintenance of our website or for providing accounting services.

Duration of personal data retention

• If a booking fails due to the unavailability of a vehicle during the desired timeframe, Avacar 2000 EOOD will eliminate and refrain from storing or processing your booking data.

Potential recipients of your personal data

We could share your personal information with:

• Contractual partners;
• Accounting firms handling billing requests;
• Companies responsible for website maintenance and related functionalities.

Post-Reservation Confirmation and Car Rental Agreement:

• Subsequent to reservation confirmation, a voucher will be issued containing the data you entered into the booking form.
• To finalize a car rental agreement, you must provide:
• A scanned or physical copy of a valid driver’s license.
• The bank card details (number and CVV) used for the deposit for the rental service.
• Your car rental agreement will encompass:
• Full names
• Unique civil number / Date of birth
• Valid identification number
• The driver’s license number and its expiration date
• Contact number
• Email address
• Bank card details including the card number and CVV, which may be charged for any vehicle damage or electronic fines (as per Article 189 of the Road Traffic Act).
• By signing the car rental agreement, you agree that the personal data shared for the contract’s conclusion may be utilized in legal actions or prosecutions.

Purpose of collecting your personal data

We gather this information to ensure we provide you with top-notch and personalized services, as well as fulfill our obligations under Bulgarian law. Your personal information may be preserved and used for the following reasons:

• To offer you our “car rental” service via concluding a lease agreement.
• To facilitate transaction processing related to car rentals.
• To comply with mandatory disclosures to governmental authorities.

What legal bases support our collection of your personal data?

• Your consent related to personal data processing.
• Execution of the contract you are part of, along with any preparatory actions before the contract is finalized.
• Our legitimate interest involves sharing contractual partner data for website maintenance or accounting purposes.
• Legal grounds applicable when there is a mandate to provide your personal data to public entities.

Duration of personal data retention

• Your personal data will be retained for 4 years and 6 months, per Article 82, paragraph 4 of the Administrative Offenses and Penalties Act and Articles 80 and 81 of the Criminal Code concerning Article 189 of the Road Traffic Act. Upon expiry of this retention period, data stored electronically will be deleted, and physical records will be destroyed.

Potential recipients of your personal data

Your personal information may be disclosed to:

• Government agencies authorized to request personal data;
• Contractual partners;
• Accounting firms assisting with billing requests;
• Software development firms managing the maintenance or functionalities of the website.

Feedback form on our website

What personal data do we collect?

• Your full name
• Email address
• Contact number
• Additional information based on what you enter in the “Your request” section.

Reasons for collecting your personal data

• To provide thorough responses to your inquiries.

What is the legal basis for collecting your personal data?

• Your consent for processing your personal data.
• Our legitimate interest in sharing data with software development firms supporting our website.

Duration of personal data retention

• Your personal data will only be kept for the duration necessary to address your inquiry. In instances involving legal matters or disputes, we may retain your data for up to 5 years following the submission of your request.

Potential recipients of your personal data

Your personal information could be transferred to:

• Software development companies ensuring the upkeep of our website and its functionalities.

Rules for Exercising the Rights of Personal Data Subjects

These rules (the “Rules”) define the framework within which individuals whose personal data are processed by Avacar 2000 EOOD can assert their rights per personal data protection legislation.

Part 1: General Principles

• Avacar 2000 EOOD processes and safeguards personal data collected during operations transparently, lawfully, and aligned with the purposes for which the data was initially gathered.
• Employees handling personal data while executing their duties at Avacar 2000 EOOD adhere to the following principles:

i) Personal data is processed both lawfully and in good faith.
(ii) Data is collected for precise, clearly defined, and legitimate purposes, and is not further processed inconsistently with those objectives.
(iii) Personal data gathered and managed concerning human resources must be current, relevant, and not exceed the intended purposes.
iv) Personal data must be accurate and updated as necessary.
(v) Data must be deleted or rectified if found inaccurate or disproportionate to the processing goals.
(vi) Personal data shall be kept in a format that identifies the subjects only for as long as necessary for the reasons for which the data was collected.

• Staff who handle personal data undergo initial and ongoing training regarding confidentiality and relevant legal compliance.

Part 2: Definitions

The terms defined here have the following meanings:

“Personal Data” refers to any information related to an individual that is or can be identified directly or indirectly through identifiers such as name, identification number, location data, online identifier, or one or more characteristics unique to the physical, physiological, genetic, mental, intellectual, economic, cultural, or social identity of the individual;

“Applicable Law” refers to both the law of the European Union and the Republic of Bulgaria relating to the protection of personal data;

“Profiling” pertains to any automated processing of personal data aimed at assessing personal aspects that relate to an individual, notably analysis or forecasting aspects relevant to the person’s work performance, economic conditions, health, preferences, interests, reliability, behavior, location, or movements;

“Data Subject” indicates an individual who can be identified either directly or indirectly, especially through identifiers like name, identification number, location data, online identifiers, or other characteristics specific to the individual’s identity;

“Regulation (EU) 2016/679” indicates Regulation (EU) 2016/679 by the European Parliament and the Council dated April 27, 2016, concerning the protection of individuals regarding personal data processing and the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation), published in the Official Journal of the European Union on May 4, 2016.

Part 3: Rights of Personal Data Subjects

Data subjects hold the following rights concerning their personal data:

i) Right of access;
(ii) Right to rectify;
(iii) Right to data portability;
iv) Right to erasure;
v) Right to be forgotten;
vi) Right to request restrictions on processing;

**Right of Access**

Upon request, Avacar 2000 EOOD will inform the data subject whether their personal data is being processed and provide the following information:
i) Whether Avacar 2000 EOOD processes personal data;
(ii) A copy of the personal data being processed by Avacar 2000 EOOD;
(iii) An explanation of the data being processed.

2.2. The explanation outlined in Article 2.1(iii) includes:
(i) Processing objectives;
(ii) Relevant categories of personal data;
(iii) Recipients or categories of recipients who will receive or have received access to personal data, particularly those in third countries or international organizations;
(iv) Whenever feasible, the expected duration of personal data retention and, if not possible, the criteria for determining that duration;
(v) The right to rectify or erase personal data, or to restrict or object to the processing of personal data relating to the data subject;
(vi) The right to lodge a complaint with the supervisory authority;
(vii) If personal data were not collected from the data subject, any available information regarding their source;
(viii) The availability of automated decision-making, including whether the processing involves profiling and details about the logic applied, along with the significance and anticipated consequences of such processing for the data subject;
(ix) If personal data is transmitted to a third country or internationally.

• The information regarding processed data is provided by Avacar 2000 EOOD through privacy notices.

 

• Upon the data subject’s request, Avacar 2000 EOOD may offer a copy of the processable personal data.
• When providing such a copy, Avacar 2000 EOOD must not disclose:
• (i) Personal data pertaining to third parties, unless explicit consent has been provided;
• (ii) Data classified as trade secrets, intellectual property, or confidential information;
• (iii) Any other information protected by applicable law.
• Access to personal data is not permissible if it infringes on the rights and liberties of third parties or violates a regulatory obligation of Avacar 2000 EOOD.

4.1. If access requests are blatantly unreasonable or excessive, especially due to their repetitive nature, Avacar 2000 EOOD may impose a reasonable fee based on the administrative costs incurred, or refuse to accommodate the access request.

4.2. Avacar 2000 EOOD evaluates each case to determine if a request is indeed unreasonable or excessive.

4.3. In the event of refusal to grant access to personal data, Avacar 2000 EOOD will provide justification for the refusal and inform the data subject of their right to appeal to the CPDP.

**The Right to Rectification**

5.1. Data subjects may request corrections to their personal data if it is found to be inaccurate or incomplete.

5.2. Once a rectification request is approved, Avacar 2000 EOOD will inform other recipients who have received this data (such as government agencies or service providers) about the changes made.

**The Right to Erasure (“Right to be Forgotten”)**

• Upon request, Avacar 2000 EOOD must delete personal data if any of the following conditions are met:
• (i) The personal data is no longer necessary for the purposes for which it was collected or processed;
• (ii) The data subject revokes consent on which processing is based, and there is no other legal basis to continue processing;
• (iii) The data subject objects to the processing and no valid legal grounds exist for processing that outweigh the objection;
• (iv) The data subject contests the processing of personal data intended for direct marketing;
• (v) The personal data was processed illegally;
• (vi) The personal data must be deleted to comply with legal obligations placed on Avacar 2000 EOOD;
• (vii) The personal data was collected while providing information society services to children per Article 8(1) of Regulation (EU) 2016/679.

Avacar 2000 EOOD has no obligation to erase personal data if processing is necessary for:

• (i) Exercising the right to freedom of expression and information;
• (ii) Compliance with legal obligations imposed on Avacar 2000 EOOD;
• (iii) Public interest reasons, especially in public health as outlined in Article 9(2)(h) and (i) and Article 9(3) of Regulation (EU) 2016/679;
• (iv) Archiving purposes in the public interest for scientific or historical research, or statistical reasons under Article 89(1) of Regulation (EU) 2016/679. The right to erasure might obstruct or severely hinder such processing; or
• (v) Establishing, enforcing, or defending legal proceedings.

**The Right to Request Processing Restrictions**
Data subjects have the right to request limitations on processing if one of the following conditions is satisfied:

• (i) if the data subject disputes the accuracy of the personal data; restrictions will apply while the controller verifies the accuracy;
• (ii) if the processing is unlawful, yet the data subject prefers that personal data not be erased but that its use be limited;
• (iii) if Avacar 2000 EOOD no longer requires personal data for processing purposes, but the data subject needs them for the establishment, exercise, or defense of legal claims;
• (iv) if the data subject challenges the processing based on Avacar 2000 EOOD’s legitimate interest, while an investigation is pending to determine whether the controller’s legal basis outweighs the data subject’s interests.
• When the data subject requests a restriction on processing and any conditions cited in Article 7.1 apply, Avacar 2000 EOOD will inform them before withdrawing the restriction.

 

Avacar 2000 EOOD may process data for which processing has been restricted only for the following purposes:

• (i) For the purpose of storage.
• (ii) With the consent of the data subject;
• (iii) To establish, exercise, or defend legal claims;
• (iv) To protect the rights of another individual; or
• (v) For compelling reasons of public interest.
• When the data subject requests restrictions on processing and adheres to any conditions cited in Article 7.1, Avacar 2000 EOOD will inform them in advance of any changes made to the restriction status.

**Right to Data Portability**

8.1. The data subject possesses the right to obtain their personal data shared with Avacar 2000 EOOD in a structured, commonly used, and machine-readable format.

8.2. This data can also be transferred to another controller indicated by the data subject if such transfer is technically feasible.

8.3. The right to portability can be exercised in these situations:

• (i) if processing relies on the data subject’s consent;
• (ii) if processing is tied to contractual obligations;
• (iii) if the processing occurs automatically.

8.4. The right to portability must not interfere with the rights and freedoms of others.

**Right to Object**

• The data subject has the right to contest the processing of their personal data by Avacar 2000 EOOD, if data is processed on any of the following grounds:
• (i) processing is essential for performing a task concerning the public interest or exercising official authority vested in the controller;
• (ii) processing is necessary for purposes relating to the legitimate interests of Avacar 2000 EOOD or a third party;
• (iii) data processing entails profiling.
• Avacar 2000 EOOD will cease to process personal data unless it can demonstrate that compelling legal grounds prevail over the interests, rights, and freedoms of the data subject or for the establishment, enforcement, or defense of legal claims.

**Right to Object to Processing Personal Data for Direct Marketing**

10.1. When personal data is processed for direct marketing, the data subject may object to such processing, including profiling connected to direct marketing, at any time.

10.2. Upon objection to processing for direct marketing, such processing must be terminated.

**Right to Human Intervention in Automated Decision-Making**

11.1. In scenarios where Avacar 2000 EOOD makes decisions automatically—regardless of whether these decisions derive from profiling—with legal ramifications or significant impacts on the affected individual, they may request a reevaluation of the decision through human intervention and express their perspective.

11.2. Avacar 2000 EOOD will furnish individuals subjected to automated decision-making with essential details about the logic used, along with the implications and expected outcomes of such processing.

Part 4: Procedure for Exercising the Rights of Personal Data Subjects

12.1. Personal data subjects can exercise their rights as outlined in these Rules by submitting a request for the specific rights they wish to exercise.

12.2. Requests related to personal data rights can be submitted through the following methods:

• i) Electronically via the following email address ***
• ii) In person at the Avacar 2000 EOOD office
• iii) By postal mail to the head office address of Avacar 2000 EOOD: ****

12.3. The request to exercise personal data rights must include:

• i) Identity verification—name and unique identification number
• ii) Contact information—address, phone number, email
• iii) Your request—a clear description of your inquiry

12.4. Avacar 2000 EOOD will acknowledge the actions taken in response to the rights request within one month from receipt of the request.

12.5. If necessary, this time frame may be extended for an additional two months, factoring in the complexity and volume of requests from a given individual. Avacar 2000 EOOD will notify the individual of any such extension within one month of receiving the request, explaining the delay reasons.

12.6. Avacar 2000 EOOD is not obliged to respond to requests if the data subject’s identity cannot be verified.

12.7. In cases where there are valid concerns regarding the identity of the requester, Avacar 2000 EOOD may require further information to confirm the identity of the data subject.

12.8. For requests sent electronically, Avacar 2000 EOOD aims to provide information in an electronic format, unless the individual requests otherwise.