Privacy Policy

Mandatory information on the rights of individuals regarding the protection of personal data (Privacy notice)

General information

As of May 25, 2018, the new General Data Protection Regulation (GDPR), adopted by the European Union, has come into force. The Regulation aims to ensure the protection of personal data for all individuals within the EU member states and to harmonize regulations regarding their processing.

As a personal data controller in the provision of services, “Right Rental” Ltd. complies with all requirements of the GDPR. The company collects only the data necessary for the provision of its services and stores it responsibly and lawfully.

This Personal Data Protection Policy applies to all individuals related to “Right Rental” Ltd., including but not limited to: employees, job applicants, clients, users, contractors, suppliers, subcontractors, business partners and/or their representatives, as well as other interested parties (e.g. individuals who have submitted a complaint, inquiry, request, or signal; users of the company’s website, etc.).

Any violation of the GDPR or the Bulgarian Personal Data Protection Act by an employee of “Right Rental” Ltd. will be treated as a breach of labor discipline. In cases where a criminal offense is suspected, the competent authorities will be notified.

Partners, subcontractors, and third parties working with or for “Right Rental” Ltd. who have or may have access to personal data are expected to be familiar with, understand, and comply with this Personal Data Protection Policy.

No third party may access personal data stored by “Right Rental” Ltd. without having first signed a written data confidentiality agreement. This agreement must impose obligations on the third party that are no less stringent than those undertaken by “Right Rental” Ltd. in its capacity as a personal data controller and must grant “Right Rental” Ltd. the right to audit the third party’s compliance with these obligations.

Basic concepts

“Personal Data” – means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

“Special Categories of Personal Data” (also known as “Sensitive Personal Data”) – refers to personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation.

“Processing” – means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means. This includes collecting, recording, organizing, structuring, storing, adapting or altering, retrieving, consulting, using, disclosing by transmission, dissemination or otherwise making available, aligning or combining, restricting, erasing, or destroying data.

“Controller” – means a natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

“Data Subject” – means any natural person whose personal data is processed by the Controller.

“Consent of the Data Subject” – means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes, by a statement or by a clear affirmative action, signifying agreement to the processing of personal data relating to him or her.

“Profiling” – means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, particularly to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

“Personal Data Breach” – means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored, or otherwise processed.

“Main Establishment” – for a controller with establishments in more than one EU Member State, the main establishment is the place where the principal decisions regarding the purposes and means of data processing are made. For a processor, the main establishment will be its central administration in the EU.

“Recipient” – means a natural or legal person, public authority, agency, or any other body to whom personal data is disclosed, whether or not they are a third party. Public authorities that may receive personal data in the course of a specific investigation in accordance with Union or Member State law are not considered “recipients”.

The processing of these data by the aforementioned public authorities must comply with the applicable data protection rules according to the purposes of the processing.

“Third Party” – means any natural or legal person, public authority, agency, or body other than the data subject, the data controller, the data processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

Information Regarding the Data Controller

Name: “Right Rental” Ltd.
UIC: BG131051951
Registered Office and Address: Sofia 1220, Sofia Municipality, Nadezhda District, “Lomsko Shose” Blvd. No. 228A
Business Address: Sofia 1220, Sofia Municipality, Nadezhda District, “Lomsko Shose” Blvd. No. 228A
Correspondence Address: Sofia 1220, Sofia Municipality, Nadezhda District, “Lomsko Shose” Blvd. No. 228A
Email: office@rightrental.net
Phone: 070 014 700

Information Regarding the Competent Supervisory Authority

Name: Commission for Personal Data Protection
Administrative Address: Sofia 1592, “Prof. Tsvetan Lazarov” Blvd. No. 2
Correspondence Address: Sofia 1592, “Prof. Tsvetan Lazarov” Blvd. No. 2
Phone: 02 915 3 518
Email: kzld@government.bg, kzld@cpdp.bg
Website: www.cpdp.bg

“”Right Rental” Ltd. operates in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 (GDPR) of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons in relation to the processing of personal data and on the free movement of such data.

Grounds for collecting, processing and storing your personal data

Article 1. (1) “Right Rental” Ltd. collects and processes your personal data in connection with the provision of services, marketing and advertising information, correspondence prior to entering into contracts, and entering into contracts with the company based on Article 6(1) of Regulation (EU) 2016/679, and specifically based on the following:

  • Explicit consent obtained from you as a client;
  • Fulfillment of obligations by “Right Rental” Ltd. under a contract with you;
  • Compliance with a legal obligation applicable to “Right Rental” Ltd.;
  • For the purposes of the legitimate interest of “Right Rental” Ltd.

(2) “Right Rental” Ltd. is the data controller with respect to your data as users of our services. With regard to the personal data you process when using our services, “Right Rental” Ltd. acts as the data processor.щ лични данни.


Purposes and principles for collecting, processing and storing your personal data

Article 2. (1) “Right Rental” Ltd. collects and processes the personal data that you provide to us in connection with the use of our website and for entering into a contract with the company, performing a service(s), as well as registering for participation in our events, including for the following purposes:

  • Human resource management, payment of wages, and the fulfillment of related employer obligations such as withholding and paying health and social security contributions for employees, taxes, as well as other rights and obligations of “Right Rental” Ltd. as an employer;
  • Identification of the contracting party;
  • Registration of participants in events organized by “Right Rental” Ltd.;
  • Accounting purposes;
  • Statistical purposes;
  • Protection of information security;
  • Ensuring the execution of the contract for providing the relevant service;
  • Sending informational messages, notifications about changes in the service, recommendations for improving the use of our website, etc.;
  • Improving and personalizing the service by offering suitable renewal offers, events, and other products and services that may be of interest to you;
  • Selecting content to be displayed to you.

(2) “Right Rental” Ltd. follows the following principles when processing your personal data:

  • Lawfulness, fairness, and transparency;
  • Purpose limitation of processing;
  • Data minimization and relevance to the purposes of processing;
  • Accuracy and up-to-date information;
  • Storage limitation in relation to achieving the purposes;
  • Integrity and confidentiality of processing and ensuring an appropriate level of security for personal data.

(3) In processing and storing personal data, “Right Rental” Ltd. may process and store personal data for the purpose of protecting the following legitimate interests:

  • Fulfilling its obligations to the National Revenue Agency, the National Social Security Institute, the National Health Insurance Fund, the Ministry of the Interior, and other state and municipal authorities, as well as to the judicial authorities.


What types of personal data does “Right Rental” Ltd. collect, process and store?

Article 3.

(1) “Right Rental” Ltd. performs the following operations with personal data for the following purposes:

  • Conclusion and execution of a commercial transaction with a client or partner – The purpose of this operation is the conclusion and execution of a contract with a business partner or client and its administration.
  • Sending informational messages – The purpose of this activity is to manage the process of sending messages to clients related to improvements or changes in the services, in order to understand your needs and interests and serve you better.

(2) “Right Rental” Ltd. processes the following categories of personal data and information for the following purposes and on the following grounds:

  • Data: Your identifying data (name and surname, email address)
    • Purpose for which the data is collected: 1) To establish contact with the user and send information to them, including upon request – to send newsletters and promotional messages.
    • Ground for processing your personal data: Correspondence prior to the conclusion of a contract, as the acceptance of our “Privacy Policy” and the provision of services by us creates a contractual relationship between “Right Rental” Ltd. and you, based on which we process your personal data – Article 6, Paragraph 1, letter (b) of GDPR.
  • Additional data provided by you: If you wish to complete the feedback form, you may also provide a phone number.
    • Purpose for which the data is collected: To supplement the information for the user in the feedback form on the website.
    • Ground for processing the data: The acceptance of our “Privacy Policy” and the provision of services by us creates a contractual relationship between “Right Rental” Ltd. and you, based on which we process your personal data – Article 6, Paragraph 1, letter (b) of GDPR.
  • Other data processed by “Right Rental” Ltd.: When accessing our website and filling in the feedback form, “Right Rental” Ltd. collects data on the used IP address.
    • Purpose for which the data is collected: To improve the security of the service, localization of the interface, statistical and marketing research.
    • Ground for processing the data: The processing is necessary for the conclusion and execution of a contract under which the data subject is a party – Article 6, Paragraph 1, letter (b) of GDPR. Prior to the conclusion of the contract, the IP address is collected based on the legitimate interests of the controller – Article 6, Paragraph 1, letter (f) of GDPR.
  • Your data for issuing an invoice to a natural person: If you wish to receive an invoice as a natural person, you should provide your personal identification number (EGN).
    • Purpose for which the data is collected: To issue an invoice for the payment of a service performed by us through the use of our website.
    • Ground for processing your personal data: Upon the conclusion of a written contract, a contractual relationship is established between “Right Rental” Ltd. and you, based on which we process your personal data – Article 6, Paragraph 1, letter (b) of GDPR.

(3) “Right Rental” Ltd. does not collect or process personal data related to the following:

  • Revealing racial or ethnic origin;
  • Revealing political, religious, or philosophical beliefs, or membership in trade union organizations;
  • Genetic and biometric data, data related to sexual life or sexual orientation.

(4) “Right Rental” Ltd. processes sensitive data, specifically personal data regarding health condition, disability decisions, medical certificates, sick leave, and any related documentation, only to the extent necessary for the execution of its specific rights and obligations under labor and social security legislation.

(5) The personal data was collected by “Red Devil Catering” AD from the individuals to whom it pertains.

(6) The company does not carry out automated decision-making based on data.

Consent to the collection and processing of personal data

Article 4. (1) “Consent” in the context of Right Rental Ltd. means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes, expressed by a statement or a clear affirmative action, that signifies agreement for their personal data to be processed. The data subject may withdraw their consent at any time.

(2) Right Rental Ltd. will consider “consent” only in cases where the data subject has been fully informed about the planned collection and processing of their personal data and has expressed their consent voluntarily, without any pressure being exerted on them. Consent obtained under pressure or based on misleading information will not be a valid basis for data processing.

(3) Consent cannot be inferred from the lack of response to a message sent to the data subject. There must be active communication between Right Rental Ltd., as the data controller, and the data subject for consent to be valid. The controller must be able to prove that consent for data processing activities has been obtained through a completed and signed declaration or form, through explicit acceptance of a privacy notice, through ticking a consent box in an online form, or by any other means that allow a clear conclusion that the data subject has provided explicit informed consent for the processing of their personal data.

(4) For special categories of data, explicit written consent must be obtained in accordance with the “Procedure for Obtaining Consent for the Processing of Personal Data,” unless there is an alternative legal basis for processing.

(5) In most cases, consent for processing personal and special categories of data is routinely obtained by Right Rental Ltd. through standard consent documents (declarations/forms), such as when a new contractor, client, user, or supplier requests a quote, signs a contract or invoice, or during the recruitment of new staff, etc.


Period of storage of your personal data

Article 4. (1) Right Rental Ltd. retains your personal data for as long as necessary to achieve the purposes outlined in the “Personal Data Protection Policy,” to protect the legitimate interests of Right Rental Ltd., and to fulfill its legal obligations to government authorities and institutions. After this retention period has expired, Right Rental Ltd. takes the necessary measures to erase and destroy all your data without undue delay.

(2) Right Rental Ltd. will notify you if the retention period for your data needs to be extended in order to fulfill the objectives, execute the contract, or for the legitimate interests of Right Rental Ltd., or for any other purpose.

(3) Red Devil Catering Ltd. retains personal data that it is required to keep under applicable law for the specified duration, which may exceed the retention period for the provision of services or the execution of a contract.


Transfer of your personal data for processing

Article 5. (1) Right Rental Ltd. may, at its discretion, transfer some or all of your personal data to data processors for the purpose of processing in compliance with the requirements of Regulation (EU) 2016/679.

(2) Right Rental Ltd. will notify you in the event of its intention to transfer some or all of your personal data to third countries or international organizations.


Your rights in the collection, processing and storage of your personal data


Withdrawing consent to the processing of your personal data

Article 6. (1) If you do not wish all or part of your personal data to continue being processed by Right Rental Ltd. for a specific or all purposes of processing, you may withdraw your consent at any time by submitting a written request (Appendix No. 1) or by providing a free-text request.

(2) Right Rental Ltd. may ask you to verify your identity to confirm that you are the person to whom the data relates.

(3) Withdrawing your consent for the processing of personal data that is mandatory for the creation and maintenance of your registration to use the services will result in the deactivation of your account.

This gives you the ability to control the processing of your data while also understanding the consequences of withdrawing consent. Should you need further clarification or wish to proceed with any actions, feel free to reach out!


Right of access

Article 7. (1) You have the right to request and obtain from Right Rental Ltd. confirmation as to whether personal data related to you are being processed.

(2) You have the right to access the data related to you, as well as to information regarding the collection, processing, and storage of your personal data.

(3) Right Rental Ltd. will provide you, upon request, with a copy of the personal data being processed related to you, in electronic or another appropriate format.

(4) Providing access to the data is free of charge, but Right Rental Ltd. reserves the right to impose an administrative fee in case of repeated or excessive requests.

This section emphasizes your right to transparency and control over your personal data. Should you wish to exercise any of these rights, you can contact Right Rental Ltd. for further action. Let me know if you need help with anything else!


Right to correction or completion

Article 8
You have the right to correct or complete any inaccurate or incomplete personal data related to you by submitting a written request to Right Rental Ltd. (Appendix No. 4).

This provision ensures that you can maintain the accuracy of your personal data, which is essential for correct processing. If you notice any errors or incomplete information, you can request corrections through the proper channels outlined in the policy.


Right to erasure (“to be forgotten”)

Article 9
(1) You have the right to request the deletion of personal data related to you from Right Rental Ltd., and Right Rental Ltd. is obligated to delete them without undue delay when any of the following grounds apply:

  • The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
  • You withdraw your consent upon which the processing of the data is based, and there is no other legal basis for processing;
  • You object to the processing of your personal data, including for direct marketing purposes, and there are no legitimate grounds for processing that override your rights;
  • The personal data has been processed unlawfully;
  • The personal data must be deleted in order to comply with a legal obligation under EU law or the law of a Member State applicable to Right Rental Ltd.;
  • The personal data was collected in connection with the offering of information society services.

(Article 9 (2) and (3)
(2) Right Rental Ltd. is not obligated to delete personal data if it is being stored and processed for the following reasons:

  • To exercise the right to freedom of expression and the right to information;
  • To comply with a legal obligation that requires processing under EU law or the law of the Member State applicable to the Administrator, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Administrator;
  • For reasons of public interest in the field of public health;
  • For archiving purposes in the public interest, for scientific or historical research, or for statistical purposes;
  • For the establishment, exercise, or defense of legal claims.

(3) To exercise your “right to be forgotten,” you must submit a written request to Right Rental Ltd. (Appendix 2), and you will need to verify your identity and the identity of the person to whom the data relates by presenting your identity card in person at the Right Rental Ltd. office to an employee of the company for identification purposes.

(4) Right Rental Ltd. will not delete data that it is legally obligated to retain, including data required for defending against legal claims or for proving its rights.


Right to limitation

Article 10: Right to Restrict Processing

You have the right to request Right Rental Ltd. to restrict the processing of your personal data when:

  • You dispute the accuracy of the personal data, for a period that allows Right Rental Ltd. to verify the accuracy of the personal data;
  • The processing is unlawful, but you do not want your personal data to be deleted, only its use to be restricted;
  • Right Rental Ltd. no longer needs the personal data for processing purposes, but you require it for the establishment, exercise, or defense of legal claims;
  • You have objected to the processing, pending verification of whether the legitimate grounds of Right Rental Ltd.override your interests.

Right of portability

You have the right to download the data that is stored and processed about you in relation to using the services of Right Rental Ltd., by submitting a written request (Appendix No. 3) or by emailing the request.

You also have the right to request Right Rental Ltd. to directly transfer your personal data to another data controller of your choice, provided this is technically feasible (Appendix No. 3).


Right to receive information

Article 12: Right to Information about Recipients
You have the right to request Right Rental Ltd. to inform you about all recipients to whom the personal data, for which you have requested correction, deletion, or restriction of processing, has been disclosed. Right Rental Ltd. may refuse to provide this information if it is impossible or would require disproportionate efforts.


Right to object

According to Article 13 of the data protection policy, you have the right to object at any time to the processing of your personal data by Right Rental Ltd., including if the data is being processed for the purposes of profiling or direct marketing.

This means you can request that your personal data not be used for marketing activities or profiling purposes, and the company is obligated to respect this request, unless there are other legitimate reasons for continuing the processing.


Your rights in the event of a breach of your personal data security

According to Article 14 of the data protection policy:

  1. If Right Rental Ltd. identifies a security breach involving your personal data that could pose a high risk to your rights and freedoms, they are obligated to notify you without undue delay about the breach, as well as the measures that have been or will be taken in response.
  2. However, Right Rental Ltd. is not required to notify you if:
    • They have implemented appropriate technical and organizational measures to protect the data affected by the breach.
    • They have taken subsequent actions to ensure that the breach no longer poses a high risk to your rights.
    • Notifying you would require disproportionate efforts.

Persons to whom your personal data is provided (Personal data processors)

Article 15
(1) In connection with the conclusion and performance of a service contract, Right Rental Ltd. provides the necessary information to the relevant accounting firm, IT support company, and, if delivery is required, to the courier company, which process your data as data processors for the purpose of performing the contract.
(2) The provision of personal data to data processors is done only if there is a legitimate reason for it and based on a written agreement, ensuring that the recipients provide an adequate level of protection.
(3) Data processors have no right to process the personal data provided to them for purposes other than the work assigned to them by Right Rental Ltd. Data processors must comply with all instructions from Right Rental Ltd.
(4) Right Rental Ltd. may provide the collected statistical information about website traffic to advertisers/advertising agencies who track clicks on their advertising banners and links, prepare internal statistics, and for the purposes of direct marketing (both for its own and PARTNER’S purposes).

Article 16
The administrator does not transfer your data to third countries.

Other provisions

Article 17
In the case of a violation of your rights under the above-mentioned or applicable personal data protection legislation, you have the right to file a complaint with the Commission for Personal Data Protection as follows:

Name: Commission for Personal Data Protection
Administrative Address: Sofia 1592, Prof. Tsvetan Lazarov Blvd. No. 2
Correspondence Address: Sofia 1592, Prof. Tsvetan Lazarov Blvd. No. 2
Phone: 02 915 3 518
Email: kzld@government.bg, kzld@cpdp.bg
Website: www.cpdp.bg

Article 18
You can exercise all your rights regarding the protection of your personal data using the forms attached to this information. Of course, these forms are not mandatory, and you may submit your requests in any form that contains a statement thereof and identifies you as the data subject.

Article 19
If consent relates to the transfer, the Administrator describes the possible risks of transferring data to third countries in the absence of a decision on adequate protection and appropriate safeguards.

Article 20
(1) When you assign Right Rental Ltd. to process personal data of a third party for the purpose of using the service, Right Rental Ltd. acts as the data processor.

(2) In the cases under para. 1, Right Rental Ltd. acts solely on your instruction as the user of the service and only to the extent that it may have control over the personal data you process. Right Rental Ltd. has no control over the content and data that you, as the service user, choose to upload to the service (including whether or not those data include personal data). In this case, there is no role in the decision-making process regarding whether the user uses the service for personal data processing and for what purposes.ели и дали същите са защитени. Съответно, отговорността на “Райт Рентал” ООД  в този случай се ограничава до 1) съобразяване с инструкциите на ползвателя на услугата съгласно договора и 2) предоставянето на информация за услугата и функционалностите чрез нейния интерфейс.

Cookies Policy

Use of Cookies and Data Security at Right Rental Ltd.

Cookies:

  1. Essential Cookies: These are necessary for the proper functioning of the website, such as displaying content in the correct language, adjusting prices based on the currency and VAT of the country, caching, etc.
  2. Analytical Cookies: These allow us to track the website’s traffic and user behavior to improve the user experience. They help us understand which pages are visited and whether users access the site from mobile or desktop devices. These cookies do not collect personal data but only anonymous information. We use Google Analytics, where IP addresses are anonymized. The maximum retention period for data collected through Google Analytics is 50 months.
  3. Functional Cookies: These enable full functionality of the site, such as watching videos, chatting with us, and remembering your language preferences for content display.
  4. Targeting Cookies: These cookies provide information on how you have used our site and are used by our advertising partners. They do not store personal information but ensure you are not shown irrelevant ads. Examples include cookies from Facebook, Google, Adform, Adwise, etc.

You can control cookie settings in your browser. Be aware that limiting some cookies may affect the site’s functionality and prevent you from using certain features.

Security Measures:
Right Rental Ltd. takes the security of personal data seriously. We have implemented a comprehensive security system to ensure the protection of all data, including personal information, on our infrastructure. We have made every effort to fully comply with the new data protection regulations, ensuring a secure environment for data storage and processing. Security is a priority, and we do not compromise on it.