Privacy Policy (GDPR)

01Data controller

The data controller is EVO LUXURY OOD (EIK 208565345), whose registered office is at 3 Brashlyan Street, Sofia 1619, Bulgaria (see the legal notice). For any question relating to your data: evoluxury@protonmail.com.

02Data collected

• Identification and contact data: surname, first name, company, email address, telephone number, language of the page.
• Data relating to your request: vehicle, desired duration and mileage, message, page from which the visit originated (if you have accepted audience measurement).
• Contractual data: vehicles, contracts, invoices, file documents (company registration extract, accounts for the last two financial years, bank account details, identity document of the signing director, drivers’ licences, proof of address, beneficial owners, intra-EU VAT number).
• Vehicle usage data: monthly photographs and mileage readings, claim reports (with the location of the incident if you authorise it in your browser), exchanges with support.
• Connection and security data: audit logs, authentication, connected devices.
• Audience measurement (only with your consent): pseudonymous visit identifier stored on your device and pages viewed.

03Purposes and legal bases

• Management of rental contracts (rentals, invoicing, vehicle monitoring, claims) — basis: performance of the contract.
• Responding to your requests and commercial follow-up (acknowledgement of receipt, call-back, qualification of the request) — basis: pre-contractual measures taken at your request and legitimate interest.
• Accounting and tax obligations — basis: legal obligation.
• Identity verification and sanctions list screening (clients and investors) — basis: legal obligation where applicable, otherwise legitimate interest in fraud prevention.
• Security of the website and accounts — basis: legitimate interest.
• Audience measurement — basis: your consent, which may be withdrawn at any time.
• Commercial communications by email — basis: your consent (double opt-in), which may be withdrawn in one click.

04Automated indicators and artificial intelligence

To organise the work of our teams, internal indicators are calculated automatically: a request qualification score, a monitoring indicator for client and partner files, and an automated analysis of the monthly vehicle photographs to detect any visible damage. These indicators assist our teams; no decision producing legal effects concerning you is taken on a solely automated basis: every file, every contractual condition and every finding of damage is reviewed by a person. You may request explanations about these indicators and submit your observations to evoluxury@protonmail.com.

05Recipients

Your data is intended for the authorised teams of EVO LUXURY and for its service providers, who act on instructions and are bound by a duty of confidentiality:

• Hosting: Fly.io, Inc. (servers in the European Union, Paris region); encrypted backups: Cloudflare, Inc. (R2 service).
• Email delivery: Brevo; contact address mailbox: Proton AG (Switzerland).
• Conversational assistant: Anthropic, solely for exchanges with the assistant.
• Payment: Stripe, where applicable.
• WhatsApp (Meta): only if you choose to write to us through this channel.
• Insurers and loss adjusters: in the event of a claim; chartered accountant and public authorities: for accounting and tax obligations.
• Partners (insurers, fleet financiers): only with your consent.

No data is sold. Transfers outside the European Union: some service providers are established in the United States; such transfers are governed by the EU–US Data Privacy Framework where the provider participates in it or, failing that, by the European Commission’s standard contractual clauses. Switzerland benefits from an adequacy decision.

06Retention periods

• Requests and prospects: 3 years after the last contact.
• Client account: for the duration of the contractual relationship; contractual data: 5 years after the end of the contract.
• Invoices and accounting records: 10 years.
• Identity documents and verifications: 5 years after the end of the relationship.
• Proof of consent: 3 years after its withdrawal.
• Audience measurement: 13 months.
• Security logs: 1 year.

At the end of these periods, the data is deleted or anonymised.

07Security

EVO LUXURY implements appropriate technical and organisational measures: encryption of passwords and sensitive data, strong authentication (2FA, passkeys), role-based access control, a tamper-proof audit log, encrypted backups and hosting in the European Union.

08Your rights

In accordance with the GDPR, you have the following rights:

• Right of access to and rectification of your data.
• Right to erasure, subject to statutory retention obligations.
• Right to restriction of processing and right to object to processing, in particular to direct marketing.
• Right to portability of your data.
• Right to withdraw your consent at any time (‘Cookie settings’ link at the bottom of the page, unsubscribe link in emails).

You may exercise these rights from your client area (‘Privacy’ section) or by writing to evoluxury@protonmail.com. You may also lodge a complaint with the competent supervisory authority: in Bulgaria, the Commission for Personal Data Protection (КЗЛД / CPDP — cpdp.bg); residents of another EU Member State may refer the matter to their national authority (in France, the CNIL — cnil.fr).

09Amendments

This policy may be updated. The version in force is the one published on this page, together with the date of its last update.