Privacy Policy
As of 18 Oct 2026 · Draft
1. Controller
ВИТТАЛИ КРАФТ ЕООД (VITTALI KRAFT EOOD), UIC (ЕИК) 203865381, ул. „България“ 1, ет. 4, офис 409, 9300 гр. Добрич, Bulgaria, represented by its managing director Динчер Хаджиев. E-mail: , phone: .
No data protection officer has been appointed. [OPEN: lawyer – check whether there is an obligation because registration certificates and number plates are processed.]
2. What data we process
When you order a cost estimate:
Contact data: first and last name, address, e-mail, phone number.
Vehicle and damage data: registration number, mileage, date of accident, description of damage, optionally insurer and claim number.
Photos and documents: photos of the vehicle and the damage, registration certificate (front and back), vehicle identification number, proof of technical inspection (ГТП), optionally further documents. The registration certificate may also contain data of the vehicle keeper if this is not the person ordering.
Order and payment data: order number, chosen package, amount, receipt of payment.
Technical data when visiting the website: IP address, date and time, page accessed, browser. This data is generated automatically at the web host.
3. Purposes and legal bases
Preparing the cost estimate, communication, submitting photos later, complaints: performance of a contract, Art. 6(1)(b) GDPR.
Invoicing and accounting: legal obligation, Art. 6(1)(c) GDPR.
Secure operation of the website, prevention of misuse: legitimate interest, Art. 6(1)(f) GDPR.
Providing the required data is necessary for the contract. Without it we cannot prepare the cost estimate. No automated decision-making or profiling takes place.
4. Recipients and service providers
We only pass on your data where this is necessary for the order. We use the following service providers, with whom data processing agreements under Art. 28 GDPR are in place or will be concluded:
Web hosting: [OPEN: SuperHosting.bg or ICN.bg – enter after registration], Bulgaria.
Database and file storage: Supabase, data centre in Frankfurt am Main (Germany). The provider is Supabase Inc. (USA). [OPEN: lawyer – check the information on data transfer to the USA (standard contractual clauses / EU–US Data Privacy Framework); conclude a data processing agreement.]
E-mail sending: Scaleway SAS, Paris (France).
Mailbox: Google (Gmail). [OPEN: data transfer to Google (USA) – no longer applies once the mailbox info@avtoshteta.bg is set up.]
Calculation system: vehicle data and damage information are entered into a professional calculation system (DAT, Germany). [OPEN: lawyer – clarify the role of DAT and the data processing agreement.]
Messages via the “Ask a question” button: your name, e-mail, order number (if given) and question are stored in order to reply to you (Art. 6(1)(b) GDPR where related to an order, otherwise (a) – consent). For an internal translation and a suggested reply, the text is processed by an AI provider (Anthropic PBC, USA). The AI never replies to you itself – every reply is checked and sent by a member of staff. [OPEN: lawyer – transfer to the USA, data processing agreement with Anthropic, retention period for messages (proposal 12 months).]
Bank: for processing the payment (United Bulgarian Bank).
Accountant: for accounting and tax returns.
[OPEN: if employees or partners outside ВИТТАЛИ КРАФТ ЕООД (for example in Germany) are involved in the preparation, they must be named here and bound by contract.]
5. Retention period
We delete photos and uploaded documents 12 months after the cost estimate has been sent.
For cancelled, unpaid orders we delete all data and photos immediately after cancellation (at the latest 10 days after the order without payment).
We keep invoicing and accounting data for as long as Bulgarian tax and accounting law requires. [OPEN: insert the exact period.]
Server logs are deleted after [OPEN: web host's period].
6. Cookies and tracking
The website currently uses only technically necessary functions. No analytics, advertising or tracking cookies are used. [OPEN: as soon as Google Ads, Facebook or analytics tools are used, this section must be extended and a cookie banner with consent added.]
7. Security
Transmission is encrypted (HTTPS). Photos are stored in a non-public storage and can only be accessed via protected, time-limited links. Only the persons processing the order have access.
8. Your rights
You have the right to:
access the data stored about you (Art. 15 GDPR),
rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18),
data portability (Art. 20),
object to processing based on legitimate interests (Art. 21).
Please send requests to .
You can also lodge a complaint with the supervisory authority: Комисия за защита на личните данни (КЗЛД), бул. „Проф. Цветан Лазаров“ 2, 1592 София, www.cpdp.bg (Art. 77 GDPR).
9. Changes
We update this Privacy Policy when our processes or the legal situation change. The version published on the website applies.