GDPR & Data Protection Notice

GDPR and Data Protection Notice
Last updated: 14 October 2026 (pro forma, subject to final legal review)

This notice describes how UCSM Solutions Ltd (UIC/EIK [EIK], 16 Aleko Konstantinov Str., floor 4, Plovdiv, Bulgaria) organises data protection on the UCSM platform. It complements the Privacy Policy, which explains what personal data is processed, why and for how long.

1. Controller and processor roles
UCSM Solutions Ltd is the controller of the data it needs to run the platform (accounts, sign-in and security, payments and Credits, support, notifications, audit records, and shared service-history and vehicle records).

Service workshops, fleet companies and other business tenants are controllers of the personal data they enter about their own customers, drivers and employees. For that data UCSM Solutions Ltd is their processor. This relationship is governed by the Data Processing Agreement (DPA) that every business tenant enters into with UCSM Solutions Ltd. The DPA sets the subject matter, duration, nature and purpose of the processing, the categories of data and people, our duty to act only on documented instructions, confidentiality, security measures, help with data-subject requests and breaches, the use of sub-processors, return or deletion of data, and audits.

2. Principles we follow
Lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability. The platform works with the vehicle first: names and contact details are shown only to those whose role and workflow need them.

3. Lawful bases
Each processing purpose has a legal basis, which the Privacy Policy states: performance of a contract, legal obligation, legitimate interest, and consent where required. The acceptance of the Terms, the Privacy Policy and this notice is recorded to show who accepted which version. That record is evidence that a document was accepted; it is not, by itself, a consent under the GDPR, and we do not use it as the legal basis for processing.

4. Access control and separation
Access is role-based. Workspaces of different organisations are separated. Data is shared only through explicit workflows, approvals or ownership and authorisation relationships. Administrator access is limited and recorded.

5. Audit trail
Important actions, such as sign-in events, acceptance of legal documents, changes of access, payments and refunds, and administrator operations, are recorded with date, time and network details. Administrators review them only for security, legal compliance, support and incident investigation.

6. Sub-processors and transfers
We use the processors listed in the Privacy Policy (sign-in, payments, text recognition, assistant, push notifications, email delivery, network protection and hosting) under written terms that require them to protect the data and to process it only for us. Where a processor transfers data outside the European Economic Area, we rely on an adequacy decision or the standard contractual clauses. Business tenants can obtain the current list of sub-processors from [email protected] and are told of material changes.

7. Artificial intelligence and text recognition
The EKI assistant and document text recognition are tools that suggest and inform. They do not take decisions with legal effect and do not change records without a person's confirmation. Users must not upload special categories of personal data. Uploaded documents and assistant queries are sent to the providers named in the Privacy Policy only to produce the result.

8. Your rights and how to use them
You can access, correct, delete, restrict, object, withdraw consent and ask for portability by writing to [email protected]. You can correct your data and delete your account in your profile, and opt out of promotional email with the link in each message. We answer within one month. If the data was entered by a service centre or fleet, we pass the request to that organisation, which is the controller. You may complain to the Commission for Personal Data Protection (Комисия за защита на личните данни, www.cpdp.bg) or to the authority in your country.

9. Personal data breaches
We investigate every security incident that may affect personal data. Where the law requires it, we notify the supervisory authority within 72 hours of becoming aware of a breach and notify the people affected without undue delay when the risk to them is high. We tell business tenants without undue delay so that they can meet their own duties.

10. Retention
We keep personal data only as long as needed for the purposes in the Privacy Policy or as the law requires. Verified service history stays with the vehicle record; a person's contact details in it are removed or anonymised when the account is deleted, where possible. After an account is closed, data is available for export for 30 days and is then deleted or anonymised, except what we must keep by law or to defend legal claims.

11. Impact assessments and records
We keep a record of our processing activities and carry out a data-protection impact assessment where processing is likely to result in a high risk, for example for the assistant, text recognition and the matching of vehicles to manufacturer campaigns.

12. Contact
Controller: UCSM Solutions Ltd, 16 Aleko Konstantinov Str., floor 4, Plovdiv, Bulgaria, UIC/EIK [EIK]
Privacy and personal data requests: [email protected]
General: [email protected]
Data protection officer: [none appointed / contact details, to be confirmed]