Privacy Policy

UCSM Privacy Policy
Last updated: 14 October 2026 (pro forma, subject to final legal review)

This policy explains how UCSM processes personal data when you use the UCSM platform, the website and the mobile application.

1. Who we are
The data controller for the processing described in this policy is:
UCSM Solutions Ltd, a company incorporated under Bulgarian law
Registered address: 16 Aleko Konstantinov Str., floor 4, Plovdiv, Bulgaria
UIC/EIK: [EIK]
Contact for privacy matters: [email protected]
General contact: [email protected]
Data protection officer: [none appointed / contact details, to be confirmed]

2. Our roles
UCSM is the controller of the personal data it needs to run the platform: accounts, sign-in and security, payments and Credits, support, notifications, audit records, and the shared service-history and vehicle records that are shown to the people entitled to see them.

Service workshops, fleet companies and other organisations that use UCSM to manage their own customers, drivers, employees, vehicles and orders are controllers of the data they enter about those persons. For that data UCSM acts as their processor, under the Data Processing Agreement (DPA) that business tenants enter into with UCSM Solutions Ltd.

The platform is built around the vehicle rather than the person. Where a service organisation needs a name or a contact detail to do its work, it sees only what its role and the workflow require.

3. The data we process
Account and identity: name, email address, telephone number, language and display preferences, the role and organisations you belong to, and the identifier given by our sign-in provider.
Sign-in and security: sign-in events, IP address, device and session information, security alerts (for example a sign-in from a new IP address), and the acceptance of our legal documents with date, time, version and network details.
Vehicles: VIN, registration number, brand, model, year, mileage, ownership and authorisation links, vehicle photographs and documents.
Service and fleet data: service requests and orders, operations, parts and costs, messages between clients and service centres, appointments and bookings, vouchers, campaign and offer messages, service-history records, documents, fleet organisations, branches, members and authorisations, and reports.
Payments: your Credits wallet, purchases, charges, refunds and billing details such as name, address and VAT number. Card details are entered on the Stripe page and are not stored by UCSM.
Support: tickets and messages you send us.
Notifications: in-platform notifications, email, and, in the mobile application, push notifications that use a device identifier.
Assistant, suggestions and documents: the questions you put to the EKI assistant, the texts and images you submit for AI-assisted suggestions or analysis, and the documents you upload for text recognition (OCR).
Technical data: server logs and error information, and the cookies described in Section 12.
We do not ask for special categories of personal data (such as health data or criminal-offence data) or national identity numbers, and you must not upload them (see our Terms).

4. Why we use your data and on what basis
To create and run your account, provide the platform, process orders, bookings and service history, and provide support: performance of the contract (Article 6(1)(b) GDPR).
To process payments, issue invoices, keep accounting and tax records, and answer legal requests: legal obligation (Article 6(1)(c)).
To secure the platform, detect fraud and abuse (including abuse of refunds and free periods), keep an audit trail, and establish, exercise or defend legal claims: our legitimate interest (Article 6(1)(f)).
To show verified service history to the people entitled to see it and to keep that history reliable: performance of the contract and our legitimate interest in a trustworthy history.
To send you service messages about your account, orders, bookings, packages, Credits and security: performance of the contract.
To deliver promotional messages that a service centre sends to its own clients through the platform: the legitimate interest of the service centre and of UCSM in delivering them, and your consent where the law requires it; you can opt out at any time with the link in each message.
To send push notifications: performance of the contract and your choice in the settings of your device.
To provide the EKI assistant and text recognition at your request: performance of the contract.
To meet obligations under law, for example an order from an authority: legal obligation.
Where we rely on consent you can withdraw it at any time, without affecting what was done before.

5. Who receives your data
Within the platform: the people and organisations you work with, according to their role and the workflow. For example a service centre sees the requests, vehicles and contact details of its own customers; a vehicle holder sees the verified history of the vehicle; a fleet sees its own vehicles and members.
Service providers (processors) that help us run the platform:
- Auth0 (Okta): sign-in and identity.
- Stripe: payment processing, invoicing and tax details. Stripe also acts as an independent controller for some of the payment data it needs for fraud prevention and its legal duties.
- Microsoft Azure (Document Intelligence): text recognition of uploaded documents.
- OpenAI: the EKI assistant, the repair-suggestion tool and the image-analysis feature, which send the query, the text or the image and the platform information needed to answer.
- Google Firebase Cloud Messaging: push notifications to the mobile application.
- Our email delivery provider: sending email.
- Cloudflare: network protection and delivery.
- Our hosting provider: [name and location, to be confirmed].
Authorities, courts and advisers, where the law requires it or to defend legal claims.
We do not sell personal data.

6. Transfers outside the EEA
Some of our providers may process data outside the European Economic Area, in particular in the United States. We rely on an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or on the standard contractual clauses approved by the European Commission, together with additional safeguards where needed. You can ask us for details at [email protected].

7. How long we keep data
Account data: while your account is open. After closing it, your data is available for export for 30 days (Terms, Section 19) and then deleted or anonymised, except what we must keep by law or to defend legal claims.
Verified service-history and vehicle records: for as long as the vehicle record exists on the platform, because they form part of the vehicle's history. A person's contact details in them are removed or anonymised when the account is deleted, where this is possible without breaking the record.
Payment and invoicing records, and Credits ledger: for the period required by accounting and tax law: [statutory period, to be confirmed].
Audit and security logs, including IP addresses and acceptance of legal documents: [period, to be confirmed].
Support tickets: [period, to be confirmed].
Notifications and device identifiers: until you delete them, sign out of the device or close the account.
Backups are kept for a limited time and then overwritten.

8. Your rights
You have the right to: information; access to your data and a copy; correction; erasure; restriction of processing; data portability; objection to processing based on legitimate interest and to direct marketing at any time; withdrawal of consent; and not to be subject to a decision based solely on automated processing that has legal or similarly significant effects.

You can correct your data in your profile, delete your account in your profile (permanent deletion also removes your sign-in identity), and opt out of promotional email with the link in each message. For anything else write to [email protected]. We answer within one month and may ask you to prove your identity. Requests concerning data that a service centre or fleet entered about you are passed to that organisation, which is the controller of that data. Requests that affect records we must keep by law or to defend legal claims, or the verified history of a vehicle, may be limited to the extent the law allows, and we will explain why.

You have the right to complain to the supervisory authority. In Bulgaria this is the Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg, or the authority in the country where you live or work.

9. Automated processing and artificial intelligence
UCSM does not take decisions based solely on automated processing that have legal or similarly significant effects on you. Text recognition output and AI suggestions are suggestions that you must check before saving. The EKI assistant is informational and read-only: it does not change records, permissions or statuses. Your queries, texts and images, and the platform information needed to answer them, are sent to the providers named in Section 5. Do not put sensitive personal data into queries or images.

10. Vehicles, VIN and manufacturer campaigns
A VIN or registration number can identify a person when it is linked to them. For manufacturer campaigns, an authorised brand service centre uploads a list of VIN; UCSM matches it with vehicles registered on the platform and sends a neutral notice from the platform to the holders of the matching vehicles. The service centre does not learn which vehicles are registered or who holds them. Uploaded lists are deleted [period, to be confirmed] after the campaign ends.

11. Children
The platform is for persons aged 18 and over. We do not knowingly collect data from children.

12. Cookies and similar technologies
We use only the cookies and local storage that the platform needs to work: sign-in and session cookies, security tokens that protect forms, and a cookie that remembers your display theme and language. These do not need your consent. We do not use advertising cookies or third-party analytics on the platform. If we ever add non-essential cookies, we will ask for your consent first. The mobile application stores a sign-in token and a push-notification identifier on your device.

Content from other providers: our pages load fonts from Google Fonts, code libraries from jsDelivr and Cloudflare (cdnjs), and training videos from YouTube in its privacy-enhanced mode. When your browser loads them, these providers receive your IP address and browser details under their own terms.

13. Security
We protect data with role-based access, separation between organisations' workspaces, encrypted connections, an audit trail of important actions, backups, and restricted administrator access. No system is perfectly secure, so please also protect your devices and passwords.

14. Personal data breaches
If a breach is likely to put your rights at risk, we notify the supervisory authority within 72 hours and, where there is a high risk, we notify you without undue delay.

15. Changes to this policy
We may update this policy. We publish the new version with its date and notify you of material changes. Where the law requires it, we ask you to accept the new version.

16. Contact
UCSM Solutions Ltd, 16 Aleko Konstantinov Str., floor 4, Plovdiv, Bulgaria, UIC/EIK [EIK]
Privacy and personal data requests: [email protected]
General: [email protected]