Privacy policy

The controller of the personal data is:

Name: „Кар Би Ен Пи" ООД / CAR BNP LLC

UIC (Unified Identification Code): 208411742

Registered Office and Management Address: Sofia, 88 Stara Planina Str.

Contact Phone: +359 877 122 298

Email Address for Personal Data Inquiries: contact@carbnp.com

Website: carbnp.com

Mobile Application: carbnp.com/app/download

Data Protection Officer (if applicable): Not appointed

In this Policy, "CAR BNP", "we", "us", or "the Controller" refers to the company stated above.

This Policy applies to natural persons whose personal data is processed in connection with the use of CAR BNP, including:

• Website visitors;
• Users of the mobile application;
• Individuals who create an account on the platform;
• Individuals looking for, reserving, or renting a parking space or garage;
• Owners, users, or representatives of persons who list parking spaces or garages for rent;
• Individuals who communicate with us regarding support, inquiries, reports, complaints, or other requests.

Whenever the word "User" is used in this Policy, it refers to any of the individuals listed above, as applicable.

Depending on how you use CAR BNP, we may process the following categories of personal data:

Registration and Profile Data: Names, phone number, email address, password or other account access information, profile picture, user settings, and preferences.

Technical Data and Geolocation: IP address, device identifiers, browser data, operating system, language, precise geolocation (real-time location data from your device), access logs, date and time of actions on the website or application.

Vehicle Data: Vehicle information, make/model, license plate number, and any other information entered by the User in connection with the use of a parking space or garage.

Reservation and Service Usage Data: Selected parking space or garage, period of use, entry and exit times, reservation status, history of requests, correspondence, and actions within the platform.

Owner and Property Data: Information regarding listed parking spaces and garages, address, number of spaces, photos, prices, access conditions, access instructions, availability, occupancy, and calendar.

Payment Data: Information regarding payment transactions, amount, currency, payment status, transaction ID, invoice or accounting data, where applicable. Full payment card details are processed by the payment provider, as described in Section 5.

Communication and Support Data: Content of inquiries, messages, complaints, reports, feedback, reviews, and correspondence with us or between users, where such functionality is available.

Platform Behavior Analytical Data: Screens/pages visited, functionalities used, clicks, searches, session duration, preferred locations or categories, technical events, and errors.

As a rule, we do not require Users to provide special categories of personal data within the meaning of the GDPR, such as health data, political opinions, religious beliefs, or biometric data for identification purposes. Please do not enter such data in free text fields, photos, messages, or other functionalities of the platform.

We process personal data only when there is a specific purpose and an applicable legal ground. The main purposes and grounds are:

Creation and management of a user profile – for registration, login, user identification, profile support, and providing access to platform features. Legal ground: Performance of a contract or taking steps prior to entering into a contract.

Mediation in renting and leasing parking spaces and garages – for listing properties, searching, reserving, managing availability, confirmations, communication between parties, and fulfilling requests. Legal ground: Performance of a contract; legitimate interest in the proper functioning and protection of the platform.

Displaying information about parking spaces and garages – for visualizing addresses, photos, prices, availability, access, and other property details on the platform. Legal ground: Performance of a contract with the owner/listing user and legitimate interest in providing the service to searching users.

Translation of text written by users – for showing listing descriptions, access instructions and guests' rating comments in the language of each user's app (see Section 7). Legal ground: Performance of a contract; legitimate interest in providing the platform in more than one language.

Payments, fees, refunds, and accounting reporting – for processing payments, commissions, refunds, invoicing, accounting, and tax obligations. Legal ground: Performance of a contract; compliance with a legal obligation; legitimate interest in proving payments and defense in case of disputes.

Support and communication – for responding to inquiries, technical assistance, processing complaints, reports, feedback, and user communication. Legal ground: Performance of a contract; legitimate interest in customer service and improving the service.

Security, fraud prevention, and rights protection – for detecting and preventing fraud, unauthorized access, violations of terms, technical issues, disputes, and legal claims. Legal ground: Legitimate interest; compliance with a legal obligation, where applicable.

Analysis and improvement of the platform – for understanding user behavior, optimizing features, troubleshooting, developing the website and application, and improving user experience. Legal ground: Legitimate interest or consent, when the law requires consent for specific analytical technologies.

Marketing communications (if utilized) – for sending news, offers, promotional notifications, or recommendations, where permitted. Legal ground: Consent or legitimate interest, to the extent permitted by applicable law. The User may opt out of marketing communications at any time.

Compliance with legal obligations – for fulfilling duties under accounting, tax, consumer protection, administrative, or other applicable legislation. Legal ground: Compliance with a legal obligation.

Determining precise location – for calculating distances and displaying the nearest available parking spaces and garages to the User on the platform's map.

When processing is based on a legitimate interest, CAR BNP performs a balancing test to ensure that this interest is not overridden by the interests, rights, and freedoms of the respective User.

Users may enter payment card details or other payment methods when making a payment on the platform. Full payment card details are not stored directly by CAR BNP; instead, they are processed within the secure environment of the payment provider, such as Stripe or another payment service provider: myPOS.

CAR BNP may receive and store limited information necessary for confirming and administering the payment, such as a transaction ID, payment status, amount, currency, date, the last digits of the card, card type, or a token, when such information is provided by the payment provider.

The payment provider may act as an independent data controller or data processor depending on the specific service and arrangements with CAR BNP. Users should also review the privacy policy of the respective payment provider: Stripe (https://stripe.com/privacy) or myPOS (https://merchant.mypos.com/en-gb/terms-conditions/doc:PP).

The CAR BNP website and mobile application may use cookies, SDKs, pixels, device identifiers, and other similar technologies to:

• Maintain sessions and account logins;
• Remember settings and preferences;
• Measure traffic, usage, and platform performance;
• Detect errors, crashes, and technical issues;
• Improve functionalities and user experience;
• Marketing and personalized messaging, if utilized and if an applicable legal ground is present.

The analytical tools and SDKs used are: Google Analytics, Meta Pixel, PostHog, Vercel Analytics.

When the law requires consent for the use of certain cookies or similar technologies, CAR BNP will use them only after obtaining consent through the corresponding banner, website setting, or mobile application setting.

CAR BNP may disclose personal data only when necessary for the purposes described in this Policy and in the presence of an applicable legal ground. Categories of recipients may include:

• Other users of the platform – for example, limited data necessary for reservations, access, communication, or fulfillment of the rental, such as name, contact details, vehicle information, license plate number, or information about the specific parking space/garage.
• Payment providers – such as Stripe or another payment tool, necessary for executing, confirming, refunding, or administering payments.
• Hosting, cloud, and technical infrastructure providers – for storage, maintenance, security, and operation of the website and application.
• Translation provider – Anthropic Ireland, Limited, which machine-translates, using artificial intelligence (the Claude model), text that users write on the platform, so that other users can read it in the language of their app. Only these free-text fields are sent: a listing's name, short and full description, notes (where the spot is, how to get in, how to get out, additional instructions, other notes), access description and access instructions; the name, access description, access instructions and notes of each individual spot; and the comments guests leave when rating a stay. Addresses, photos, prices, account and profile data, vehicle data, payment data and location data are not sent. The text is sent as written, so it includes any personal data its author chose to put in it, such as a name, phone number or access code. Anthropic acts as our processor, processes the text only to translate it for us, does not use it to train its models, and deletes it within 30 days, unless it must keep it longer to prevent abuse or is required to by law. The author always sees their original text; we keep the translations alongside it for as long as the original is kept.
• Analytical, communication, and marketing service providers – when such tools are used, subject to applicable consent and privacy rules.
• Customer support, legal, accounting, auditing, or other professional service providers – when necessary for our business operations or for fulfilling legal obligations.
• Competent state authorities, courts, regulators, or other entities – when required by law, necessary for protecting rights, preventing abuse, or assisting with lawful requests.
• In corporate changes – potential buyers, investors, consultants, or successors in the event of restructuring, business sale, investment, merger, or other similar operations, subject to applicable safeguards.

CAR BNP does not sell personal data to third parties.

It is possible that some of our service providers—such as payment, cloud, analytical, communication, or technical providers—may process personal data outside the European Union or the European Economic Area.

When transferring personal data to a third country or an international organization, CAR BNP applies appropriate safeguards under the GDPR, including adequacy decisions, standard contractual clauses, additional technical and organizational measures, or another applicable mechanism.

This includes our translation provider Anthropic (see Section 7), which may process the text it translates outside the European Economic Area, including in the United States. That transfer is covered by the European Commission's standard contractual clauses.

CAR BNP stores personal data only for the period necessary to achieve the purposes for which it was collected, unless a longer retention period is required or permitted by law. Specific periods depend on the data type, processing purpose, legal obligations, and the necessity to protect rights.

Approximate retention periods and criteria are:

Profile Data: For the duration of the account's activity and thereafter for a reasonable period necessary to settle relations, ensure security, prevent abuse, and defend against claims.

Reservation, Payment, and Transaction Data: For the period necessary to perform the service, fulfill accounting and tax obligations, and defend against claims.

Data on Listed Parking Spaces and Garages: As long as the property is active on the platform and thereafter for a reasonable period to prove relations, resolve disputes, and comply with legal obligations.

Communication and Support Data: For the period necessary to process the request and thereafter for a reasonable period to prove service delivery and defend against claims.

Technical Logs and Security Data: For a period necessary to ensure security, prevent abuse, and diagnose technical problems.

Analytical Data: In aggregated or pseudonymized form, to the extent possible, for durations according to the settings of the analytical tools used.

Data Processed Based on Consent: Until consent is withdrawn, unless there is another legal ground for further storage.

When personal data is no longer necessary, it is deleted, anonymized, or restricted in accordance with CAR BNP's internal rules and applicable law.

CAR BNP implements appropriate technical and organizational measures to protect personal data against unauthorized access, unlawful disclosure, alteration, loss, destruction, or other unlawful processing.

These measures may include, as applicable:

• Access control to administrative panels and internal systems;
• Use of passwords, access rights, and restricting access only to persons with a need to process the data;
• Encryption of communication using secure protocols;
• Logging and monitoring of security-related actions;
• Backups and recovery measures in case of a technical incident;
• Contractual confidentiality and data protection obligations with providers;
• Periodic review of security measures;
• Minimizing access to payment card data through the use of a specialized payment provider.

Regardless of the measures taken, no electronic service can guarantee absolute security. Users must safeguard their passwords and devices and notify us immediately if they suspect unauthorized access to their account.

Subject to the conditions and limitations of the GDPR, every User has the following rights regarding their personal data:

• Right to information – to receive clear information about the processing of their personal data.
• Right to access – to obtain confirmation as to whether we process their personal data and to access it.
• Right to rectification – to request the correction or completion of inaccurate or incomplete data.
• Right to erasure – to request the deletion of personal data when grounds for it exist.
• Right to restriction of processing – to request a temporary restriction of processing in cases provided by law.
• Right to data portability – to receive the data they have provided in a structured, commonly used, and machine-readable format, when legal prerequisites are met.
• Right to object – to object to processing based on legitimate interest, including against direct marketing.
• Right to withdraw consent – when processing is based on consent, the User may withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
• Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, except when permitted by law and appropriate safeguards are provided.
• Right to lodge a complaint with a supervisory authority – the User has the right to file a complaint with the Commission for Personal Data Protection or another competent supervisory authority.

Requests to exercise these rights can be submitted to: contact@carbnp.com

We may request additional information to confirm the identity of the applicant when necessary. We respond to requests within the timeframes stipulated by the GDPR.

Providing part of the personal data is necessary for you to use the core features of CAR BNP. For example:

• Without an email address it may not be possible to create and use a profile. A phone number is optional for a renter profile and is required when you register as an owner, where it is used for Stripe;
• Without vehicle data or a license plate number, it may not be possible to use certain parking spaces, garages, or access modes;
• Without information about the parking space, address, availability, price, and access, the owner may not be able to list or manage a property;
• Without payment details provided to the payment provider, it may not be possible to complete a paid reservation or payment;
• Without technical data, we may not be able to ensure normal operation, security, and protection of the platform.
• Without granting access to your precise location, the platform will not be able to automatically detect where you are and show you the nearest parking spaces around you; in this case, you will have to search for properties by manually entering an address or city.

When certain data is optional, this will be indicated via the platform's interface or will be obvious from the context. Failure to provide optional data does not result in a denial of the core service but may limit some additional functionalities.

CAR BNP is not intended for use by children under the age of 16, unless applicable law permits a lower age or valid consent/permission from a parent or legal guardian is present, where required.

If we learn that we have collected personal data from a child without the necessary legal ground or consent, we will take reasonable steps to delete or restrict that data.

Age restrictions and rules for using the platform must be aligned with the Terms and Conditions of CAR BNP.

CAR BNP may update this Policy periodically, including changes to the platform, technologies used, providers, legal requirements, or the way we process personal data.

The current version of the Policy will be published on the website and/or within the mobile application. In the event of material changes, we may notify Users via email, an in-account message, a push notification, or another appropriate channel.