Privacy Policy

Information on Processing and Protection of Personal Data

Van-Al LTD, entered in the Commercial Register at the Registry Agency under UIC 205394711, with registered office and address of management: Sofia, 3 Luborodie Str., web:, tel. +359 892 476 929, processes your data in the capacity of a controller of personal data within the meaning of the Personal Data Protection Act and the General Data Protection Regulation.
This information aims to outline the approach to the lawful processing of your data and its protection within the framework of the activity carried out by Van-Al LTD. The information includes the following:

Personal data we process

  • Personal information (names, PIN / date of birth and place of birth, personal identification number of a foreign national, nationality, address(s), including country, details according to identity document, signature specimen, telephone, e-mail address,  IBAN of client accounts)

Information collected when using information and communication technologies

  • IP addresses
  • Location (e.g. from our GPS trackers)
  • Communication information (the information we learn about you from the correspondence between us)
  • Special categories of personal data – biometric data (e.g: identity card photo) for the sole purpose of identifying an individual.

Data Sources

We collect the above listed data in the following ways:

  • The information you provide to us.
  • Information we receive when you or a person you represent uses our services and products.
  • Internet.
  • Video and audio surveillance and recording in and around the bank's premises.
  • Other sources.

For What purposes "Van-Al" LTD process you data

"Van-Al" LTD  processes your personal data for the following purposes:

  • Identification of clients and persons with whom Van- AL LTD may potentially enter into relationship. The provision of personal data is voluntary or performed in compliance with a statutory requirement. In case of refusal to provide personal data,  "Van-Al" LTD  will not be able to provide the requested  service.
  • Execution of agreements entered into between us and you / a person represented by you.
  • Realization of marketing researches (obtaining information about the brand perception, the behavior, needs and expectations of current and potential clients with a view to developing / improving products and / or services and improving the level of service of the our's clients).
  • Preservation and archiving of documents.
  • For the purpose of protecting the legitimate interests of Van – Al LTD (in cases of suspicion of abuse and / or fraud, embezzlement, theft,  related to the legal relations between you / the person you represent and Van – Al LTD; in case of legal disputes related to legal relationships between you / the person you represent and Van – Al LTD, etc.).
  • For strategic planning of our business and business process management.
  • Investigating and responding to a request, recommendation, complaint or appeal made by you / the person you represent.
  • Sending you information on paper and electronic media about rent-a-car services used by you.
  • Auditing the company's activities.
  • For the purpose of establishing, exercising or defending legal claims of Van – Al LTD.

Ground on which process your personal data

On what grounds Van-Al LTD processes your personal data

Van-Al LTD  processes your personal data lawfully on the basis of the legal grounds provided under Article 6 of the General Date Protection Regulation.
Contractual grounds
We process your personal data when it is necessary to take steps to conclude a Rental Agreement with you  or for the performance of a contract already concluded with us.
For example, on a contractual grounds, we process personal data for the purposes of identifying the persons requesting to rent one of our vehicles, upon entering into relations with them and in the course of performing our obligations under the Rental Agreement concluded between us;
Legal obligation
In the case where a number of statutory obligations are imposed to Van-Al LTD by different legislative acts, both at national level and under EU law, we processes your personal data for the purpose of compliance with the relevant obligation.
Legitimate interest
In many cases, we processes your data on the basis of its legitimate interests. For example, for the purpose of direct marketing, but limited only to offers for services similar to the ones already used by them. Prior to processing your data for these purposes and in the course of processing, Van-Al LTD checks whether there is a balance between its legitimate interest and your fundamental rights and freedoms or interests, and in the event that the latter have an advantage, we do not undertake or discontinue the processing of your data, unless you expressly consent to the processing. 
Van-Al LTD processes your personal data only on the basis of and upon receipt of your explicit consent.

Third parties to which Van-Al LTD provides personal data

Van-Al LTD will not provide your personal data to third parties other than the following recipients / categories of recipients and if one of the following circumstances is present:
Data processing by third party assignes by Van-Al LTD
We provide data to related or other trusted third parties under a contract between us and they process it for us based on our instructions and in accordance with the applicable data protection legislation.
Here are included the following third parties who process your data on assignment by us:

  • Partners of Van-Al LTD under contracts for legal services or document translation services.
  • Providers of systems / services for management and maintenance of our activity and the quality of our services, including such related to the information technologies with which we have a contract (e.g. marketing and marketing research companies, IT and telecommunication service providers, software vendors, computer support providers, printing houses, document storage and destruction companies, administrative service providers, archive service providers, etc.).
  • Subcontractors for different services, e.g. insurance brokerage, debt collection, financial analysis.

For the performance of a legal obligation
We share your data with state bodies / institutions, persons with public functions, regulators and supervisors or persons performing public functions (including the NSSI, SANS, court, prosecutors and investigators authorities, Commission for Consumer protection, Competition Protection Commission, Commission for Personal Data Protection, state and private enforcement agents, etc.), auditors, companies, organizations or external persons, if we have reasonable grounds to believe that the personal data access, use, retention or disclosure is necessary for:

  • Implementation of applicable law or other statutory instrument of mandatory nature.
  • A response to a request from a supervisory body, regulator or other state institution or a person exercising public functions in relation to or in connection with the performance of its statutory functions or initiated investigation, complaint, audit, etc.
  • Detection, prevention or other action in connection with fraud, money laundering, terrorist financing, technical or security issues.
  • Undertaking measures to protect the rights and property of  Van-Al LTD, ensuring the safety of our clients or the public as required and permitted by law.

With your explicit consent
Beyond the above listed cases, we will share your personal data with companies, organizations, or other third parties when we have your consent to do so.

Retention period for data collected

We will keep your personal data for a period of time not exceeding 10 years from the year following the year of termination of the relationship in respect of which your personal data has been collected and as long as there is no other reason to process the data.
We will keep your data for the following reasons:

  • In order to be able to meet your requests for information.
  • In order to be able to answer your questions and complaints.
  • In order to be able to prove the fulfillment of our commitments to you.
  • In order to fulfill the statutory obligations to us  regarding retention of client data and the documents relating to the transactions and operations carried out, as well as the documents relating to the establishment and maintenance of business or professional relations.
  • In order to exercise our legitimate interests, e.g. for establishing, filing and defending legal claims;

Your rights as a subject of data processed by D

You have the right to:

  • Access your personal data processed by us and the right to require Van-Al LTD  to correct and u pdate your personal data; You can do this by submitting an application in the following form, at the following address or in our office.
  • Withdraw at any time the consent you have provided for the processing of your personal data in cases where it is processed only on the basis of consent (e.g. in the case of direct marketing of our products / services you have not previously used or products / services of our partners or for the purpose of marketing research). Withdrawal of your consent does not affect the lawfulness of the data processing so far.
  • Submit a request for deletion of your personal data, which is stored and processed by us, in cases where there is no longer any reason to process it.
  • Request that you limit the storage and processing of your personal data by Van-Al LTD and file an objection against processing.
  • Receive your personal data that you have provided to Van-Al LTD in a structured, widely used and machine readable format, and transfer this data to another controller when the data is processed on the grounds of your consent or under a contract between you and Van-Al LTD as well as when the processing is carried out in an automated manner.
  • Submit a complaint to the Commission for Personal Data Protection at the following address: 1592 Sofia, 2 Prof. Tsvetan Lazarov, tel.: 02/91-53-518, e-mail: / or other supervisory/ regulatory body, if you believe there is a violation related to the processing of your personal data by the bank.

We will respond to all your requests without undue delay within 30 days of receipt of your request.
If we are unable to process your request within one calendar month (due to its complexity, need for third party assistance or the number of requests), we may extend this period and explain the reasons for doing so.