Privacy Policy
Последна актуализация: 12 ноември 2026 г.
1. Personal data administrator
Администратор на личните данни, обработвани чрез сайтовете smartwash.me и shop.smartwash.me, е „SMART WASH“ EOOD, UIC 208942807, with registered office and correspondence address: Sofia, 47 Krum Popov Street. For questions about personal data, you can contact us at go@smartwash.me.
2. What data do we collect?
When you use the contact form, we receive the data you fill in: name, e-mail address, optional phone number, subject and content of the message. When visiting the site, limited technical data necessary for its security and normal operation may be processed - for example, IP address, browser type, date and time of the request, and cookie consent settings.
Please do not send sensitive personal data or information that is not necessary for the inquiry through the form.
Online sales and forms: When you order goods or submit a cancellation or complaint, we process name, e-mail, recipient details, delivery address or office, courier contact phone number, products, amounts, payment references and billing details. In case of cancellation, the phone number is optional. In case of complaints, the order number, description of the problem, photos and proof of payment may be processed. In case of business contacts, the name and position of the representative, company details and correspondence may be processed.
3. Purposes and legal bases
- Processing inquiries and correspondence — to answer your questions, prepare a proposal or discuss a possible partnership. Grounds: pre-contractual actions at your request (Art. 6, para. 1, lit. „b“ of the GDPR), where applicable, or our legitimate interest in carrying out business communication (lit. „f“).
- Security and technical support — to protect the site from abuse and ensure its reliable operation. Ground: legitimate interest (Art. 6, par. 1, b. „e“).
- Optional cookies and external services — when used, they are activated in accordance with your consent, which you can withdraw at any time.
Additional purposes and grounds: fulfillment of online orders, deliveries, payments and refunds (Art. 6, par. 1, b GDPR); invoicing, accounting, tax obligations and processing of legal consumer requests (b c); verification of complaints, fraud prevention and protection of rights where a legitimate interest is applicable (b f). Data about the services are processed only when they are actually used.
4. To whom do we provide data?
The data may be accessed by authorized persons from the company and hosting, email, support and security providers, to the extent necessary to provide the service. The site uses WordPress and WPForms Lite; form requests are sent to our business email. WPForms Lite does not store form records in its own request review module.
We do not sell personal data. If a specific service requires the transfer of data outside the European Economic Area, the relevant legal requirements and safeguards apply.
Delivery and payment: for online orders we provide the necessary recipient data to a courier company Speedy. Banks and payment intermediaries process the information required for card payments, bank transfers and cash on delivery. We do not collect payment card numbers and security codes through contact forms. If necessary, data may be obtained by accounting and legal consultants or competent authorities on a legal basis. For visit statistics, only after the necessary consent, we use Google Analytics 4 via MonsterInsights. The provider is Google Ireland Limited, and companies from the Google group may also participate in the processing. Online identifiers, technical data about the device and browser, approximate location, pages visited and interactions with the site may be processed. We use this data for aggregated statistics and site improvement, and not for automated decisions with legal consequences. In the event of any data transfer outside the European Economic Area, the mechanisms and guarantees permitted under the GDPR apply.
5. Storage periods
We retain correspondence for as long as necessary to process the inquiry and a reasonable period for subsequent clarifications or protection of legitimate interests. Where the information is related to a contract, accounting document or legal dispute, longer statutory periods may apply. We periodically review the need for retention and delete the data when the grounds no longer apply.
Deadlines by category: Order data and accounting documents are kept for the applicable periods under the Accountancy Act and the Bulgarian Code of Civil Procedure (including 10 years for certain accounting registers and financial statements). Documentation of refusals and complaints is kept for as long as necessary for the case, legal obligations or protection of rights. Technical records and correspondence are reviewed periodically and kept only as long as necessary. Not all personal data is kept for the same period.
6. Cookies and external content
We use technically necessary cookies for the operation of the site and to preserve your privacy choices. Google Analytics and other optional technologies are only activated after consent, where required. You can refuse or withdraw your consent at any time via „Cookie Settings“ in the footer. Details of categories, purposes and terms are available in the separate Cookie Policy.
7. Your rights
Under the GDPR, you have the right, where the legal conditions are met, to access your personal data, rectify, erase, restrict processing, portability and object. Where the basis is consent, you can withdraw it without affecting the lawfulness of the processing before the withdrawal.
To exercise your rights, write to go@smartwash.me. You have the right to file a complaint with Personal Data Protection Commission.
8. Data Obligation
Completing the contact form is voluntary, but the fields marked in it are necessary for us to receive and process the inquiry. We do not make automated decisions with legal consequences based solely on this data.
9. Policy changes
We may update this policy as changes occur to the site, the services used, or applicable law. The current version will be published on this page.
10. Contract withdrawal and complaints forms
Applications can include order details, email, description and optionally a phone number for clarification. We use email for confirmation of receipt and subsequent correspondence. With the current configuration of WPForms Lite, applications are sent via work email and are not stored as standard local records in WPForms Lite. Correspondence and attached evidence are processed for the respective application and to fulfill legal obligations.
11. On-site services and vending machines
When using automated services and purchasing from vending machines, data on the transaction, object, device, selected service or product, date and time may be processed. In the case of a specific complaint, we may request vehicle data, including registration number, only if necessary to establish the case. When paying by card, the card data is processed by the relevant payment provider.
12. Video surveillance of the sites
SmartWash.me facilities only use video surveillance in clearly marked and necessary areas for access, vehicle movement, washing and servicing. The objectives are the safety of visitors and staff, the protection of people and property, the prevention and detection of incidents and the verification of specific reports of damage or irregularities. The legal basis is the legitimate interest of the company under Art. 6, par. 1, letter „e“ of the GDPR, after a documented assessment of the necessity and the balance between this interest and the rights of the data subjects.
Recordings may contain images of faces and vehicle registration numbers. No audio recording, biometric recognition or automated facial recognition shall be carried out unless a separate valid legal basis has been established in advance for a specific technology and clear information has been provided. Cameras shall be directed so as not to cover more space than necessary.
The usual records are stored for no longer than 14 calendar days and are then automatically deleted. The period is determined taking into account the automated nature of the service and the possibility for the customer to identify and report an incident or suspected damage after leaving the site. The records are used only to verify specific incidents, complaints and reports and to protect the rights and legitimate interests of customers and the company. When a specific record is necessary to clarify a case, only the relevant excerpt is separated and stored for the period necessary until the final completion of the investigation or dispute, to fulfill a legal obligation or to establish, exercise or defend legal claims, after which it is deleted.
Access is granted only to explicitly authorized persons under controlled access rules. Records are provided to competent authorities or other recipients only if there is a legal basis. Before entering a monitored area, a visible information sign is placed with details of the controller, the purposes, the legal basis, the basic retention period and the means of accessing this complete information. The affected persons may exercise their applicable rights in accordance with Section 7, while the rights of other persons in the records are protected.
13. Cross-border data processing
Some cloud, electronic, analytical or payment service providers may process information outside the European Economic Area. When such a transfer occurs, the mechanisms and safeguards of the GDPR apply, including an adequate level of protection solution or standard contractual clauses under the relevant circumstances. You can request information about the applicable mechanisms at go@smartwash.me.
14. Security and response to requests
We implement appropriate technical and organizational measures in accordance with the risks of the processing. We respond to requests to exercise rights without undue delay, as a rule within one month, with the possibility of extension under legal conditions. If necessary, we may request proportionate confirmation of the identity of the applicant.