Date of update: 01.09.2026
1. Information about the Controller
EasyRentBulgaria Ltd., UIC 202163172 (“EasyRent”, “we”, “us”, or the “Controller”), is a company registered with the Commercial Register of the Bulgarian Registry Agency, with its registered office and management address at: 8230 Nessebar, Sunny Beach Resort, Hotel Karlovo, ground floor, Bulgaria.
Contact details: e-mail: [email protected]; telephone: +359 899 999 179; website: https://easyrent.bg/.
2. Purpose and Scope of this Policy
EasyRent attaches great importance to the protection of personal data and processes personal data in accordance with applicable Bulgarian and European legislation, including Regulation (EU) 2016/679 (GDPR).
This Policy explains what personal data we process, the purposes and legal grounds for processing, how long we retain the data, with whom we may share it, how we protect it, and what rights data subjects have.
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, unlawful use, alteration, loss, destruction, or unauthorised disclosure.
3. Whose Personal Data Do We Process?
In connection with its business and services, EasyRent may process personal data relating to the following categories of individuals:
visitors to https://easyrent.bg/, whether they use the website as guests or through a registered user account;
individuals who create and maintain a user account;
individuals who make a reservation as guests without registering;
renters of motor vehicles or other items under an agreement with EasyRent;
drivers, including an additional driver named in the Individual Rental Agreement;
individuals on whose behalf or for whose benefit a reservation has been made;
participants, witnesses, or other persons connected with a road traffic accident, damage, theft, or another incident involving a rented vehicle;
individuals who submit enquiries, requests, reports, complaints, or other correspondence to EasyRent;
individuals whose data is contained in documents or correspondence provided to EasyRent, where processing is necessary for the provision of services, compliance with a legal obligation, or the protection of a legitimate interest.
4. What Personal Data Do We Process?
4.1. Data Processed When Using the Website
When you visit and use the website, technical data and logs may be processed where necessary for the normal and secure operation of the services, identification of technical problems, prevention of misuse, and compliance with legal obligations.
Such data may include date and time, IP address, visited URL, browser information, operating system, device information, request status, technical identifiers, and security-related data.
The website may use cookies and similar technologies. Details of the types of cookies, their purposes, and the available preference-management options are provided through the website's applicable cookie-management mechanism.
4.2. Registration and User Account
Creating a user account is not a mandatory condition for making an online reservation. A reservation may also be made as a guest.
When you create an account, we process the data necessary for registration, such as first name, surname, telephone number, e-mail address, and access-authentication data. We may also retain information concerning electronic statements related to registration and acceptance of the applicable terms, including date, time, and IP address.
Where the website functionality allows, additional data may be provided voluntarily to facilitate faster completion of future reservations. The user may edit or remove such data using the available functionality, unless specific data must be retained on another legal basis.
4.3. Reservation, Conclusion and Performance of an Agreement
EasyRent's services may be requested through the website, either as a guest or through a user account, through external partner online car-rental platforms, by telephone, or at an EasyRent office.
For taking steps prior to entering into an agreement, concluding and performing the agreement, and providing the services, we may process:
identification data: names, date of birth, nationality, address, and other data necessary for identification;
identity-document data necessary for identification and performance of the agreement;
driving-licence data: licence number, issuing country, date of issue and expiry, category, and other necessary data;
contact details: telephone number, e-mail address, and postal address where necessary;
reservation and rental data: reservation number, rental period, vehicle, locations, requested services, selected Coverage level, additional driver, and other contractual parameters;
financial and payment information: amounts due and paid, transaction information, security deposit, deposit refunds, fines, penalty notices, damage, fees, and other subsequently established liabilities;
partial payment-instrument data, such as a masked card number/last digits, card type, expiry date, transaction identifier, or token, where necessary to identify a payment, release or refund a security deposit, and carry out other permitted operations;
bank-account data where payment or refund is made by bank transfer;
data and documents relating to a road traffic accident, damage, theft, violation, fine, penalty notice, road toll or parking charge, administrative procedure, insurance event, or legal claim;
GPS/telematics data relating to the location and use of the rented vehicle where the vehicle is equipped with the relevant device or system.
4.4. Identity Documents and Driving Licence
When concluding and performing the agreement, EasyRent may require an identity card or passport to be presented for verification in order to establish the person's identity and verify the necessary data.
EasyRent does not make or retain a copy of the identity card or passport, unless expressly required by law in a specific case.
Driving-licence data is processed to the extent necessary to verify the driver's entitlement to drive, perform the agreement, comply with legal obligations, including those relating to road traffic violations, and establish, exercise, or defend legal claims.
4.5. Payment Instruments and Card Data
EasyRent does not retain full bank-card details and does not retain CVV/CVC codes.
For the purposes of identifying a payment, blocking, releasing or refunding a security deposit, and processing other permitted payments and subsequently established liabilities under the agreement, EasyRent may have access to and retain limited, masked, or tokenised payment-instrument data.
Payment transactions are processed through the relevant payment operator/payment service provider, which may also process and retain payment and partial card data in accordance with its own legal obligations, security requirements, and terms. EasyRent receives only the data necessary to manage and evidence the relevant transaction and perform the contractual relationship.
4.6. GPS and Telematics Data
Some vehicles may be equipped with GPS and/or other telematics devices. The data may be processed for the protection of the vehicle and property, locating the vehicle in the event of theft, unlawful retention or failure to return it, assistance in the event of an incident, monitoring unauthorised departure from the permitted territory, establishing and defending legal claims, and other legitimate purposes related to fleet management and security.
Depending on the ownership, financing, and technical equipment of the particular vehicle, GPS/telematics data may also be retained and processed by the vehicle lessor and/or the provider of the software and system to which the installed device is connected. In such cases, the relevant entity may act as an independent controller or as a processor, depending on the specific relationship and purposes of processing.
EasyRent processes only data to which it has lawful access and which is necessary for the relevant purpose.
4.7. Communications and Customer Service
For the handling of enquiries, requests, reports, complaints, and other correspondence, we process the information provided through the relevant communication channel, together with information about the actions taken and the outcome.
Telephone calls with EasyRent are not recorded.
4.8. Direct Marketing
Where applicable and where there is a valid legal basis, including consent, EasyRent may use contact details to send information about services, promotions, surveys, or other marketing communications.
Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.
4.9. Video Surveillance
For the protection of persons and property and the security of EasyRent's offices, service facilities, car parks, and other premises, video surveillance and recording may be carried out. Appropriate information is provided in areas subject to video surveillance in accordance with applicable requirements.
5. Purposes and Legal Bases for Processing
5.1. Steps Prior to Entering into and Performance of an Agreement
We process the data necessary to accept and manage reservations, identify the Renter and Driver, conclude and perform the Individual Rental Agreement, hand over and receive the vehicle, manage additional services and Coverage, payments, security deposits, refunds, communications, and customer service.
5.2. Compliance with Legal Obligations
We process data where necessary to comply with applicable legal obligations, including:
obligations under the Bulgarian Road Traffic Act and the provision of information to competent authorities in connection with violations, fines, and penalty notices;
tax, accounting, and reporting obligations;
obligations to retain or provide information to competent state, administrative, and judicial authorities;
obligations relating to personal-data protection, consumer protection, payment transactions, and other applicable regulatory requirements.
5.3. Legitimate Interests
Where the interests, rights, and freedoms of the data subject do not override them, EasyRent may process personal data on the basis of legitimate interests, including:
protecting vehicles, property, employees, and customers;
preventing, detecting, and investigating fraud, misuse, theft, unlawful retention, and other violations;
ensuring the security, normal operation, and technical maintenance of the website and information systems;
establishing, exercising, and defending legal claims, including in relation to damage, road traffic accidents, violations, fines, penalty notices, unpaid amounts, and subsequently established liabilities;
debt collection and, where applicable, assignment of receivables;
video surveillance for the protection of persons and property;
processing GPS/telematics data for fleet security and protection;
communicating with customers on important matters relating to the services provided;
managing relationships with partner car-rental platforms, vehicle lessors, insurers, and other providers necessary for the business.
5.4. Consent
Where processing is based on consent, the data is processed only for the purposes and to the extent for which consent was given. Consent may be withdrawn at any time.
6. Retention Periods
Personal data is retained only for the period necessary for the purposes for which it was collected, unless applicable law, a legal dispute, or a binding instruction from a competent authority requires a longer period.
The following principal retention periods apply:
registration and user-account data – for the duration of the registration and up to 5 years after its termination;
additional data voluntarily entered in the user account – until deleted by the user or until the registration is terminated, unless another retention period applies because the data has been used in connection with a service or legal obligation;
data relating to a reservation, rental, and performance of an agreement – for the term of the agreement and up to 5 years after its termination, unless a longer statutory period applies;
invoices, financial and accounting documents, and related information – for up to 10 years from the beginning of the year following the financial year to which they relate;
data relating to enquiries, complaints, reports, and customer service – for up to 5 years, unless a longer period applies;
data from surveys and feedback questionnaires – for up to 1 year;
data processed on the basis of consent – until consent is withdrawn or until the expiry of any period specified in the consent;
GPS/telematics data, where retained in systems under EasyRent's control – for up to 60 days, unless specific data is required in connection with a dispute, incident, violation, legal claim, or compliance with a legal obligation;
GPS/telematics data retained by vehicle lessors or providers of the relevant software/device – in accordance with the applicable retention periods of the relevant controller or processor and their contractual relationship with EasyRent;
video-surveillance recordings – for up to 2 months from the date of recording, unless a specific recording is required for an investigation, dispute, or legal claim;
system logs and security and technical-maintenance logs – for up to 1 year; logs relating to electronic statements are retained in accordance with the duration of the relevant legal relationship or applicable legal basis.
Where there is a binding instruction from a competent authority, a specific legal dispute, or proceedings, data may be retained for a longer period – in accordance with the authority's instruction or for up to 5 years after the final conclusion of the dispute or proceedings at all instances, where necessary to protect rights and legitimate interests.
The stated retention periods may be amended if the applicable legislation changes.
7. With Whom Do We Share Personal Data?
7.1. Service Providers Processing Data on Behalf of EasyRent
EasyRent uses external service providers for technical, administrative, and operational support. Depending on the specific service, they may act as processors on behalf of EasyRent and are required to process personal data only in accordance with applicable contractual and legal requirements.
Such providers may include:
hosting, cloud-infrastructure, and technical-support providers, including DigitalOcean;
security, protection, and web-content-delivery service providers, including Cloudflare;
web analytics and statistics providers, including Analytics services, where enabled and in accordance with the selected cookie preferences;
providers and subcontractors of software, IT, communications, and information services;
accounting, administrative, courier, and other service providers where access to data is necessary for the relevant service;
GPS/telematics and fleet-management system providers where they act on behalf of EasyRent.
7.2. Payment Operators and Financial Institutions
For payments, blocking, releasing or refunding security deposits, and other payment operations, data is exchanged with banks, card schemes/operators, payment institutions, and other payment service providers. They may act as independent controllers and/or processors depending on the specific service and applicable law.
EasyRent does not receive or retain full card details or CVV/CVC codes, but only the necessary partial, masked, or tokenised data and transaction identifiers.
7.3. Partner Car-Rental Platforms and Travel Intermediaries
Where a reservation is made through an external partner car-rental platform, travel agency, or other intermediary, the necessary data is exchanged between EasyRent and the relevant partner for the creation, confirmation, amendment, performance, and accounting of the reservation, payments, and related services.
The relevant platform or intermediary may also process personal data as an independent controller in accordance with its own privacy policy.
7.4. Vehicle Lessors, Insurers and Vehicle-Related Service Providers
Where a vehicle is provided under a lease or another form of financing, or where necessary in connection with insurance, damage, a road traffic accident, theft, a GPS/telematics system, repair, or maintenance, data may be disclosed to vehicle lessors, insurers, repair facilities, telematics-system providers, and other parties to the extent necessary for the relevant purpose.
7.5. Competent Authorities, Fines, Penalty Notices and Violations
Where there is a legal basis, EasyRent may provide data to the Bulgarian Ministry of Interior, Traffic Police, courts, prosecution authorities, municipalities, road and parking operators, and other competent authorities or organisations.
This includes processing and providing data to identify the Renter and/or Driver in connection with fines, penalty notices, road and parking violations, administrative proceedings, and other violations committed in connection with the use of the rented vehicle.
7.6. Legal, Accounting and Debt-Collection Professionals
Where necessary to establish, exercise, or defend rights and claims, EasyRent may provide the necessary data to lawyers, notaries, accountants, auditors, debt-collection companies, assignees of receivables, and other professional advisers or parties involved in debt collection.
8. Transfers of Personal Data Outside the European Economic Area
Some of the technology providers used by EasyRent, including Cloudflare, Analytics service providers, and DigitalOcean, may be international companies or may use infrastructure and subcontractors in different countries.
Where the use of such services involves a transfer of personal data outside the European Union/European Economic Area, EasyRent takes the necessary measures to ensure that the transfer is carried out on an applicable legal basis and subject to appropriate safeguards under the GDPR, including an adequacy decision, Standard Contractual Clauses, or another permitted mechanism, where applicable.
Where processing through analytics or other non-essential technologies requires consent, such technologies are activated in accordance with the user's choice through the cookie-management mechanism.
9. Personal Data Security
EasyRent implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.
Access to personal data is restricted to persons who require it for the performance of their employment, contractual, or legal duties.
10. Data Subject Rights
Subject to applicable law, you have the following rights:
10.1. Right to Information
You have the right to receive clear information about the processing of your personal data. This Policy is intended to provide the principal information about the processing activities carried out by EasyRent.
10.2. Right of Access
You have the right to obtain confirmation as to whether EasyRent processes your personal data and, where it does, to access that data and obtain a copy subject to the conditions of the GDPR.
10.3. Right to Rectification
You have the right to request the correction or completion of inaccurate or incomplete personal data. Where such functionality is available, certain data in your user account may be updated directly by you.
10.4. Right to Erasure
You have the right to request erasure of personal data where the grounds provided for in the GDPR apply. This right is not absolute and may not apply where retention is necessary to comply with a legal obligation or to establish, exercise, or defend legal claims.
10.5. Right to Restriction of Processing
You have the right to request restriction of processing in the cases provided for by applicable law.
10.6. Right to Data Portability
Where the statutory conditions are met, you have the right to receive personal data you have provided in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
10.7. Right to Object
You have the right to object to processing based on legitimate interests on grounds relating to your particular situation. Where personal data is processed for direct marketing, you may object at any time, in which case processing for that purpose will cease.
10.8. Right to Withdraw Consent
Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
10.9. Automated Decision-Making
You have the right not to be subject to a decision based solely on automated processing, including profiling, where such a decision produces legal effects concerning you or similarly significantly affects you, except in the cases provided for by law and subject to the required safeguards.
As of the date of this Policy, EasyRent does not use automated decision-making of this kind in the provision of its car-rental services.
10.10. Right to Lodge a Complaint
You have the right to lodge a complaint with a competent supervisory authority. In the Republic of Bulgaria, this is the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg.
11. How Can You Exercise Your Rights?
You may submit a request to EasyRent using the contact details specified in Section 1 or at one of the company's offices. To protect your data, where necessary we may request additional information enabling us to verify the identity of the applicant, without collecting more data than is necessary.
Requests are handled within the time limits and under the conditions provided for by applicable law.
12. Relationship with the General Terms and Conditions
This Policy applies in conjunction with EasyRent's General Terms and Conditions and Individual Rental Agreement. Where processing relates to an additional Driver, a reservation made through a partner platform, a payment instrument, a security deposit, damage, a fine, a penalty notice, a road toll or parking charge, or another subsequently established liability, personal data is processed only to the extent necessary for performance of the agreement, compliance with a legal obligation, protection of a legitimate interest, or another applicable legal basis.
13. Changes to this Policy
EasyRent may amend and update this Policy where there are changes to its services, technologies used, service providers, or applicable legislation.
The current version is published at https://easyrent.bg/ and states the date of the latest update. Where applicable law requires individual notification of a material change, such notification will be provided in an appropriate manner.
Privacy Policy – EasyRentBulgaria Ltd.