Services How it works Pricing Contact Blog Create free account Log in to Garage Manager
Legal

Privacy Policy

Garage Manager — garagemanager.eu

Last updated: March 2026

1. Introduction

This Privacy Policy explains how Графикс Технолъджи Интернешънъл ЕООД (UIC 202905717), Sofia, Bulgaria ("we", "us", or "Company") collects, uses, and protects personal data when you use the Garage Manager web application ("Service").

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR), the Bulgarian Personal Data Protection Act (Закон за защита на личните данни, ЗЗЛД), and the Bulgarian Electronic Communications Act (Закон за електронните съобщения) implementing the ePrivacy Directive.

This notice is provided pursuant to GDPR Art. 13 (data collected directly from you) and Art. 14 (data obtained from other sources).

2. Data Controller

Графикс Технолъджи Интернешънъл ЕООД
Sofia, Mladost 1-22, Bulgaria
UIC: 202905717
Email: office@garagemanager.eu

We have not appointed a dedicated Data Protection Officer, as we do not fall within the mandatory categories of Art. 37 GDPR. Privacy queries are handled directly at the contact above.

3. What Personal Data We Collect

3.1 Account and Profile Data

  • Name, email address, and password (stored as a bcrypt hash — never in plain text)
  • Business name, workshop address, and phone number
  • Billing address, VAT number, and company registration details (when provided for invoicing)

3.2 Data You Enter Into the Service

You act as the data controller for personal data of third parties (your clients, employees, etc.) entered into the Service. We act as a data processor on your behalf. You are responsible for ensuring a lawful basis exists for such processing.

  • Client records: names, contact details, vehicle information
  • Work orders, repair descriptions, and service history
  • Invoices and financial transaction records
  • Team member accounts created within your workspace

3.3 Usage and Technical Data

  • IP address, browser type, and device information
  • Pages visited, features used, and session duration
  • Error logs and diagnostic information

3.4 Payment Data

Payment card details are processed directly by our payment providers (Stripe, PayPal, Skrill, ePay.bg). We store only a payment reference, the last four digits of the card, and the card type. Full card numbers are never transmitted to or stored on our systems.

4. Purposes and Legal Basis for Processing

We process personal data only where we have a lawful basis under GDPR Art. 6:

  • Contract performance (Art. 6(1)(b)) — creating and managing your account; providing the Service; processing payments; sending transactional emails (receipts, password resets, subscription notifications).
  • Legal obligation (Art. 6(1)(c)) — retaining financial records and invoices in accordance with the Bulgarian Accounting Act (Закон за счетоводството) and VAT Act (ЗДДС); responding to lawful requests from public authorities.
  • Legitimate interests (Art. 6(1)(f)) — security monitoring and fraud prevention; error logging and service reliability; product analytics and feature improvement. Our legitimate interests do not override your fundamental rights; you may object to this processing (see section 10).
  • Consent (Art. 6(1)(a)) — analytics cookies and optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Statutory or contractual requirement

Providing your name and email address is a contractual requirement for account registration. Without it, we cannot provide the Service. Providing billing details is required only when subscribing to a paid plan and is both a contractual and, for invoicing, a legal requirement. All other data is provided voluntarily.

5. Data Retention

  • Account data: Retained for the lifetime of your account. Upon account deletion, personal data is deleted or anonymised within 90 days, subject to the exceptions below.
  • Financial records and invoices: Retained for 10 years from the end of the financial year in which the transaction occurred, as required by Art. 12(1) of the Bulgarian Accounting Act and the VAT Act (ЗДДС). This obligation applies even after account deletion.
  • Usage and technical logs: Retained for up to 12 months for security and diagnostic purposes.
  • Anonymised analytics data: May be retained indefinitely.

6. Third-Party Processors

We share data with trusted sub-processors only as necessary to provide the Service. All processors are bound by data processing agreements compliant with GDPR Art. 28:

  • Stripe, Inc. — payment processing and card tokenisation (US; relies on EU Standard Contractual Clauses)
  • PayPal (Europe) S.à r.l. et Cie, S.C.A. — alternative payment processing (Luxembourg, EEA)
  • Skrill Limited — alternative payment processing (UK; relies on adequacy decision or SCCs)
  • ePay.bg (Fibank) — payment processing (Bulgaria, EEA)
  • Google LLC — reCAPTCHA bot prevention and Google Analytics (US; relies on EU SCCs and, where applicable, EU-US Data Privacy Framework)
  • Cloud infrastructure provider — hosting and database services; servers located within the EU/EEA

We do not sell your personal data. We do not share data with third parties for their own marketing purposes.

7. International Data Transfers

Where personal data is transferred outside the European Economic Area (e.g., to US-based processors), we rely on one or more of the following safeguards as applicable: EU Standard Contractual Clauses (SCCs) adopted by the European Commission; the EU-US Data Privacy Framework (where the recipient is certified); or another lawful transfer mechanism under GDPR Chapter V. You may request a copy of the relevant safeguards by contacting us.

8. Cookies and Similar Technologies

We use cookies under the Bulgarian Electronic Communications Act (Art. 248a) implementing the ePrivacy Directive, which requires prior, informed, and freely given consent for non-essential cookies:

  • Strictly necessary cookies — session management, CSRF protection, and authentication. These are required for the Service to function and do not require consent.
  • Analytics cookies — understanding how users interact with the Service (e.g., Google Analytics). These are only placed after you provide explicit consent via the cookie consent banner.
  • Third-party functional cookies — reCAPTCHA (Google) and payment provider scripts. These are loaded only when you interact with the relevant feature.

You may withdraw cookie consent at any time by adjusting your settings in the cookie consent banner or by configuring your browser to block cookies. Withdrawing consent does not affect essential cookies required for the Service to operate.

9. Data Security

We implement appropriate technical and organisational measures as required by GDPR Art. 32, including: TLS encryption for all data in transit; bcrypt password hashing; role-based access controls; multi-factor authentication (MFA) option; and audit logging for sensitive operations.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Commission for Personal Data Protection (КЗЛД) within 72 hours of becoming aware of the breach, in accordance with GDPR Art. 33. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay (GDPR Art. 34).

10. Your Rights Under GDPR

Under GDPR Arts. 15–22, you have the following rights regarding your personal data:

  • Access (Art. 15) — obtain a copy of the personal data we hold about you and information about how it is processed.
  • Rectification (Art. 16) — request correction of inaccurate or incomplete data.
  • Erasure (Art. 17) — request deletion of your data where it is no longer necessary, you withdraw consent, or processing is unlawful. This right is subject to our legal retention obligations (section 5).
  • Portability (Art. 20) — receive data you have provided to us in a structured, commonly used, machine-readable format (applies to data processed by automated means on the basis of consent or contract).
  • Restriction (Art. 18) — request that we restrict processing of your data in specified circumstances.
  • Objection (Art. 21) — object to processing based on legitimate interests or for direct marketing purposes. Where you object, we will cease processing unless we can demonstrate compelling legitimate grounds.
  • Withdraw consent (Art. 7(3)) — where processing is based on consent, withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
  • No automated decision-making (Art. 22) — the right not to be subject to a decision based solely on automated processing (including profiling) that produces significant legal or similarly significant effects. We do not carry out such processing.

To exercise any of these rights, submit a request to privacy@garagemanager.eu. We will respond within one month of receiving your request (GDPR Art. 12(3)). This period may be extended by a further two months where requests are complex or numerous, with notice given to you.

We may ask you to verify your identity before processing a request.

11. Right to Lodge a Complaint

You have the right to lodge a complaint with the Bulgarian supervisory authority:

  • Commission for Personal Data Protection (Комисия за защита на личните данни — КЗЛД)
  • 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
  • +359 883 386 201
  • kzld@cpdp.bg
  • www.cpdp.bg

If you are resident in another EU member state, you may also lodge a complaint with the supervisory authority in your country of residence.

12. Children's Privacy

The Service is directed exclusively at business users. We do not knowingly collect personal data from individuals under 16 years of age. If we become aware that such data has been collected, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice before they take effect. The "Last updated" date at the top of this page always reflects the most recent revision. Where required by law, we will obtain fresh consent for any new processing purposes.

14. Contact

For any privacy-related questions, requests, or complaints:

  • Company: Графикс Технолъджи Интернешънъл ЕООД
  • Address: Sofia, Mladost 1-22, Bulgaria
  • Email: privacy@garagemanager.eu