For booking and enquiries: +359 892 476 929 +359 892 476 547

Privacy Policy

Privacy Policy

With this Privacy Policy, we aim to clarify what information and why we collect from you when you visit and use the website (the“Site”) and all services presented and/or provided to/through/in connection with it, including marketing, information campaigns, rentals, transfer services, promotions and other events (collectively “Service/s”), how we use and protect it and what rights you have in relation to such processing of your personal data.

If you have any concerns or questions about this Privacy Policy or our practices in the area of processing your data, you can contact us at the contact details provided below. If there are terms in this Privacy Policy with which you do not agree, please discontinue visiting and using the Site and the Services.

Information About the Personal Data Controller

VAN-AL Ltd., registered in the Commercial Register of the Registry Agency under UIC 205394711, with registered office and management address: Sofia, 3 Lyuborodie St., web:, email:, mobile: 00359 (0) 892 47 69 29 (“we”, “us”, “our”), processes personal data in its capacity as a personal data controller within the meaning of the Personal Data Protection Act and the General Data Protection Regulation.

The information provided is intended to outline our approach to the lawful processing of your personal data and their protection within the framework of our activities.

We take the protection of your personal data as our top priority.

What Data Do We Process

We only collect the following categories of personal data depending on the purpose for which we process it:

  • Personal information (names, PIN/date of birth and place of birth, personal number of a foreigner, citizenship, address/s, including country, data from an identity document, telephone, e-mail address) which you provide us when entering into a contract with us;
  • Banking information – credit or debit card information, bank account number or other banking and payment information in connection with payments made to us;
  • Data about your location that we receive from a GPS tracking system built into your rental car, as well as when you voluntarily provide us by uploading to the Site images with embedded location data;
  • Electronic identification data (IP address, browser version, operating system), which we collect through cookies in connection with ensuring the functioning of the Site and improving the user experience of using it;
  • Data you voluntarily provide to us when leaving a review on the Site – names, photo, electronic identification data, including a hash (an anonymous string based on your email address) that may be provided to the Gravatar service we use. The Gravatar Privacy Policy can be found here: Once your comment is approved, your profile picture will be publicly visible on it;
  • Data from registered accounts, such as names and email address, according to your account settings on the relevant platform – if you use any functionalities provided by us to access social networks and media through the Site;
  • Email address if you have subscribed/opted in to receive informative messages from us;
  • Communication information (the information we learn about you from correspondence between us, such as names, email address and telephone number);
  • Special categories of personal data – biometric data (eg: ID photo, photos and video content with your image that you voluntarily provide us to share your user experience on the Site and/or in our profiles in social networks and media or platforms for sharing video content, as well as collected as a result of video surveillance of our physical facilities).

For What Purposes Do We Process Your Data

We process your personal data for the following purposes:

  • To process inquiries and requests for the Services provided;
  • To create an opportunity to register a user profile on the Site in order to facilitate subsequent use and improve the user experience;
  • To fulfill a contract concluded between us and you or to take steps to enter into such a contract. The provision of personal data is voluntary and is carried out on the basis of statutory permission. In case of refusal to provide identification data, we will not be able to provide the requested Service;
  • For the implementation of marketing studies (obtaining information about the perception of our service, as well as the needs and expectations of current and potential customers with a view to further developing the services and improving the level of our customer service);
  • To send newsletters and useful, up-to-date and interesting information about the Services we provide;
  • To fulfill legal requirements for documentation, reporting, storage and archiving of documents;
  • For the purposes of protecting our legitimate interests in protecting our property and ensuring your safety;
  • For strategic planning of our business and management of business processes;
  • To review and provide an answer to your inquiry, recommendation, complaint or appeal;
  • In order to establish, exercise or defend our legal claims;
  • To achieve trouble-free and error-free functioning of the Site;
  • To keep statistics on the visitation and usability of the Site;
  • To improve the user experience of using the Site and the usefulness of the Services;
  • To enable you to access our social network and media profiles.

Grounds for Processing of Your Personal Data

We process your personal data on the following grounds:

  • The processing of personal data that you provide to us when making a reservation on the Site and/or when concluding a contract with us at our physical location is processed on the basis of a concluded contract for the purposes of its performance or to take steps prior to entering into a contract.
  • If you contact us by phone or email, the contact details you share with us when contacting us will be stored for the purposes of processing your inquiry and follow-up questions. If your inquiry is related to the performance of a contract with us or pre-contractual relations, the processing of such data is based on these contractual/pre-contractual relations. In all other cases, the processing is based on our legitimate interest in effectively processing inquiries to us or on your consent, if necessary.
  • The data we collect through cookies is primarily processed based on our legitimate interest in facilitating the proper functioning of the Site. To the extent that cookies are applied for purposes other than ensuring the functionality of the Site, you will be expressly invited to give your consent to the use of the relevant cookies and the processing of the information we receive through them. You have the right to refuse your consent to access your personal data through cookies other than the so-called “necessary cookies”; however, the refusal to give consent to the application of certain types of cookies may lead to the loss and/or inaccessibility of some functionalities of the Site, implemented through the respective cookies.
  • The data we collect and share through third-party services and tools is processed either based on our legitimate interest in making the Site more attractive to visitors and potential users, or on your express prior consent. The different cases are described below in this Privacy Policy.
  • The data we collect to send you newsletters and interesting offers, if applicable, is processed based on your express prior consent. You can learn more about your options regarding data processing for these purposes in the relevant sections of this Privacy Policy below.
  • In addition, we may process and store your personal data to protect our legitimate interests from fulfilling our administrative and/or contractual obligations arising from applicable laws and regulations (such as accounting, statistics, taxation, responding to requests from public organs, etc.).
  • We process personal data about your location, which we learn through a GPS tracking system built into your rental car, based on our legitimate interest in monitoring your safety, for example to be able to assist in the event of an accident, and to protect our property. Information about your location may be shared with us and other visitors to the Site voluntarily by you when you upload images with embedded location data (EXIF GPS) to the Site. In case you do not wish to share such information with us and third parties, please avoid sharing such images.
  • We process your names, comments, photos and video content with your image based on your express consent to share such information on the Site, as well as in social networks and media and platforms for sharing video content.
  • In addition, due to the identified high risk for the security of our physical facilities, we carry out permanent video surveillance, upon which it is possible to process your personal data when you visit our facility in connection with such video surveillance. Video surveillance is carried out solely and only in our facilities based on our legitimate interest in protecting our property and preventing acts of vandalism and crime.
  • If your personal data is processed on the basis of your consent, you can always withdraw such consent by notifying us by email or by following the link provided for the purpose at the end of the relevant message. Please note that the lawfulness of data processing carried out before the withdrawal of your consent remains unaffected by the withdrawal.


“Cookies” are text files stored on your device for the purpose of collecting information about your user behavior. When you visit the Site, we automatically collect information from you through cookies or similar technology.

We use cookies to personalize the operation of the Site and to analyze user behavior when visiting it. Also, we may use cookies for marketing purposes and to provide certain functionalities (such as social media tools). Information collected through cookies may be shared with our social network and media partners, advertising and data analysis as described below in this Privacy Policy.

Based on our legitimate interests to improve the functionality and user experience of visiting and using the Site, we have the right to use cookies that are necessary for its operation. Other types of cookies can only be applied with your consent. When you visit the Site for the first time, you will be asked to select the cookies you want to allow access to your device. If you change your mind later, you can change your cookie settings or withdraw your consent to the use of other than necessary cookies according to your browser type as follows:

Internet Explorer:





To make it easier for you to make an informed decision about which cookies to allow to be stored on your device and which cookies you prefer not to have access to your device, below you will find a description of the cookies that the Site applies when you access it and you use:

  • If you leave a comment on our Site, you can allow your name, email address and website to be saved in cookies. These are for your convenience so you don’t have to fill in your details when leaving another comment. These cookies will be kept for one year.
  • If you have an account and log in to the Site, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is deleted when you close your browser.
  • When you log into your account on the Site, a few more cookies will save your login information and your preferences about what to see on the screen. Login cookies expire after two days and screen preference cookies after a year. If you choose the remember option, your login information will be kept for two weeks. If you log out, the login cookies will be deleted.
  • If you edit or publish an article, an additional cookie will be stored in your browser. It won’t contain any personal data, it will simply add the identifier of the post you have just edited. It expires in one day.

Disclosure of Your Personal Data to Third Parties

Sometimes, in order to provide access and full functionality of the Site and/or to fulfill contractual obligations to you and our contractual and/or administrative responsibilities arising therefrom or from applicable law, we may share your personal information with external service providers.

We require all service providers with whom we share your data to respect the security of your personal data and to treat it in accordance with applicable regulations. We do not allow any of our service providers to use your personal data for their own purposes and we only allow them to process your personal data for specified purposes and in accordance with our instructions.

We use hosting services to operate the Site. The personal data collected through the Site is stored on the servers of our hosting service provider, with whom we have an agreement guaranteeing the security of your data when processing it for the purposes of external hosting.

We use tools to analyze user behavior based on our legitimate interest in anonymized analysis of the behavior of visitors and users of the Site in order to optimize its functionality and its advertising. The operators of these tools collect information about you, such as location and user behavior. If a corresponding consent was required for this purpose (for example, consent to store cookies), the processing of data collected in this way is carried out on the basis of this consent, which can be withdrawn at any time.

In certain cases, in order to fulfill our obligations under contracts concluded with you, if applicable, or legal ones, it is necessary or we will be obliged to disclose personal data provided by you to our partners (e.g. accounting) or to competent authorities.

Links to Social Networks

We may implement plugins of social networks and media on the Site in order to establish a direct connection with the server of the operator of the relevant social network/media. You can recognize the plugins by the logo of the respective social network. By pressing a button with the logo of the relevant social network, you agree to establish a direct connection with the server of the operator of this social network, whereby this operator receives information about your visit to the Site. If at the same time you are logged into your profile in the relevant social network, its operator will be able to connect your visit to the Site with your profile in the social network. Please note that we, as the operator of the Site, do not receive information about the data provided to social media and networks and their use. Information about this can be obtained from the privacy policy of the relevant social media or network.

Term of Storage of Your Data

We protect and store your personal data in a secure manner. For more information, see the “How we protect your personal data” section.

Unless a specific storage period is specified in this Privacy Policy, we will retain your personal data until the purpose for which it is processed is fulfilled. Where personal data is processed on a contractual basis, however, we will store it until the expiry of the applicable limitation periods for making claims under or related to the relevant contractual relationship.

If you register a user profile on the Site, we will store the information you provide in the profile until you decide to delete your profile. In the latter case, we may continue to store your personal data provided on another basis according to the applicable basis and processing terms as described in this Privacy Policy.

The personal data that you have provided us voluntarily, for example when leaving a comment on the Site, sharing images, etc., or that we process based on your consent to this, will be processed until you notify us that you wish us to stop processing, respectively, that you withdraw your consent to the processing.

If we process your personal data for the purpose of fulfilling administrative obligations, for example tax, accounting, statistical purposes, we store your personal data until the statutory storage periods expire.

If you make a valid request to delete your data or withdraw your consent to the processing of your personal data, your data will be deleted, unless we have other legal grounds for storing your data (e.g. storage periods for commercial or tax purposes, limitation periods); in the latter case, the deletion takes place after the relevant reason for storage has ceased.

Marketing Communications

We reserve the right to introduce the possibility of sending up-to-date information about the Site and the Services offered, which we think you may like.


To object to the processing of your personal data for direct marketing purposes, you can follow the link provided for this purpose in the relevant marketing message or write us an email.

How We Protect Your Personal Data

To ensure adequate protection of the data of our customers, we implement all necessary organizational and technical measures provided for in the applicable legislation.

For security reasons and to protect the transmission of confidential content, the Site uses SSL encryption. You can recognize an encrypted connection by the fact that the address bar of the browser changes from “http://” to “https://” and by the lock symbol. When SSL encryption is activated, the data you send us cannot be read by third parties.

We also limit access to your personal data to those employees, external service providers and other third parties who have a legitimate right to access it. They will process your personal data only on our instructions and they are subject to confidentiality obligations.

We have procedures in place to deal with any suspected breach of personal data security and will notify you and the relevant authorities of a breach when we are legally required to do so.

What Are Your Rights as a Data Subject?

As a subject of personal data processed by us, you have the following rights:

  • Right of access – You have the right of access to information about the categories of personal data processed, their source, recipients of your personal data, the purposes of the processing and other information related to the processing, when applicable. Such information is generally provided free of charge, with the right to charge a reasonable administrative fee upon request for additional copies;
  • Right to withdraw consent for processing – You have the right to withdraw at any time the consent you have given for the processing and storage of your personal data in cases where they are processed only on the basis of consent (e.g. in cases of direct marketing of our Services or for the purposes of marketing research). The withdrawal of your consent does not affect the lawfulness of the processing of your data carried out up to that point;
  • Right to rectification – You have the right to ask us to correct inaccurate or to complete incomplete information about you;
  • Right “to be forgotten” – You have the right to submit a request for deletion of your personal data, which are stored and processed by us, in cases where there is no longer ground for their processing;
  • Right to restriction of processing – You have the right, under certain conditions, to request restriction of the storage and processing of your personal data by us;
  • Right to object to processing – You have the right, under certain conditions, to object to the processing of your personal data by us;
  • Right to portability – You have the right to receive your personal data that you have provided to us in a structured, widely used and machine-readable format and to transfer this data to another controller when the data is processed on the basis of your consent or in performance of a contract concluded between you and us, as well as when the processing is carried out in an automated manner;
  • Right of complaint – You have the right to file a complaint with a supervisory authority, including in the country of your habitual residence, your place of employment or the place of the alleged infringement. The supervisory body competent for our activities is the Commission for Personal Data Protection at the following address: Sofia 1592, Prof. Tsvetan Lazarov Blvd. 2, phone: 02/91-53-518, e-mail:

If you wish to exercise any of the rights listed, please contact us by email. We will respond to any of your requests without undue delay within one month of receiving your request.

If we are unable to fully deal with your request within one month (due to its complexity, the need for assistance from a third party or the number of requests), we may extend this period and we will explain to you the reasons for this.

Changes to Our Privacy Policy

We reserve the right to make changes or modifications to this Privacy Policy at any time. Such updates are necessary including for the fulfillment of our statutory obligations in the field of data protection and on the occasion of changes in the current regulations. You can find our current Privacy Policy at any time on this page.

Privacy Policies of Other Websites

Articles on the Site may be embedded (videos, images, content, etc.). Where such embedded content is available, it will be expressly identified on the Site with the source/original site where such content was originally published. Embedded content from other sites accepts and treats the Site visitor as a visitor to its own site. These sites may collect data about you, use cookies, embed additional third-party statistics tools, track how you use these tools, including how you use embedded content if you have an account and are logged in to the Site. Our Privacy Policy applies only to our Site. Therefore, you should be aware that our Privacy Policy does not apply to embedded content from other sites, whose privacy policies you should familiarize yourself with in connection with using and accessing content on the Site.