Ford Kuga

We, the companies within MOTO-PFOHE group: МOTO-PFOHE EOOD, МOTO-PFOHE LEASING EOOD, PFOHE AGENCY EOOD and МOTO-PFOHE BG EOOD („companies within МOTO-PFOHE group“ or „we“), collect and process personal data of natural persons, our clients, contractors or other contacts on the Bulgarian market („you“). We are aware of our responsibility to take care of and protect your personal data and to comply with the applicable personal data privacy and protection legislation.

With this Data Privacy Policy („Policy“ or „Privacy Policy“) we would like to introduce you to the way we collect and use personal data you provide to us. The Policy describes what methods the companies within MOTO-PFOHE group, respectively our service providers, use and for what purposes they process the information collected from or about you during conclusion of contracts, use of maintenance and repair services or use of services via the websit  www.usedcars.motopfohe.com („Website“).

IMPORTANT:  Read this Policy carefully. It provides important information about the way we process personal data and explains your legitimate rights. This Policy does not aim to modify the terms and conditions of any contract concluded with us, nor any rights you have under the applicable personal data protection legislation. By giving your personal data or using the Website you trust us and voluntarily accept the terms and conditions of this Data Privacy Policy.

COMPANIES WITHIN MOTO-PFOHE GROUP

________

The companies within MOTO-PFOHE group are joint controllers („Joint Controllers“):
1.1 MOTO-PFOHE EOOD, with seat and registered office in the city of Sofia, postal code 1360, Lyulin District, 444 Slivnitsa Blvd., registered in the Commercial Register and the Register of Non-Profit Legal Entities (NPLE) under Unified Identification Code (UIC) 000646811, Telephone: 02/9 842 202; Fax: 02/9 842 233, Email: n.serafimova@ford.bg.  If you have questions regarding privacy issues, please contact Sergey Kirchev at privacy@motopfohe.bg  
1.2 MOTO-PFOHE LEASING EOOD, with seat and registered address in the city of Sofia, postal code 1360, Lyulin District, 444 Slivnitsa Blvd., registered in the Commercial Register and the Register of NPLE under UIC 131452951, Telephone: 02/9 842 202; Fax: 02/9 842 233, Email: n.serafimova@ford.bg. If you have questions regarding privacy issues, please contact Sergey Kirchev at privacy@motopfohe.bg  
1.3 PFOHE AGENCY EOOD, with seat and registered office in the city of Sofia, postal code 1360, Lyulin District, 444 Slivnitsa Blvd., registered in the Commercial Register and the Register of NPLE under UIC 130864464, Telephone: 02/9 842 202; Fax: 02/9 842 233, Email: n.serafimova@ford.bg. If you have questions regarding privacy issues, please contact Sergey Kirchev at privacy@motopfohe.bg  
1.4 MOTO-PFOHE BG EOOD, with seat and registered office in the city of Sofia, postal code 1360, Lyulin District, 444 Slivnitsa Blvd., registered in the Commercial Register and the Register of NPLE under UIC 175216529, Telephone: 02/9 842 202; Email: n.serafimova@ford.bg. If you have questions regarding privacy issues, please contact Sergey Kirchev at privacy@motopfohe.bg  
1.5 The companies within MOTO-PFOHE group, each of them in its capacity of controller and joint controllers, shall be liable for the correct and legitimate processing of personal data you provide during conclusion of contracts, use of maintenance and repair services or use of services via the Website, or use of other services of ours.
1.6 You must be aware that although one of the companies within MOTO-PFOHE group may be primarily liable for the protection of your personal data, the information may be a part of databases which may be accessible by the other companies within the group. When accessing your personal data, each and any of the companies within MOTO-PFOHE group shall meet the standards imposed by this Policy.

HOW DO WE COLLECT YOUR PERSONAL DATA

________

The companies within MOTO-PFOHE group may process your personal data in the following cases:

• If you contact us directly, for example, by visiting our sales representation office or by filling in a form for registration on the Website, or when using the customer service phone lines to request information about our products and services.
• If you provide your data during conclusion of contracts for purchase and sale, leasing and/or insurance of a new or used vehicle, if you use maintenance and repair services or rent a car;
• If you buy a product or service directly from our sales representation offices or our Website;
• If you reply to our direct marketing campaigns, for example, by filling in a survey/questionnaire or inputting data online on the Website;
• If vehicle data (including vehicle registration number) has been transferred to us, for example to authorised sales representatives, during the servicing or repair of your vehicle.
• If other legal entities within MOTO-PFOHE group or business partners make a permitted transfer of your personal data to us.

If you provide information on behalf of another person/entity you must ensure that said person/entity has been provided with this Privacy Policy and that the requirements of the applicable legislation have been complied with before you provide the information.

If you are under the age of 14, please do not provide us with any of your personal information unless you have the permission of your parent or guardian to do so. 

We ask for your cooperation to keep your information up-to-date by notifying us of any changes in your personal data.

WHAT PERSONAL DATA WE COLLECT

________

The following categories of personal data may be collected from and about you depending on whether you are our client, contractor and what our services you use:

• Physical identity - full name, personal ID number or age, ID card data, address, telephone number, email address, image, number of family members;
• Economic identity - financial status, bank account information;
• Civil and legal status - Driving Licence data;
• Interests - information you provide to us regarding your interests, including types of vehicles you are interested in; 
• Use of the Website or other websites of ours – date and time of your visit; how many and which pages do you view during your visit and how long do you stay there; your Internet domain name (this could be your Internet Services Provider like NET 1 or your workplace) and the IP address (this is a number assigned to your computer when you browse the Internet), which enables your access to our site; the Internet browser you use (for example, MS Internet Explorer or Google Chrome) and the operating system of your computer (for example, Windows 8.1); the site you have visited before visiting www.usedcars.motopfohe.com or another website of ours (for example, Yahoo if you have found us using this search engine);
• Information about sales and maintenance and repair services – information about purchases, including preferred sales representative, client number and contract number, maintenance and repair services, including complaints and claims. 
• Image (We carry out video surveillance in the commercial premises of our sites). 

HOW YOUR PERSONAL DATA MAY BE PROCESSED

________

The processing of your personal data in compliance with the Bulgarian legislation and the principles of the framework directives of the European Union for protection of information, particularly the General Data Protection Regulation (ЕU) 2016/679 („Regulation“) should be based on any of the legal grounds provided for in the Regulation. We are required to specify the grounds for any use of your personal data as follows:

4.1 Purpose: to exercise the rights and fulfill the obligations of the companies within MOTO-PFOHE group arising out of the contracts concluded with you;
Ground for processing: performance of a contract in the meaning of Art. 6, Para. 1, letter b) of the Regulation or compliance with a legal obligation in the meaning of Art. 6, Para. 1, letter c) of the Regulation;
4.2 Purpose: for the companies within MOTO-PFOHE group to carry out their financial and accounting activity during and in connection with contracts concluded with you, including: receiving and ordering payments of outstanding amounts to bank accounts, issuing of invoices;
Ground for processing: performance of a contract in the meaning of Art. 6, Para. 1, letter b) of the Regulation or compliance with a legal obligation in the meaning of Art. 6, Para. 1, letter c) of the Regulation;
Purpose: to carry out correspondence with potential, current and former clients of the companies within MOTO-PFOHE group and to service clients, including in order to reply to your questions and meet your requests, for example, to send you the requested documents or notifications by email; to send you important information and/or other administrative notifications regarding the Website; the relationships with us or changes in our terms and conditions or policies; 
Ground for processing: performance of a contract in the meaning of Art. 6, Para. 1, letter b) of the Regulation; or compliance with a legal obligation in the meaning of Art. 6, Para. 1, letter c) of the Regulation; or the explicit consent of each data subject in the meaning of Art. 6, Para. 1, letter a) of the Regulation or the legitimate interests of the controller in the meaning of Art. 6, Para. 1, letter f) of the Regulation;
4.3 Purpose: to provide specific services like test drive, to provide information about cars, cars for rent, maintenance and repair services, information bulletins, printed editions and materials, brochures, electronic and print versions of MOTO-PFOHE NEWS magazine;
Ground for processing: explicit consent of each data subject in the meaning of Art. 6, Para. 1, letter a) of the Regulation;
4.4 Purpose: direct marketing targeting potential, current and former clients of the controller;
Ground for processing: explicit consent of each data subject in the meaning of Art. 6, Para. 1, letter a) of the Regulation or the legitimate interests of the Controller/Joint Controllers in the meaning of Art. 6, Para. 1, letter f) of the Regulation;
You may object to the processing of your personal data for this purpose or withdraw your consent to receiving marketing communication and direct marketing at any time with effect in the future by sending your objection or withdrawal notice to the respective Controller of MOTO-PFOHE group by email/contact phone number, specified in item 1 above.
4.5 Purpose: for our business purposes, for example, data analyses, certifications, development of new models, improvement of our Website, improvement of our products and services, identification of trends in the Website browsing process, development of a personalised environment in the Website by introduction of products and offers which are tailored to your individual needs or measure the efficiency of our promotional campaigns. 
Ground for processing: legitimate interests of the companies within MOTO-PFOHE group.
The legitimate interest of the companies within MOTO-PFOHE group to provide premium products and services meets the interest of the clients and is therefore in compliance with the requirements of the effective Bulgarian personal data protection legislation as well as a sufficient ground for the processing thereof. Clients expect high quality and premium performance of the products and services of the companies within MOTO-PFOHE group. Continuous quality monitoring and improvement as well as development or provision of new products and services are required to meet these expectations.
4.6 Purpose: video surveillance of the access to the points of sales of the companies within MOTO-PFOHE group.
Ground for processing: legitimate interests of the companies within MOTO-PFOHE group.

The essence of the legitimate interests of the companies within MOTO-PFOHE group is to ensure the safety and security of their points of sales, to guarantee the safety of their employees during the work process as well as to limit, prevent or impose sanctions or file claims in the event of any illegitimate actions or omissions. In view of the purpose for which your data is used, this interest is proportionate to the risks which may occur during the data processing and the interest of MOTO-PFOHE group shall prevail over the right of any client and/or third party not to be recorded as far as their presence in the buildings of the Controller/Joint Controllers is concerned.

4.7 Provision of personal data in compliance with the law. The companies within MOTO-PFOHE group, in their capacity of personal data controllers, are subject to the legislation of the Republic of Bulgaria. In some cases this may require the provision and/or disclosure of your personal data, if it is required by law, upon request and/or if necessary, to third parties - government or other bodies, institutions and departments, insurance companies, insurance brokers, banks and institutions within the scope of their competence and in compliance with the provisions of the Regulation, the Personal Data Protection Act and other rules of the Bulgarian legislation.

If possible, we shall forward such a request to you or we shall notify you before we reply unless it is about the prevention or detection of a crime.

4.8 Provision of data to third parties including those processing personal data. Personal data we collect may be provided for processing to third parties which/who act on their own behalf or on behalf of the companies within MOTO-PFOHE group in compliance with the requirements of the Regulation and subject to ensuring the protection of the rights of data subjects.

Your personal data may be processed by:

• Companies within MOTO-PFOHE group;
• Contractual partners and service and repair centres (for example, sales representatives, partners in the purchase of your vehicle, other authorised dealers and service and repair centres);
• Third parties the brands, products or services of which are distributed by the Companies within MOTO-PFOHE group;
• Companies providing services such as IT support and IT hosting to the Companies within MOTO-PFOHE group; 

4.9 Transfer of data to countries outside the European Economic Area (EEA) The companies within MOTO-PFOHE group do not make any transfers of your personal data to their partners based in countries outside the European Economic Area.

HOW WE PROTECT YOUR PERSONAL DATA

________

5.1 We protect personal data in strict compliance with the effective Bulgarian legislation and the principles of the framework directives of the European Union for protection of information and personal data (including Regulation (EU) 2016/679).
5.2 Your information shall be saved on our secure servers or secure servers of our subcontractors or business partners (or, in some cases, the information shall be saved in a paper version and protected using the required protection means). The information shall be accessible and used in compliance with our security policies and standards (or those of our contractors or business partners) always in compliance with the effective legislation and the necessary protection measures.
5.3 Although we cannot guarantee that the transmission of data over the Internet or the Website is free of any risks of cyberattacks, we and our business partners work hard to have in place measures for physical, personal and documentary protection as well as protection of automated information systems regarding your personal data in compliance with the applicable legislation. For example, we apply the following measures:
 (a) Strictly limited access of our employees and subcontractors to your data provided only if necessary in order to know and in view of fulfilling the purposes for which such data is processed and on the basis of a necessity to know it;
 (b) Personal data shall be saved in an electronic form in databases or shared folders protected by passwords or having different levels of authorisation; monitoring and protection against viruses shall be performed; copies and backups for recovery shall be made; the systems shall also save logs with history of document operations;
 (c) All paper documents which may contain your personal data shall be stored in the building of the Joint Controllers located in the city of Sofia, postal code 1360, Lyulin District, 444 Slivnitsa Blvd.;
 (d) The premises of the Joint Controllers where personal data is being processed shall have 24/7 physical and technical (security alarm and video surveillance) security; fire protection; physical access control procedures are in place;
 (e) The personnel of the Joint Controllers who process personal data shall be aware of the requirements of the effective legislation, the policies of MOTO-PFOHE, the possible risks and the scenarios for action when such risks occur.
 (f) Contractual protection under contracts with third parties processing personal data on behalf of MOTO-PFOHE is also provided for. 
5.4 Where we provide you with (or you choose that we provide you with) a password which gives you access to some parts of the Website or other portal or service we manage, you shall be responsible for keeping this password confidential and for observance of any other security procedure we notify you of. Please do not share your password with anyone.

HOW LONG WE RETAIN YOUR PERSONAL DATA

________

6.1 We shall keep your data for no longer than is necessary for the purpose for which we have received it. If your data is processed for two purposes, we shall keep it until the fulfillment of the purpose with the longer processing period; but we shall discontinue processing it for the purpose with the shorter period upon expiry of this shorter period.
6.2 We shall limit the access to your personal data to those persons and entities who/which have to process it for the respective purpose.
6.3 Under certain circumstances we may keep your personal data for longer periods of time so that we can have a precise record of your relations with us in case of claims or disputes or if we reasonably believe that there is a possibility of litigation in respect of which your personal data will be necessary.
6.4 The retention periods shall be based on the business needs of the companies within MOTO-PFOHE group and in compliance with the applicable legislation. Personal data that is no longer required shall be anonymised (anonymised data may be retained but it is no longer relevant to you) or shall be destroyed.

YOUR RIGHTS IN RESPECT OF PERSONAL DATA PROTECTION

________

7.1 You have certain rights in relation with your personal data, including the right to: 
 (a) request us to provide you with additional details of how your data is being used; 
 (b) request us to provide you with access to your personal data and a copy of it;
 (c) request us to provide you with information on the essential characteristics of the arrangement between the Joint Controllers of the MOTO-PFOHE group.
 (d) receive the personal data that concerns you and that you have provided us with in a structured, commonly used and machine-readable format and, if technically possible, to transmit seamlessly said data to another controller if the processing of your data is based on your consent or a contract and is carried out using automated means;
 (e) request us to update any inaccuracies in the data we keep and to correct/update them;
 (f) request us to delete or anonymise all your data for which we no longer have legal ground to process; 
 (g) in the event that the processing is based on your consent and is related to direct marketing, you may withdraw your consent so that we could discontinue that processing in the future;
 (h) make an objection to any processing for the purpose of automated making of individual decisions (including profiling) when it affects you substantially;
 (i) request us to limit the processing of your personal data, for example, during the time a complaint is investigated.
7.2 Rights exercise procedure
 7.2.1 You may submit a request to the respective Controller of the Moto-Pfohe group for exercising your rights in any of the following ways: on site, by post/mail including email, by phone or fax as specified in item 1 above. 
 7.2.2 Any application, inquiry or your request shall be accepted using a reference number and shall be considered. We shall verify your identity and the right you want to exercise and shall reply within a one-month term of submission thereof. In the event of more complicated cases and when we receive numerous requests, this period may be extended by another two months of which we shall duly notify you. If there are reasons for rejecting the request, we shall point out those reasons to the applicant in writing.
 7.2.3 The exercise of these rights is subject to certain exceptions, for example, when the public interest must be protected (for instance in crime prevention or detection) or our interests or the rights and freedoms of others must be protected. 

If you have any questions about the processing of your data please contact us using the contact details given in item 1 above (Monday to Friday from 9 a.m. to 6 p.m.). 

If you are not satisfied with the processing of your personal data or with our reply in the exercise of these rights, you have the right to file a complaint to the Commission for Personal Data Protection to the following address: 1592 Sofia, 2 Prof. Tsvetan Lazarov Blvd., tel: 02/91-53-518, website:www.cpdp.bg. 

Before you do so, please try to solve the problem with us, although you have the right to contact the Commission for Personal Data Protection at any time.

COOKIES

________

8.1 Processing of cookies 
Cookies are small text files that some websites save on your computer or mobile device. 
At this Website the cookies are used for improvement of the operation of your browser. The companies within MOTO-PFOHE group take full care of your personal data and the information saved by the cookies and your seamless processing of all functionalities of the Website.
8.2 Management and deletion of cookies.
You may accept or reject the cookies by changing the settings of your browser. If the cookies are banned, you may not be able to use all interactive functionalities of this Website. 
Most up-to-date browsers allow control of cookies through the saved browser settings. 
8.3 Cookies help:
 8.3.1 To make our Website operate in line with your expectations;
 8.3.2 To remember your settings during visits;
 8.3.3 To constantly improve our Website for you.
8.4 We do not process cookies for:
 8.4.1 Collection of identifying personal data – we shall always seek your explicit permission if we ever want to collect such information;
 8.4.2 Collection of sensitive information without your explicit consent.
8.5 The processing of cookies falls into several categories:
 8.5.1 Cookies for website functions
We process cookies to make our Website function better. For example, we save information once you visit the Website so that you do not have to enter again any time when you visit a different page/menu during your session. 
Once you exit or close the browser, the cookies for the session will be deleted.
 8.5.2 Analytical cookies
Analytical programmes use cookies for collection of statistical data which help us improve our Website. Unless you provide us with explicit information by filling in a form or calling us, all data collected by analytical programmes shall be saved anonymously and we shall see only general values not specific individual data.
Examples of that include:

• The way you reached our Website (for example, using a search engine, advertisement etc.);
• The actions you perform on the Website such as viewed number of pages, time spent on a given page, on which page the visitors have exited the Website;
• How often you come back to our Website;
• The technology (for example, browser, operating system, device etc.) used by visitors. 

8.6 To learn more about cookies in general or how to manage them, please visit www.aboutcookies.org.

We may make changes to this Policy from time to time. Changes to this Policy shall become effective on the date of publishing the reviewed Policy on the Website. If you use our Website or our services after the changes, this shall be interpreted as acceptance of the updated Policy on your part.

Companies within MOTO-PFOHE group