Privacy Policy

Auto and Bid Ltd, company registration number (EIK) 208833206, with registered office and address of management at 12 Byala Reka Str., bl. 10, ap. 3, Vitosha district, 1766 Sofia, Bulgaria, is the controller of the personal data processed through the website encareurope.com and its related services.

This policy sets out the categories of personal data we process, the purposes and legal grounds for processing, the sources of the data, the recipients, the retention periods, international data transfers, and how you can exercise your rights under Regulation (EU) 2016/679 — the General Data Protection Regulation, referred to below as GDPR — and applicable Bulgarian law.

Version 1.3 · Last updated: 7 August 2026

1. Data Controller

Controller: Auto and Bid Ltd

Company registration number (EIK): 208833206

Registered office and address of management: 12 Byala Reka Str., bl. 10, ap. 3, Vitosha district, 1766 Sofia, Bulgaria

Managing Director: Martin Todorov

Email for data protection questions and requests: [email protected]

Phone: +359 88 671 7074

Website: encareurope.com

Requests relating to the protection of personal data are handled by the company without undue delay, and as a rule within one month of receipt. Where necessary due to the complexity or number of requests, this period may be extended by up to two further months. In such cases, you will be informed of the extension and the reasons for it within the initial one-month period.

2. What personal data we process

Depending on how you use the website and the services offered through it, we may process the following categories of personal data.

2.1. Registration and user account data

• email address;
• name, where provided;
• internal user account identifier;
• information about account status and settings;
• cryptographically secured password hash;
• two-factor authentication data;
• passkey data, including public key and technical identifiers;
• backup access codes, where this feature is enabled;
• information about active and terminated user sessions.

Passwords are never stored in readable form.

2.2. Sign-in data via third-party providers

When you choose to sign in with Google, we may receive:

• email address;
• name;
• profile picture;
• unique Google account identifier;
• information on whether your email address has been verified by Google.

We do not receive or store your Google account password.

2.3. Order, purchase, delivery and invoicing data

• first and last name;
• address;
• city/town;
• postal code;
• country;
• phone number;
• email address;
• invoicing details;
• data required to identify the customer;
• information about the selected vehicle;
• order identifier;
• contractual documents;
• data required for purchase, import, customs clearance, transport, registration or delivery;
• information relating to the performance of a specific order or transaction.

2.4. Payment and deposit data

• payment or deposit amount;
• currency;
• transaction date and status;
• payment identifier;
• payment reference;
• information on refunded, declined or disputed payments;
• limited data about the payment method used, where provided by the payment provider.

Card details are entered and processed directly by our payment provider, Stripe. Auto and Bid Ltd does not receive or store the full card number, security code or other sensitive card data.

2.5. Transport and tracking data

• container number;
• bill of lading number;
• shipment identifier;
• transport and logistics events;
• vehicle or shipment status;
• carrier details;
• port, country or other location related to transport;
• information about planned or completed delivery;
• vehicle-specific data linked to the customer's order.

2.6. Inquiries and correspondence

• name;
• email address;
• phone number;
• message content;
• information about the vehicle the inquiry relates to;
• attached documents or files;
• correspondence history;
• our replies and actions taken.

2.7. Preferences and site interaction data

• saved vehicles;
• saved searches;
• preferred makes, models, fuel types, transmissions and other criteria;
• price ranges;
• listings viewed;
• language and currency settings;
• notification preferences;
• information about interaction with individual site features;
• data on opened or used notifications.

Where processing is not necessary for providing the core service, it is only carried out where an applicable legal basis exists, including consent where required.

2.8. Technical and security data

• IP address;
• approximate location, determined based on IP address;
• browser type;
• device type and operating system;
• date and time of the request;
• requested URL;
• referring page;
• account login and logout data;
• session identifiers;
• diagnostic information;
• system, security and network logs;
• records of administrative actions;
• information about failed login attempts;
• information necessary to prevent abuse, fraud and unauthorised access.

2.9. Consent and privacy preference data

• which categories of cookies and technologies you have accepted or declined;
• date and time your choice was made;
• version of the applicable policy;
• any subsequent withdrawal or change of consent;
• technical identifier of the consent record.

3. Sources of personal data

We obtain personal data primarily directly from you, when you:

• create or manage a user account;
• sign in;
• send an inquiry;
• express interest in a vehicle;
• enter into or prepare a transaction;
• make a payment or deposit;
• provide delivery, invoicing or customs clearance details;
• save a search or a vehicle;
• enable notifications;
• communicate with us;
• exercise your rights.

In certain cases, we may also receive data from:

• Google, when you sign in using Google;
• Stripe and other payment providers, in connection with payment status and identifiers;
• intermediary companies involved in the purchase, payment, documentation, export or import of the vehicle;
• vehicle sellers and dealers;
• carriers and tracking service providers;
• customs representatives;
• freight forwarders;
• port and warehouse operators;
• logistics partners;
• Korean partners involved in the purchase, preparation or transport of the vehicle;
• public or commercial sources of vehicle listings;
• technical providers and site security systems;
• government or administrative authorities, where necessary and lawful.

When we receive personal data from third parties, we only process the data necessary for the relevant purpose.

4. Mandatory and voluntary provision of data

Certain data is required for us to enter into or perform a contract, create a user account, process a vehicle purchase, or fulfil a legal obligation.

For example:

• without an email address and a suitable authentication method, we cannot create or maintain a user account;
• without a name, contact details and the necessary identification data, we cannot process a purchase, import or delivery;
• without the required payment details, Stripe or another payment provider cannot process a payment;
• without certain contractual, customs or invoicing data, it may not be possible to complete a specific transaction or comply with an applicable legal obligation.

Data marked as optional is provided at your discretion. Not providing it does not restrict access to the core functionality, except where that information is required for a specifically requested service.

5. Purposes and legal grounds for processing

5.1. Performance of a contract or pre-contractual steps

Under Art. 6(1)(b) GDPR, we process personal data to:

• create and maintain a user account;
• handle inquiries;
• provide information about vehicles;
• prepare and conclude a contract;
• accept and process orders;
• accept and record payments and deposits;
• arrange the purchase of a vehicle;
• share the necessary data with an intermediary, seller and other parties involved in the transaction;
• issue invoices and other contractual documents;
• arrange export, import, transport and delivery;
• track orders, vehicles and shipments;
• provide customer support;
• manage the contractual relationship;
• handle complaints and requests relating to the transaction.

5.2. Compliance with a legal obligation

Under Art. 6(1)(c) GDPR, we may process personal data for:

• accounting and tax reporting;
• issuing and retaining accounting records;
• customs clearance;
• fulfilling obligations towards government authorities;
• preventing money laundering, where required by law;
• complying with applicable commercial, tax, customs and consumer protection law;
• fulfilling obligations relating to data protection and information security.

5.3. Legitimate interest

Under Art. 6(1)(f) GDPR, we may process personal data where necessary for:

• protecting the website, IT systems and user accounts;
• preventing and investigating fraud, abuse and unauthorised access;
• technical support and troubleshooting;
• maintaining security and audit records;
• establishing, exercising or defending legal claims;
• improving the reliability and security of the service;
• preventing duplicate, misleading or unlawful requests;
• protecting our legitimate business and organisational interests.

Where processing is based on legitimate interest, we assess the necessity of the processing and balance our interest against the rights and freedoms of the individuals concerned.

You have the right to object at any time to processing based on legitimate interest.

5.4. Consent

Under Art. 6(1)(a) GDPR, we may process personal data where you have given freely given, specific, informed and unambiguous consent, including for:

• optional cookies and similar technologies;
• personalisation of offers;
• certain email notifications;
• push notifications;
• price change notifications;
• notifications about new vehicles matching a saved search;
• other optional features for which consent has been requested.

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

6. Cookies and similar technologies

We use strictly necessary cookies and technical tools, without which the website, its security and its core functions cannot operate properly.

Optional cookies and similar technologies are only used where valid consent has been given, when required by law.

Through the "Cookie Settings" panel, you can:

• accept or decline individual categories;
• change a previous choice;
• withdraw a given consent.

Detailed information about the cookies we use, their providers, purposes and retention periods can be found in our separate Cookie Policy.

If a statistics or analytics service is used, including Google Analytics 4, it will only be activated in line with your chosen preferences and applicable consent requirements.

7. Recipients of personal data

We share personal data only when necessary for the relevant purpose, to the minimum extent required, and where an applicable legal basis exists.

7.1. Hosting and infrastructure

Hetzner Online GmbH — for hosting, server infrastructure, storage, backup and the technical environment.

7.2. Email services

Resend or another email service provider we use — for sending transactional messages, confirmations, notifications and replies to inquiries.

7.3. Payment services

Stripe or another payment provider — for processing payments, deposits, refunds and related checks.

Depending on the specific service and applicable contractual arrangements, the payment provider may act as an independent controller or as a data processor.

7.4. Sign-in with Google

Google Ireland Limited and its affiliated Google companies — when you choose to sign in with Google.

7.5. Translation and processing of vehicle listing content

Anthropic, Google or other language and technology service providers — for translating, categorising, structuring or summarising content from vehicle listings.

Only the content necessary for the relevant task is sent to these services. We do not send user account data, delivery addresses, payment information or personal correspondence, unless this is expressly necessary, lawful and disclosed in advance.

We make reasonable efforts to minimise and remove non-essential personal identifiers from content before automated processing.

7.6. Intermediaries in vehicle purchases

When you request or complete a vehicle purchase through the platform, we may share the necessary personal data with one or more intermediary companies involved in arranging, documenting and carrying out the transaction.

Depending on the specific purchase, this may include:

• first and last name;
• email address;
• phone number;
• address;
• invoicing details;
• details of the selected vehicle;
• order identifier and information;
• contractual and payment data;
• data needed to issue an invoice or other document;
• data needed for the purchase, transport, export, import, customs clearance, registration and delivery.

We only share the personal data that is necessary to carry out the specific purchase and related services.

The legal basis for this processing is taking steps at your request prior to entering into a contract, and the performance of a contract under Art. 6(1)(b) GDPR, as well as compliance with applicable legal obligations under Art. 6(1)(c) GDPR.

Depending on its actual role in a given transaction, the intermediary may process the data as an independent controller, a joint controller, or a processor acting on behalf of Auto and Bid Ltd.

Where the intermediary acts as an independent controller, it bears sole responsibility for the lawful processing of the data it receives and for providing the applicable data protection information.

Where the intermediary processes personal data on our behalf, the relationship is governed by a contract or applicable data processing terms under Art. 28 GDPR.

Where the intermediary is located outside the European Economic Area, personal data is transferred only where an appropriate mechanism under Chapter V GDPR applies, as described in Section 8.

7.7. Transport, logistics and import

We may share the necessary data with:

• carriers;
• freight forwarders;
• port operators;
• customs representatives;
• warehouse operators;
• tracking service providers;
• companies arranging road transport;
• Korean and other foreign partners involved in the purchase, export or transport of the vehicle.

7.8. Professional advisors

We may share data with:

• accountants;
• lawyers;
• auditors;
• insurers;
• tax advisors;
• other professional advisors bound by professional or contractual confidentiality.

7.9. Government and regulatory authorities

We may disclose personal data where required by law, a court order, or a valid request from a competent government, judicial, administrative or regulatory authority.

Where a provider processes personal data on our behalf, our relationship with it is governed by a contract or applicable data processing terms under Art. 28 GDPR.

We do not sell personal data or share it with advertising networks in exchange for payment.

8. Transfers of data outside the European Economic Area

Some providers, intermediaries or partners may process personal data outside the European Economic Area.

Where personal data is transferred internationally, we rely on an appropriate mechanism under Chapter V GDPR, including:

• a European Commission adequacy decision;
• the recipient's valid participation in the EU–US Data Privacy Framework, where applicable;
• standard contractual clauses adopted by the European Commission;
• binding corporate rules;
• a specific derogation expressly provided for under GDPR;
• another permissible legal mechanism.

Where necessary, we also apply additional technical, contractual and organisational safeguards.

We only share the minimum amount of personal data necessary for the specific service, purchase, transport or delivery with recipients outside the EEA.

Information about the mechanism applicable to a specific transfer can be requested at [email protected].

9. Retention periods

We retain personal data only for as long as necessary for the relevant purpose, unless applicable law requires or permits a longer period.

9.1. User account

Account data is retained for as long as the account remains active.

When an account is deleted, we remove or, where applicable, anonymise:

• account data;
• addresses;
• active sessions;
• passkey data;
• two-factor secrets;
• saved searches;
• saved vehicles;
• optional preferences.

Certain data may be retained where we are legally required to keep it, or where it is necessary to establish, exercise or defend legal claims.

9.2. Accounting and tax documents

Accounting records, financial statements, invoices and other documents are retained for the periods required under the Accountancy Act, the Tax and Social Security Procedure Code, and related legislation. For certain categories of documents, this period may be up to 10 years.

9.3. Purchase, import and delivery documents

Contractual, payment, transport and customs documents are retained for as long as necessary to carry out the transaction, and for the applicable statutory, warranty, accounting and limitation periods.

9.4. Inquiries not resulting in a transaction

Inquiries and correspondence that did not lead to a transaction may be retained for up to 2 years from the last communication, unless a longer period is necessary to protect our legal interests.

9.5. Sessions

Active sessions may be retained for up to 30 days from the last activity, or until explicitly terminated.

9.6. Technical and security logs

Technical and security logs are typically retained for up to 90 days, unless a longer period is necessary to investigate an incident, abuse, fraud or legal dispute.

9.7. Consents

The choice recorded in the cookie or consent management system may remain valid for up to 12 months, after which a new choice may be requested.

The record evidencing that consent was given, declined, changed or withdrawn may be retained for up to 3 years after its expiry or withdrawal, where necessary to demonstrate the lawfulness of the processing.

9.8. Preference data

Data relating to optional preferences may be retained for up to 90 days from the last activity, or until deleted by the user, where such data is stored locally on the device.

10. Your rights

Under GDPR, and provided the relevant legal conditions are met, you have the right to:

• be informed about the processing of your personal data;
• access your personal data;
• obtain a copy of it;
• rectify inaccurate or incomplete data;
• request erasure;
• request restriction of processing;
• data portability;
• object to processing based on legitimate interest;
• withdraw a given consent;
• not be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you;
• lodge a complaint with a competent supervisory authority.

Requests should be sent to [email protected].

We may request additional information where necessary to verify the identity of the requester and prevent unauthorised access to someone else's data.

Requests are generally handled free of charge. In the case of manifestly unfounded or excessive requests, particularly due to their repetitive nature, we may charge a reasonable fee or refuse to act, where permitted by law.

Complaints to a supervisory authority

In Bulgaria, you can lodge a complaint with:

Commission for Personal Data Protection
1592 Sofia
2 Prof. Tsvetan Lazarov Blvd.
Email: [email protected]
Website: cpdp.bg

If your habitual residence, place of work, or the location of the alleged infringement is in another EU Member State, you may also lodge a complaint with the relevant local supervisory authority.

11. Profiling and automated decision-making

Where you have given consent to personalisation, we may automatically analyse:

• makes and models viewed;
• preferred fuel types and transmissions;
• price ranges;
• saved searches;
• saved vehicles;
• interactions with vehicle listings.

The purpose is to rank or suggest vehicles that may better match your interests. This processing may constitute profiling within the meaning of GDPR.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR.

Personalisation:

• does not determine an individual price;
• does not alter contractual terms;
• does not restrict access to vehicles;
• does not affect purchase approval;
• can be switched off at any time through your privacy settings.

12. Email and push notifications

12.1. Service messages

Service messages may be necessary for:

• account security;
• registration confirmation;
• account recovery;
• payment confirmation or status;
• orders;
• purchases;
• transport;
• delivery;
• changes to the contractual relationship;
• replies to inquiries.

These messages do not constitute direct marketing where they are necessary to provide the requested service or perform a contract.

12.2. Requested notifications

When you expressly enable a notification for:

• a new vehicle;
• a price change;
• results matching a saved search;
• a change in order or shipment status;

we will use the data you provide for that specific requested feature.

12.3. Direct marketing

Marketing messages are only sent where a valid legal basis exists.

You can unsubscribe at any time via the link in the message or through your account settings.

Unsubscribing from marketing messages does not stop service messages relating to account security, payments, orders or the performance of a contract.

13. Personal data contained in vehicle listings

Certain vehicle listings may contain information published by dealers, intermediaries or other third parties.

When processing this content, we take reasonable steps to:

• limit the data to what is necessary;
• remove or hide non-essential personal identifiers;
• prevent the publication of payment, identification or other sensitive data;
• limit use to lawful purposes related to providing the vehicle service;
• review reports of unlawfully published personal data.

If we are notified that a listing contains unlawfully published personal data, we will review the matter and, where necessary, restrict access to, correct or remove the relevant content.

14. Children's data

The service is intended for individuals aged 18 and over.

We do not knowingly collect personal data from children. If we discover that we have received such data without an appropriate legal basis, we will take steps to restrict or delete it.

15. Data security

We implement appropriate technical and organisational measures, taking into account the nature of the data processed, the risks involved, implementation costs, and available technology.

These measures may include:

• encrypted communication via HTTPS;
• cryptographically secured password storage;
• Secure and HttpOnly session cookies;
• two-factor authentication;
• passkeys;
• access restrictions based on operational need;
• security and audit logs;
• backups;
• restricted public access to databases and internal services;
• network security rules;
• system updates and monitoring;
• incident response procedures;
• controls on administrative access.

No system can guarantee absolute security. Nonetheless, we take reasonable and proportionate steps to prevent unauthorised access, loss, alteration, destruction or unlawful disclosure of personal data.

16. Security breaches

In the event of a personal data breach, we assess the likelihood and severity of the risk to the rights and freedoms of the individuals affected.

Where a breach is likely to result in a risk to the rights and freedoms of individuals, we notify the Commission for Personal Data Protection without undue delay and, where feasible, within 72 hours of becoming aware of it.

Where a breach is likely to result in a high risk to the rights and freedoms of the affected individuals, we notify them without undue delay, unless an exception provided for by law applies.

17. Changes to this policy

We may periodically update this policy to reflect:

• changes to our services;
• new features;
• changes in providers and partners;
• legal or regulatory requirements;
• changes in how personal data is processed;
• changes to retention periods or security measures.

In the event of a material change, we will update the version number and the date of the last update.

Where a change affects processing based on consent, we may request your consent again.

The current version of this policy will be available at encareurope.com.

18. Contact

For questions, requests or complaints relating to data protection, you can contact us at:

Auto and Bid Ltd
Company registration number (EIK): 208833206
Managing Director: Martin Todorov
Address: 12 Byala Reka Str., bl. 10, ap. 3, Vitosha district, 1766 Sofia, Bulgaria
Email: [email protected]
Phone: +359 88 671 7074
Website: encareurope.com