Privacy Policy.

1. Administrator

"NAID" EOOD, EIK 111561587, Montana, "3-ti Mart" Blvd. 157, email nayd.ltd@gmail.com, phone +359 888 519 891.

2. What data we process

• Profile data: email, name, mobile phone number, registration number, date of agreement to the terms and conditions and your choice of reminders.
• Service data: customer number, orders (date, number, mileage, work done, parts and quantities, amounts), registration number, VIN and car make.
• Loyalty program data: points accumulated, used and expired.
• Company Profiles: name, email and mobile number of the person who represents or is authorized by the company.
• Orders from the online store: name, phone, email, address or delivery office, selected courier, invoice details (if requested), goods ordered, amounts and payment status. Card data is entered at Stripe and does not reach us.
• Login technical data: session data required to log in to the account.

We do not process the TIN in the profile. The radio and immobilizer codes, which are kept in the workshop, are not uploaded to the site.

3. Purposes and grounds

• Participation in the loyalty program, profile and file - execution of a contract (Art. 6, par. 1, b. "b" of GDPR).
• Company profile and fleet overview — legitimate interest of the company and the Service to fulfill their contractual relations (Art. 6, par. 1, b. "f").
• Associating the profile with your visits by phone and registration number and preventing abuse - legitimate interest (Art. 6, par. 1, b. "f").
• Email reminders for service, expiring points and seasonal checks - consent (Art. 6, par. 1, b. "a"), which you can withdraw at any time from "Settings".
• Orders from the online store — execution of the contract for purchase, delivery and communication on the order (Article 6, Par. 1, b. "b").
• Accounting and tax records for orders — legal obligation (Art. 6, par. 1, b. "c").

4. Who has access

Service employees — only to the extent necessary for their work. We use suppliers who process data on our behalf: Supabase (database and login, servers in EU - Ireland), Netlify (site hosting), Brevo (sending the login letters, reminders and order confirmation), Stripe (in-store card payment) and Cloudflare Web Analytics (visit statistics, no cookies). Supabase, Netlify, Cloudflare and Stripe are US companies. When ordering from the store, your name, phone number and address are passed on to the selected courier (Speedy, Econt, Sameday or BOX NOW) for delivery. Where US data is accessed, it is based on the European Commission's Standard Contractual Clauses and/or the EU-US Data Protection Framework (Articles 45 and 46 of GDPR). We do not sell or provide data for advertising.

5. Deadlines

• The account and program data — until you delete the account or up to 5 years without a visit to the service and without logging into the account.
• The points — according to the General Terms and Conditions (12 months after the last visit).
• Inquiries of the form "Save an appointment" - 5 years, to contact you and to analyze the inquiries (legitimate interest, art. 6, par. 1, b. "f").
• Order records — 10 years under the Accounting Act, regardless of whether you have an account.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, portability, objection and withdrawal of consent. The account is deleted from "Settings" → "Delete my account". For everything else, write to nayd.ltd@gmail.com.

You have the right to appeal to the Personal Data Protection Commission (www.cpdp.bg).

7. Cookies

When logging in to the profile, the browser saves session data (local storage) necessary to stay logged in. The cart and order fields are stored locally in the browser. Cloudflare Web Analytics measures visits without cookies.

Only after "Accept" we load Meta Pixel, to measure ads in Facebook and Instagram. Meta get technical data about browser and page visited, products viewed, add to cart, start order and purchase with value and currency. The pixel uses _fbp and when visiting from an ad _fbc, usually up to 90 days. We do not submit names, emails, phone numbers or addresses through advanced matching.

Recipient is Meta Platforms Ireland Limited. More: policy of Meta. Meta also processes data outside the EU according to its policy. Your selection is saved until 12 month. You refuse or withdraw consent at any time by Cookie settings in the footer. Cancellation does not interfere with orders.

8. Changes

The current version is posted on this page.