UrbanMoto.eu
UrbanMoto.eu privacy notice
Proposed by the operator, pending counsel review.
This notice explains how SERVBG Ltd (СЕРВБГ ООД) processes personal data as the controller of the UrbanMoto.eu platform: workshop applications, messages from the contact form, platform accounts (including "My garage" accounts) and security records. It is the information required by Article 13 of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").
1. Controller
SERVBG Ltd (СЕРВБГ ООД)
Registration number (EIK): 200905066
VAT number: BG200905066
Address: 1233 Sofia, Bulgaria
Country: Bulgaria
E-mail for data protection questions: [email protected]
The operator is not required to appoint a data protection officer (Art. 37 GDPR); please send every question to the e-mail above.
2. Who is the controller of which data
The operator is the controller of every platform account, including a "My garage" account: the sign-in and identity data (e-mail, name, password hash, preferred language, roles) and the security of the account.
Each workshop is the controller of its own customer, booking, order and invoice data, including what "My garage" shows about your bookings and repairs at that workshop. The operator processes those data for the workshop as a processor under a data processing agreement (Art. 28 GDPR). Each workshop publishes its own privacy notice on its pages (the "Privacy policy" link at the bottom of the workshop's pages). This notice covers only the data the operator controls.
3. What data, why, and on what basis
| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Workshop application (/join) | business name, contact person, e-mail, phone, city, country, registration and VAT number, message, language, version and time of the accepted terms | reviewing the application and concluding a contract with the workshop | steps prior to entering into a contract (Art. 6(1)(b) GDPR) | approved: the term of the contract and 5 years after it ends; rejected: up to 12 months after the decision |
| Contact form | name, e-mail, subject, message | answering your enquiry | legitimate interest in answering (Art. 6(1)(f)) | the correspondence: up to 24 months; the record of the sent e-mail: 24 months |
| Platform account (workshop back office and "My garage") | e-mail, name, password hash, preferred language, roles | sign-in, access to the workshop back office or to "My garage", security of the account | performance of a contract (Art. 6(1)(b)) | while the account is active; anonymised after deletion |
| Security records | IP address, time, action, browser | preventing abuse, investigating incidents, evidencing actions | legitimate interest in protecting the platform and evidencing actions (Art. 6(1)(f)) | IP address in the audit log: 12 months, then erased; the audit record: 5 years; web-server log: up to 15 days |
| Request limits | one-way hash of the IP address or e-mail | limiting the number of applications and messages | legitimate interest (Art. 6(1)(f)) | up to 24 hours |
The fields marked with an asterisk in the forms are needed to review an application or to answer; without them we cannot do so. We make no automated decisions and no profiling.
4. Location search
The home page and the workshop search page (/book) can show the nearest workshops by your location. The home page asks for it by itself only after you choose "Accept all" in the cookie bar; on both pages the location button ("Find the nearest service center" on the home page, "Use my location" on /book) asks for it when you press it. Your browser asks for permission first. If you give it, the browser's coordinates are sent to /api/find to find the nearest workshops. The application does not store them. They remain in the web-server log for up to 15 days, and the content delivery network (Cloudflare) carries them while handling the request. Basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw in your browser settings.
5. Visit analytics
Google Analytics 4 runs only on workshop pages, only when the platform has enabled it and only after you choose "Accept all" in the cookie bar. Google Ireland Limited then receives data about the visit (pages, device, approximate location from the IP address). Basis: your consent (Art. 6(1)(a) GDPR and Art. 4a of the Bulgarian Electronic Communications Act). Details: Cookie policy.
6. Recipients
Processors the operator uses for the platform:
- LeaseWeb Netherlands B.V.: Leased server hardware in a Netherlands data centre (web server, database and files of the platform), the server is operated by the operator (data: All data stored on the platform; location: NL, EEA, no transfer)
- Cloudflare, Inc.: CDN, TLS termination and DDoS protection in front of urbanmoto.eu (data: All HTTP traffic incl. IP addresses and page content; location: US, transfer under the EU Standard Contractual Clauses)
Other recipients:
- The mail server (SMTP) that sends the e-mails is operated by the operator.
- Google Ireland Limited (with a possible transfer to Google LLC, USA, under standard contractual clauses): only for visit analytics (section 5).
- Public authorities where the law requires it.
We do not sell personal data.
7. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interest, and to withdraw consent at any time without affecting the lawfulness of processing before the withdrawal. Write to [email protected]; we answer within one month.
You may lodge a complaint with the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg.
8. Changes
When this notice changes we publish a new version of this page with a new date. Date of this version: 07.10.2026.