Security and proper use of personal data are of utmost importance to us. Our personal data policy does not regulate rights and obligations, but aims to explain to users what personal data we process in connection with the provision of goods and services, why and how we process them, including when it is necessary to disclose personal data to third parties. It also provides information about the rights that users have in connection with the processing of personal data by SUBARUPARTS Ltd..

For greater clarity and convenience of users, many places in this Privacy Policy contain examples that illustrate why and/or how SUBARUPARTS Ltd. processes users' personal data.

These examples are not part of this Privacy Policy and are not exhaustive.

Basic Principles of Personal Data Processing

• We process personal data lawfully, fairly and in a transparent manner;
• We process personal data collected for specific, explicitly stated and legitimate purposes and do not process it further in a manner incompatible with those purposes;
• The personal data processed is appropriate, relevant and limited to what is necessary in relation to the purposes for which it is processed ("data minimization");
• The personal data processed can be kept up to date at all times, taking all reasonable measures to ensure timely deletion or correction of inaccurate personal data, taking into account the purposes for which they are processed ("accuracy").
• The personal data we process is stored in a form that allows identification of the data subject for a period no longer than necessary for the purposes for which the personal data is processed ("storage limitation");
• The personal data we process is stored in a manner that ensures an appropriate level of security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, applying appropriate technical or organizational measures ("integrity and confidentiality");

Personal Data Controller

The personal data controller is:

SUBARUPARTS Ltd.

VAT: 202793534

Registered office: BULGARIA, Sofia, Vrabnitsa District, Lomsko Shose Blvd., 261

If you have questions about privacy at SUBARUPARTS Ltd. or want to contact us regarding a data protection issue, you can contact us at the following email: office@garage17.com or phone: +359 888 888 888

This Privacy Policy may be amended in accordance with national and European legislation. Any change takes effect from the moment of publication on this page. We advise you to check our website frequently to see the latest changes.

Our privacy policy will not be changed in a way that would allow weaker protection of our customers' and users' personal data without their written consent.

What Personal Data is Processed

We collect your personal data to enable us to provide our goods and services, as well as to continuously improve them. Here are the types of information we collect:

Information You Provide:

We receive and store any information you provide in connection with SUBARUPARTS Ltd. services and products, such as:

• information related to searches on the platform;
• orders you have placed;
• login data to your customer profile (if applicable);
• email when it is necessary to contact you;
• phone when it is necessary to contact you;
• address when it is necessary to contact you;
• completed fields from a contact form or sent email message for inquiry purposes;
• requests for access to personal information, etc.

Automatic Information:

We automatically receive and store certain types of information when you use the SUBARUPARTS Ltd. website, such as: information about your usage, including your interactions with content and services available through the site.

Like many websites, we use "cookies" and other unique identifiers and receive certain types of information when your web browser or device accesses the site, such as:

• the Internet Protocol (IP) address used to connect your computer or other device to the Internet;
• email and encrypted password (information about computer, device and connection, such as device type and application version or browser type, browser plugin types and versions, operating system or time zone settings;
• the location (village, town or regional city) of your device or computer from which the website is accessed;
• information about interaction with content, such as content downloads, streams and playback details, including duration and number of simultaneous streams and downloads, as well as network data for streaming and download quality, including information about your internet service provider;
• device metrics, such as when a device is used, application usage, connectivity data and any errors or failed events;
• site metrics (e.g., technical errors, your interactions with service features and content, settings preferences and backup information, your device location with the application, information about uploaded images and files (e.g., file name, dates, and location of your images)), etc.

We may also use device identifiers, "cookies" and other technologies on devices, applications and web pages to collect information about browsing, usage or other technical information for fraud prevention purposes.

Information from Other Sources:

We may receive information about you from other sources such as: delivery information for services or goods purchased through the site (if such functionality is available), information about the number of page views.

What are "Cookies"?

To provide our services and successfully deliver each of the products, information pages or other content provided by SUBARUPARTS Ltd. on the site, we use "cookies". For more information about "cookies" and how we use them, please read our Cookie Policy.

On What Basis We Collect and Process Your Personal Data

We collect and process your personal data lawfully and in accordance with this Privacy Policy. We process data only when you have given your explicit consent to the processing of personal data, or when processing is necessary for the performance of a contract to which you are a party, or to take steps at your request before concluding a contract (such a step is considered navigation and use of the site without needing to make a purchase request). Data processing is also necessary for the purposes of our legitimate interest, namely: when without processing a certain type of data we would not be able to provide our services and conclude a purchase and sale contract for any of the goods on the site, to improve the site and customer service and to bring value to our users. For example, collecting information about searches on the site is our legitimate interest because it is a basic method for determining the quality of our services and the need for our goods.

Due to the existence of the above grounds for collecting and processing personal data, if you believe that you do not wish to provide SUBARUPARTS Ltd. with the personal data necessary to conclude a Purchase and Sale Agreement, then SUBARUPARTS Ltd. will be factually unable to provide you with goods and services.

Purposes of Personal Data Processing

We process your personal data in order to provide and improve the goods and services on the site. These purposes include:

• Purchase and delivery of products and services - we use your personal information to accept and handle orders, deliver products and services, make payments and communicate with you about orders, products, services and promotional offers.
• Providing, troubleshooting and improving SUBARUPARTS Ltd. services - we use your personal data to provide functionality, analyze performance, fix bugs and improve the usability and efficiency of the site.
• Recommendations and personalization - we use your personal data to recommend features, products and services that may be of interest to you, to identify your preferences and to personalize your experience on the site.
• Fulfillment of legal obligations. In some cases, we have a legal obligation to collect and process your personal data. For example, we process personal data to fulfill obligations arising from accounting and tax legislation. Also, when a user purchases a service or goods from SUBARUPARTS Ltd., according to consumer protection legislation, SUBARUPARTS Ltd. is obliged to provide a warranty for the goods if at the time of its provision it is defective, in order to fulfill this obligation, SUBARUPARTS Ltd. must process the basic data of the user (through which the right to make a complaint is established), as well as the data for the respective contract (through which it is established whether the respective goods are under warranty).
• Written or verbal communication with you - we use your personal data to communicate with you regarding the goods and services we provide through various channels (e.g., by phone, email, chat or other communication channel to contact you).
• Fraud prevention and credit risks. We process personal information to prevent and detect fraud and abuse in order to protect the security of our customers.

Purposes for which we seek your consent. We may also request your consent to process your personal information for a specific purpose that we communicate to you. When you consent to process your personal information for a specific purpose, you can withdraw your consent at any time and we will stop processing your data for that purpose. However, if processing is necessary for another lawful purpose, we may continue to process it.

Categories of Persons to Whom We Disclose Users' Personal Data

Information about our customers is an important part of our business and we do not provide it to third parties. SUBARUPARTS Ltd. may share customer personal information (or part of it) only as described below and with third parties that comply with practices that are at least as protective as those described in this Privacy Policy.

SUBARUPARTS Ltd. may share personal information of its customers with third parties who are data processors. Data processors are persons who process personal data on behalf of and on behalf of SUBARUPARTS Ltd. based on a written agreement. They have no right to process the personal data provided to them for purposes other than performing the work assigned to them by SUBARUPARTS Ltd.. Processors are obliged to comply with all instructions of SUBARUPARTS Ltd..

SUBARUPARTS Ltd. takes the necessary measures to ensure that the engaged processors strictly comply with the legislation on personal data protection and the instructions of SUBARUPARTS Ltd., and that they have taken appropriate technical and organizational measures to protect personal data.

Examples of data processors are:

• Courier service providers;
• Providers of services for implementation and/or maintenance of information systems, which sometimes need to access personal data processed in the respective systems for the purposes of providing services;
• Law firms, accounting firms or other providers of consulting services;
• Hosting service providers

SUBARUPARTS Ltd. may share personal information of its customers with banks and payment institutions. In connection with servicing user payments made by bank transfer or through a payment institution, it is necessary to exchange data between SUBARUPARTS Ltd. and the respective bank or payment institution.

Third parties in connection with transformation (e.g. merger or acquisition) or transfer of business. In the event of transformation of SUBARUPARTS Ltd., as well as in the event of transfer of assets in accordance with applicable law, it is possible that the personal data of users administered by SUBARUPARTS Ltd. will be provided to a third party - successor.

Competent authorities. The legislation of the Republic of Bulgaria requires SUBARUPARTS Ltd. to keep certain personal data for users for a certain period. In the presence of prerequisites established by law, these personal data processed by SUBARUPARTS Ltd. must be provided to the competent authorities.

What Methods We Apply to Protect Your Personal Information

We work hard to protect the security of your information during transmission by using Secure Sockets Layer (SSL) certificates that encrypt the information you enter.

In addition, we maintain physical, electronic and procedural safeguards in connection with the collection, storage and disclosure of your personal data. Our security procedures mean that we may sometimes request proof of identity before disclosing personal information to you.

Devices on which your personal data is stored offer protection features to protect them from unauthorized access and data loss. It is important to protect yourself against unauthorized access to your password and your computers and devices. Remember to log out of your profile when you finish using a shared computer.

How Long We Store Your Personal Data

SUBARUPARTS Ltd. stores users' personal data for as long as necessary to achieve the purposes specified in this Privacy Policy or to comply with legal requirements.

In order to fulfill our obligations arising from tax and accounting legislation, data for a given user is stored for a period of 11 years from the termination of his last contract, provided that the user has no outstanding obligations to SUBARUPARTS Ltd.. After the expiration of the deadlines for processing personal data, they are anonymized or deleted/destroyed, unless:

• they are necessary for pending court, arbitration, administrative or enforcement proceedings, or when a complaint has been received from the respective user that must be reviewed by SUBARUPARTS Ltd.; or
• the respective user has exercised the right to request restriction of the processing of personal data relating to him/her;

SUBARUPARTS Ltd. makes efforts to ensure that the processed personal data for users is updated (and corrected if necessary), and that data that is not necessary to achieve the purposes described above is not stored.

General Information on the Rights of Individuals

SUBARUPARTS Ltd. takes action at the request of an individual to exercise a right under this section only if it is able to identify the respective person.

Only persons who can be identified by SUBARUPARTS Ltd. have the opportunity to exercise their rights under this section. If the purposes for which SUBARUPARTS Ltd. processes personal data do not require or no longer require identification of a particular individual, SUBARUPARTS Ltd. has no obligation to maintain, obtain or process additional information to identify the person for the sole purpose of taking action based on that person's request.

SUBARUPARTS Ltd. notifies individuals of actions taken within one month of receiving a request under this section, and in certain cases this period may be extended by up to two more months.

SUBARUPARTS Ltd. provides individuals with information regarding actions taken in connection with their requests to exercise rights under this section without undue delay and in all cases within one month of receiving the request. If necessary, this period may be extended by another two months, taking into account the complexity and number of requests. SUBARUPARTS Ltd. informs the respective person of any such extension within one month of receiving the request, stating the reasons for the delay.

In case of refusal to fulfill a request, SUBARUPARTS Ltd. notifies the respective individuals of their rights.

If SUBARUPARTS Ltd. does not take action on an individual's request, SUBARUPARTS Ltd. notifies them without delay and no later than one month from receiving the request of the reasons for not taking action, as well as the possibility to file a complaint with the Commission for Personal Data Protection and seek judicial protection.

In certain cases, SUBARUPARTS Ltd. may request additional information to confirm the identity of individuals

If SUBARUPARTS Ltd. has reasonable concerns about the identity of the individual submitting a request under this section, SUBARUPARTS Ltd. may request the provision of additional information necessary to confirm the person's identity.

Actions taken by SUBARUPARTS Ltd. at and on the occasion of submitted requests to exercise rights under this section are completely free of charge for the persons, unless their requests are manifestly unfounded or excessive. When a person's request is manifestly unfounded or excessive (for example, due to its repetitive nature), SUBARUPARTS Ltd. has the right, at its discretion: (a) to refuse to fulfill the request; or (b) to require payment of a reasonable fee, determined based on the administrative costs necessary to provide the requested information or to take the requested actions.

Users Have the Right to Access Personal Data Relating to Them

Users have the right to obtain from SUBARUPARTS Ltd. information whether personal data related to them is being processed. If this is the case, users have the right to access the respective data.

Correction of Inaccurate or Outdated Personal Data

In case the personal data processed by SUBARUPARTS Ltd. is inaccurate or outdated, users have the right to request SUBARUPARTS Ltd. to correct it.

Deletion of My Personal Data ("Right to Be Forgotten")

Users have the right to request SUBARUPARTS Ltd. to delete their related personal data in the following cases:

• the personal data is no longer necessary for the purposes for which it was collected or processed;
• the user has withdrawn their consent on which the processing of personal data is based, and there is no other legal basis for processing the same;
• the user has objected to the processing of personal data based on the legitimate interest of SUBARUPARTS Ltd., unless there are other legal grounds for processing that take precedence over the interests, rights and freedoms of the user, or the data processing is necessary for the establishment, exercise or defense of legal claims;
• the user has objected to the processing of personal data for direct marketing purposes and there are no other legal grounds for processing this data;
• the personal data relating to the respective user has been processed unlawfully;
• the personal data must be deleted by SUBARUPARTS Ltd. in order to comply with a legal obligation arising from the law of the Republic of Bulgaria or the law of the European Union.

Restriction of Processing My Personal Data

As of 25.05.2018, users have the right to request SUBARUPARTS Ltd. to restrict the processing of their related personal data in the following cases:

• the accuracy of personal data is contested by the user, for a period that allows SUBARUPARTS Ltd. to verify the accuracy of the personal data; • the processing is unlawful, but the user does not want the personal data to be deleted, but instead requires restriction of its use; • SUBARUPARTS Ltd. no longer needs the personal data for the purposes of processing, but the user requires it for the establishment, exercise or defense of legal claims; • the user has objected to processing of personal data based on the legitimate interest of SUBARUPARTS Ltd., pending verification whether the legal grounds of SUBARUPARTS Ltd. take precedence over the interests of SUBARUPARTS Ltd..

Portability of My Personal Data

As of 25.05.2018, users have the right to receive from SUBARUPARTS Ltd. the personal data they have provided in a structured, commonly used and machine-readable format, as well as to transfer this data to another controller without hindrance from SUBARUPARTS Ltd., insofar as:

• SUBARUPARTS Ltd. processes this data for the purposes of concluding or performing a contract with the user, or based on consent given by the latter; • the processing of the respective data is carried out in an automated manner. Users have the right to request SUBARUPARTS Ltd. to transfer their personal data directly to another controller when this is technically feasible.

Objection to Personal Data Processing

Users have the right, at any time and on grounds related to their specific situation, to object to the processing of personal data relating to them when SUBARUPARTS Ltd. processes their data to protect its legitimate interests. In certain cases, this right is unconditional and SUBARUPARTS Ltd. will always stop processing data when an objection is made by users. These are cases where SUBARUPARTS Ltd. processes personal data for direct marketing purposes.

In other cases, depending on the nature of the objection and the circumstances presented by the respective user, SUBARUPARTS Ltd. will conduct an internal review regarding the objection and will rule on it in accordance with this section, by: (a) notifying the user that it will stop processing his/her personal data; or (b) reasonably refusing to stop processing his/her personal data, if there is a legal basis for this.

The right to access your personal data, correct, delete, restrict their processing and portability can be exercised by sending a message to the administrator at office@garage17.com

Right to Complain to a Supervisory Authority

Users have the right to file complaints or signals to the Commission for Personal Data Protection (CPDP), if according to them SUBARUPARTS Ltd. violates the legislation on personal data protection. Instructions for filing complaints are published on the CPDP website https://www.cpdp.bg

After 25.05.2018, users can also file complaints with other supervisory authorities on the territory of the European Union, as provided for in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) also called "GDPR".