Privacy Policy

Effective date: 6 October 2026.

Controller and contact

Balkan International is the trading name used on this website by Балкан Интернешънъл Би.Ай. – ЕООД, VAT number BG206214632, registered address: 39 Tsar Simeon Street, floor 1, apartment 2, Sofia 1000, Bulgaria. The company name, VAT registration and address were returned by the European Commission VIES service on 6 October 2026. That check does not verify a bank account, signing authority or an individual seller.

Contact: info@balkan-international.com; +359878385141. WhatsApp and Viber are available on the business number. WeChat account details are supplied by the manager on request.

The company is responsible for personal data collected for its enquiries and cases. Contact info@balkan-international.com for privacy questions or rights requests.

Public website enquiries

The current public website collects names, contact details, vehicle identifiers/listing links, service preferences, relevant business details, complaint information and records of terms/privacy choices. We use this information to respond, prepare requested quotes, take requested pre-contractual steps, provide agreed services, handle complaints and meet applicable legal obligations. Necessary contract or pre-contractual processing is based on Article 6(1)(b) GDPR where applicable, legal obligations on Article 6(1)(c), and proportionate security, administration and the establishment or defence of claims on Article 6(1)(f), subject to necessity and your rights. Consent is used for optional processing where required. Sending an enquiry does not subscribe you to marketing.

Do not enter passwords, bank authentication details, identity documents or unnecessary sensitive information in enquiry fields. Website document uploads and downloads are unavailable in this phase. Document sharing and any provider involvement must be agreed separately before sending documents.

Invitation-only My Balkan

The first portal phase is available to individually verified customer accounts after the designated administrator completed the security setup. There is no open customer registration. Authorised staff confirm the customer and contact email before granting access and assigning records. A customer sees their own assigned cases, vehicle information, real staff updates, communications and verified payment/transport statuses. A status or message is not an automatic purchase, reservation, payment confirmation or live tracking feed.

For this service we process account name and contact email, hashed password credentials, authentication/session records, an authenticator secret, enabled security methods and hashed recovery codes if generated, assigned case/vehicle identifiers, case messages and security/audit events. WordPress session records can include the login IP address and browser user agent. Passwords are hashed; the authenticator secret is restricted account data and is not published. The website does not send authenticator secrets to an external verification API. Keep recovery codes privately and contact the team if account access is lost.

Processing supports requested/agreed services and proportionate account security on the contract/pre-contractual and legitimate-interest bases described above, subject to applicable legal obligations and rights. Account and case records use the existing WordPress/hosting arrangements, restricted to authorised users. Retention and deletion follow the purpose-specific approach below; security setup does not establish a verified hosting location or uniform provider log/backup retention period. No documents are accepted through the portal in this phase. Do not enter identity documents, passwords, bank authentication codes or unnecessary sensitive information in case messages.

Recipients and services

Enquiries are stored in private WordPress records and notified to the company business inbox. Authorised company staff handle them. Hostinger provides the hosting and business-email infrastructure under the existing hosting arrangements. These providers may process technical access and delivery records for operation and security. You can request further information about processing arrangements from info@balkan-international.com. We do not represent that all provider storage is in Bulgaria or the EEA.

A specific inspector, carrier, customs professional, lender, workshop or other provider is identified before the relevant service is commissioned or personal documents are shared. Applicable responsibilities, recipient information and any international transfer safeguards must be established for that arrangement before sharing. WhatsApp, Viber and WeChat are external communication services with their own privacy terms; telephone and email are also available. Website analytics remains disabled. Public request tools do not make solely automated decisions with legal or similarly significant effects.

Optional public-page translation

Google Translate loads only after you choose to allow Google translation in Privacy preferences and select a public-page language. It receives connection information, including your IP address and browser information, the public page address and text used for translation. Google may process information outside the EEA under its own Privacy Policy and Terms. The relevant Google service entity and its processing arrangements are described in those notices.

This feature is disabled on My Balkan and for signed-in visitors. Private case information is not sent by this feature. Form input fields, request confirmations containing customer details and request references are excluded from translation. Do not put sensitive documents or authentication details in public enquiry fields. Automatic translation is for convenience and may be inaccurate; ask us to clarify service and contractual terms before committing.

You may decline translation and continue using the English website. To withdraw translation consent, reopen Privacy preferences and choose Essential only. This stops further provider loading, restores the English page and clears the website's translation selection cookie. See Cookie Policy for browser storage and previously set provider cookies.

Security and retention

Enquiry records are private and restricted to authorised staff. Form validation, short-lived tokens, rate limits and spam controls protect intake. No system is completely risk-free. The application uses hashed server-address buckets for short-lived rate limits rather than saving raw IP addresses in enquiry records.

We retain records for as long as needed to handle the enquiry, perform an agreed service, resolve a dispute and comply with applicable record-keeping obligations. Retention depends on the record and its justified purpose; we do not claim one uniform period for all enquiries, invoices, hosting logs and backups. Contact us for information about your particular record or to request deletion. Where a legal obligation prevents deletion, we explain it. Removal from active records and expiry from restricted backups may occur separately; backups are restricted and deletion requests must be considered if data is restored.

Rights, complaints and required information

Depending on the circumstances, you may request access, correction, erasure, restriction, portability or object to relevant processing. Consent can be withdrawn for future consent-based processing without affecting prior lawful processing. We normally reply to GDPR requests within one month; lawful extensions are explained. We may request proportionate identity verification. Legal retention or other applicable limits may prevent immediate erasure and are explained.

You may complain to the Bulgarian Commission for Personal Data Protection (CPDP, https://cpdp.bg/) or another competent supervisory authority, including in your habitual residence or workplace. Providing necessary enquiry/contract data is required to handle the requested service; optional services are optional. No solely automated decision with legal or similarly significant effects is made by the current request/review tools. Changes to this notice do not retrospectively broaden a consent.