Login to see your personalised offers Log in

Login to see your personalised offers

How and why we process personal data

You are here

Yettel uses personal information primarily to enable Users to purchase electronic vignettes through Yettel. We call this type of data processing "Processing for the purpose of contract performance". It should be noted that in the process of purchasing an electronic vignette it is necessary to exchange certain data with Concord (e.g. Vehicle Data) in order for the electronic vignette to be issued.

In addition, Yettel also processes data for purposes defined as "Legitimate interest". In such cases, it is mainly about data processing that is done in order to provide quality and timely customer service, including settling disputes. These are data processing operations to inform Users about the successful purchase of electronic vignettes, to provide receipts, and to inform Users of the impending expiration of the electronic vignettes they have purchased.

Of course, there are also cases where we are obliged to process personal data of Users in order to fulfill the obligations arising from a regulatory act. We may ask for User’s explicit consent for certain operations to process User’s personal data.

It is important to note that Yettel does not carry out automated decision-making activities based on User profiling, which has legal consequences for Users or similarly affects them significantly.

The majority of data processing operations are intended to give Users the opportunity to purchase electronic vignettes.

In certain cases, the applicable national and European legislation requires Yettel to process Users personal data for certain purposes, in a specific manner and / or for a specified period. The following are the main cases in which Yettel processes personal data in order to fulfill its regulatory obligations.

We process personal data when, under applicable law, we are required to provide information to competent authorities.

Subject to the conditions laid down by law and in accordance with the procedure laid down, personal data processed by Yettel should be made available to the competent authorities.

For example, pursuant to the Code of Criminal Procedure (CCP), Yettel is required, upon request from a court, prosecutor or investigative body, to provide documents or data relevant to the case in question. The required papers or data may contain personal information about Users who have purchased electronic vignettes through Yettel.

We process personal data of Users when, under applicable law, we are required to assist competent state and / or municipal authorities in carrying out their inspections.

The commercial activity carried out by Yettel is subject to control by various state and municipal authorities, for example: the Communications Regulation Commission (CRC), User Protection Commission (CPC), Commission for Personal Data Protection (CPDP), etc. In the course of exercising such control, these authorities have the power to carry out inspections and to require Yettel to provide the documents and information held therein. Such requested documents and information may contain personal information of Users who have purchased electronic vignettes through Yettel.

For example, upon a signal or a complaint from a User, CRC, CPC and PDPC have the power to require Yettel to provide relevant documents and information that may contain data about a User who has purchased an electronic vignette through Yettel..

We process personal data in order to fulfill our obligations under the accounting and tax laws.

The tax and accounting legislation in the Republic of Bulgaria requires Yettel to compile certain accounting and business information, and to store for a limited period of time this information, as well as any other information and documents relevant to taxation. In fulfillment of this obligation, the relevant information and documents containing personal data of the Users shall be kept by Yettel for the terms stipulated by the respective laws. These time terms are quite long (for example, tax control documents should be kept for a period of eleven years).

We process data to deliver and improve customer service.

It is important for us to provide fast, convenient and effective assistance to Users in the event that they find a problem with e-vignettes purchased through us. Quality assurance of customer service is critical to improving Yettel processes and meeting customer expectations and needs.

We process data to maintain information and network security.

At Yettel we are committed to ensuring the confidentiality, integrity and accessibility of our products and services, as well as User information. For this reason, we take measures aimed at preventing or detecting attacks and / or unauthorized access to the information and communication systems through which data is processed under this Policy. We also store records (logs) that are highly restricted and that are only used when we need to investigate potential security incidents.
We process personal data when necessary to settle legal disputes.
Sometimes, in order to exercise its rights or legitimate interests, Yettel may need to process the personal data of certain Users in order to make an out-of-court claim or bring an action against:

Third parties from whom Yettel has received personal data for the relevant Users in accordance with this Privacy Policy; or
Third parties to whom Yettel has disclosed personal data for the relevant Users in accordance with this Privacy Policy.

Accordingly, it is possible that the above-mentioned entities, as well as the Users themselves, may file an out-of-court claim or bring a case against Yettel. In such cases, it may be necessary for Yettel to process the personal data of certain Users in order to be able to organize and enforce the defense against the respective claim or case (thus Yettel aims to defense itself against unlawful encroachment on its property and / or reputation).The type and volume of personal data processed depend on the nature of the extrajudicial claims or cases brought.

A User claims to have purchased an electronic vignette for a vehicle with a different registration number. This requires Yettel to carry out an internal review of the case in order to establish the validity of the User's claim and to provide the necessary evidence;
A competent authority to which Yettel has refused to provide User information shall penalize Yettel and Yettel shall challenge the sanction imposed, which requires the processing of personal data of the relevant User and the provision of evidence before the relevant court.

We process Contact Information to inform Users of the successful purchase of e-vignettes or the unsuccessful purchase attempt.

In the e-vignette purchase process, we require Users to provide Bulgarian mobile numbers and / or email addresses so that we can send them a confirmation of a successful e-vignette purchase or to inform them that the purchase process has failed. If the User has provided an email and the process for purchasing an electronic vignette is completed successfully, the User will receive, in addition to the confirmation, also a receipt.

We process Contact Information to inform Users of the expiration of an e-vignette purchased.

Yettel will process the Contact Information provided by Users in order to notify them of the expiration of the electronic vignettes purchased through Yettel.

Most of the data processing operations are intended to give users the opportunity to register with the Solution and to make full use of it, using it for authentication in the digital services of Yettel and its partners.
(Supplemented on 11.03.2020) For example, when you have a Solution account and want to take advantage of the Single-Sign-On functionality that allows you to access other digital services securely and easily without having to authenticate each time, you need to provide us with basic information and we need to verify it (e.g. by sending a one-time SMS or email password) and create an identifier to share with the digital service you want to sign in to through the Solution. These steps require us to process data that is relevant to you.