1. Controller and contact
The personal data controller is the creditor:
- Name: AVECREDIT OOD
- Legal form: Limited liability company (OOD)
- Registered office and management address: Bulgaria, Sofia 1592, Iskar district, 41 Hristofor Kolumb Blvd.
- Registration: UIC 208559958, Commercial Register and Register of Non-Profit Legal Entities kept by the Registry Agency
- Email: loans@avekredit.com
For data questions and rights requests, use the channels above or contacts and indicate the subject of your request.
2. Whose data we process and where they come from
Enquiries, company applications and agreement servicing may involve data of representatives, authorised persons, guarantors, beneficial owners and people who send enquiries: identification data and identity document details, contact details, authority and ownership interests, whether a person is politically exposed, payments and correspondence.
Data come from you, from the company you represent or are connected with and, where legally permitted, from public registers such as the Commercial Register, including the beneficial ownership data entered in it, and other authorised sources.
3. Purposes and legal bases
- Entering into and performing an agreement to which you are a party, for example as a guarantor — GDPR Article 6(1)(b).
- Customer due diligence under the Measures Against Money Laundering Act, accounting obligations and Central Credit Register reporting where required — Article 6(1)(c).
- Verifying authority, communicating with company representatives, protecting legal claims and security — legitimate interests, Article 6(1)(f).
- Optional activities requiring consent — Article 6(1)(a). Consent can be withdrawn at any time without affecting earlier lawful processing.
Where online identity verification compares a facial image with an identity document, biometric data are processed only with your explicit consent (GDPR Article 9(2)(a)).
4. Whether providing data is required
Data needed for customer due diligence under the Measures Against Money Laundering Act and for verifying authority are a statutory and contractual requirement. Without them, an agreement with the company cannot be concluded.
5. Recipients and transfers
Data may be accessed by the creditor’s authorised staff and by processors acting on its instructions, including the online identity verification provider Sumsub and qualified trust service providers. Data are provided to the Bulgarian National Bank for the Central Credit Register, to the Financial Intelligence Directorate of the State Agency for National Security and to other competent authorities where the law requires it.
Data are transferred outside the European Economic Area only under an applicable GDPR Chapter V mechanism, about which you can request information.
6. Retention
Data collected for customer due diligence are kept for 5 years after the business relationship ends (Article 67 of the Measures Against Money Laundering Act). Accounting documents are kept for the periods set by the Accountancy Act. Other data are kept for as long as the purpose requires and to protect legal claims.
7. Automated decisions
If a solely automated decision with significant effects on you is used, you receive information about the logic involved and its consequences, and the right to human intervention, to express your point of view and to contest the decision (GDPR Article 22).
8. Your rights
Subject to legal conditions, you have the right of access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests and to direct marketing at any time. A response is provided within one month; this may be extended by two further months for complex or numerous requests, and you will be informed of any extension.
9. Supervisory authority
You may complain to the Commission for Personal Data Protection or another competent supervisory authority. For browser storage, see the cookie policy.