1. Who we are
Reflekt is software owned by BRANDYFIX EOOD, registered in the Bulgarian Commercial Register under UIC 208270850, with its registered office and address of management at 13 Peyo K. Yavorov St., Troyan 5600, Bulgaria (“we”). You can contact us at office@reflektpdr.com.
2. Who this notice is for
It explains how we process personal data as a controller: the data of the people who use the Reflekt app, of the representatives of the shops that are our customers, of the people who write to us and of the PDR shops we present Reflekt to, as well as the data of website visitors.
The data of the shops’ own customers (name, phone, car, photos, signature and so on, and in Bulgaria the personal identification number) is not covered by this notice. The shop concerned is the controller of that data, and we are its processor: we store it on the shop’s behalf under a data processing agreement and do not use it for our own purposes. If you are a customer of a shop, the shop holds the information about you, so please send any requests about your data to the shop.
3. What data, why and for how long
| Activity | Whose data | What data | Purpose | Legal basis (GDPR) | How long |
|---|---|---|---|---|---|
| Accounts in the app | Owners and technicians of shops | Email, role and shop; technical login records (time, IP address) at our provider; the subscription to notifications, if you switch them on; the tick showing that you have read this notice (when, IP address and browser) | Access to the service and its security | The contract with the shop and our legitimate interest in security, Art. 6(1)(b) and (f) | While the account is active and up to 90 days after it is closed; the tick for this notice, 5 years after the contract with the shop ends, as evidence in case of a dispute |
| Contracts and invoices with shops | Representatives and contact persons of shops | Name, position, company details, email, phone, invoices and payments; the record of accepting the terms in the app (who, when, on behalf of which shop, IP address and browser) | Concluding and performing the contract, and accounting | Contract and legal obligation, (b) and (c) | For the term of the contract and 5 years after it ends (the limitation period under Art. 110 of the Bulgarian Obligations and Contracts Act); accounting documents as long as the Bulgarian Accountancy Act requires (10 years) |
| Enquiries and requests to start | People who write to us, call us or fill in the form on the website | Name, shop, country, phone, email and the content of the message; a fingerprint (hash) of your IP address, kept for 2 days so that nobody can flood the form | Replying to you, a demo, an offer and setting up your account | Steps taken at your request before entering into a contract, and legitimate interest, (b) and (f) | 2 years from the last contact; the IP fingerprint, 2 days |
| Business contacts of PDR shops | Owners and employees of PDR shops we do not yet have a contract with, including freelance technicians (individuals) | Name of the shop, town and region, phone, address, website, Facebook and Instagram profiles, the software they use, approximate size, notes from our research and our conversations, the stage and the next step | Presenting Reflekt to shops (direct marketing between businesses) | Legitimate interest, (f); people are informed at the first contact (Art. 14) | 2 years from the last contact, or until you object |
| “Report a problem” | Users of the app | The text and type of the report, the screen it was sent from, the app version, the browser and device, a screenshot (optional), and the sender’s email and shop | Fixing problems | The contract with the shop and legitimate interest, (b) and (f) | 12 months |
| Administration log | The people at Reflekt who have access to the administration, and the accounts concerned | Which administrator, what action and when, the account or email concerned, and the administrator’s IP address and browser | Security and accountability of the administration | Legitimate interest, (f) | 2 years |
| Website visits | Visitors of reflektpdr.com and app.reflektpdr.com | IP address and technical data about the request, processed by Cloudflare; no analysis of your behaviour | Delivering the pages and protecting them against attacks | Legitimate interest, (f) | As set by Cloudflare |
If you do not give us the data the contract needs (for example, an email address for an account), we cannot provide the service. We do not take automated decisions and do not carry out profiling.
4. Where the data of business contacts comes from
The data of the PDR shops we present Reflekt to comes from public sources, such as the shops’ websites and profiles and online maps and directories, and from our conversations with them. When we contact you for the first time, we tell you who we are and where to find this notice. You can tell us at any time not to contact you. We then stop and keep only a note that you do not wish to be contacted.
5. Who we share data with
- Supabase Pte. Ltd. (Singapore), for the database, files and login. The data is stored in Ireland, in the EU, and support is provided from Singapore and the USA.
- Cloudflare, Inc., for hosting the website and the app and protecting them against attacks.
- Google Ireland Ltd., for email (Google Workspace) and for sending the app’s emails.
- Our accountant, for the invoices, and public authorities, when the law requires it.
When a provider processes data outside the European Economic Area, it does so under the safeguards of Chapter V of the GDPR. Supabase (for support from Singapore and the USA) and Google work under the European Commission’s standard contractual clauses, and Cloudflare under the EU–US Data Privacy Framework and the standard contractual clauses.
If you are in the United Kingdom, your data is sent to the EU under UK law, which treats the EEA as providing adequate protection.
6. Cookies and storage on your device
The website and the app do not use advertising cookies and do not track your behaviour. The app keeps only what it needs in the browser: the login session, a copy of the shop’s data so that it can work offline, and screen settings. When you log out, this copy is deleted. This storage is strictly necessary for the service you have asked for and does not require consent.
7. Your rights
You have the right to access your data, to have it corrected or erased, to restrict its processing and to data portability, and to object to processing based on legitimate interest. You can always object to direct marketing, without giving a reason. Write to us at office@reflektpdr.com; we reply within one month.
You have the right to complain to the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg, or to the supervisory authority of the EU country where you live or work — in Ireland, the Data Protection Commission (www.dataprotection.ie). If you are in the United Kingdom, you can complain to the Information Commission (ICO), www.ico.org.uk.
8. Security
The data of every shop is separated in the database itself, and all connections are encrypted. The personal identification numbers of the shops’ customers in Bulgaria are additionally encrypted and are deleted automatically 90 days after the car last reaches the “Handed over” or “Refused” status, and in any case no later than 365 days after the last change to the car or to the number. Our administration panel can only be opened with two-factor authentication, and it shows only counts of the shops’ customer data, never the data itself. The details are in the data processing agreement.
9. Changes
When this notice changes, we publish the new text at reflektpdr.com/en/privacy, at app.reflektpdr.com/poveritelnost and on reflektpdr.com, and we inform the shops by email. This notice is in force from 12 October 2026.