Privacy Policy

Last updated: 19 October 2026

This policy explains how „ХъбоГо“ ООД (HuboGo OOD) processes the personal data of visitors to the hubo.bg website (the "site") and of people who contact us through it. It has been prepared in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR) and the Bulgarian Personal Data Protection Act.

1. Data controller

  • Name: „ХъбоГо“ ООД (HuboGo OOD)
  • EIK (company number): [EIK — to be completed]
  • Registered office and address of management: [registered office and address — to be completed]
  • Correspondence address: 1 V. Tarnovo St., Plovdiv, Bulgaria
  • E-mail: [email protected]
  • Phone: +359 898 691 089
  • Managing director: Martin Kovachev

The company has not appointed a data protection officer, because the nature of its activities does not require one under Article 37 GDPR. For any question about your personal data, you can contact us at the e-mail address or postal address above.

2. What data we process, why and on what legal basis

2.1. Enquiries through the contact form

When you send an enquiry through the form on the site, we process:

  • your name;
  • your company (optional);
  • your e-mail address;
  • your phone number (optional);
  • the type of enquiry — venue (a location for a station), advertising or other;
  • your city (optional);
  • the text of your message (optional);
  • the site language, the page the enquiry was sent from, and the date and time it was sent.

Purpose: to answer your enquiry and to carry on any follow-up correspondence with you, including when you are interested in hosting a huboGO station at your venue or in advertising on huboMedia screens.

Legal basis: Article 6(1)(b) GDPR — taking steps at your request before a possible contract, where the enquiry concerns a business relationship; Article 6(1)(f) GDPR — our legitimate interest in answering the enquiries we receive and in being able to defend ourselves against possible claims.

Providing the data is voluntary. Without your name, e-mail address and the type of enquiry, however, we cannot process your enquiry or reply to you.

Retention: up to 3 years after the enquiry is closed. If the enquiry leads to a contract, the data needed for that contract are kept for the periods that apply to contractual and accounting records (up to 10 years after the contract ends, under the Bulgarian Accountancy Act).

2.2. Protecting the form against automated abuse

The contact form is protected by Cloudflare Turnstile, which checks whether the form is being filled in by a person rather than an automated program. For this, Cloudflare processes technical data from your browser and device (for example, your IP address and browser characteristics). We receive only the result of the check — passed or failed — and we do not store it with your enquiry.

Purpose: site security and preventing unwanted and automatically submitted messages.

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in protecting the site and our mailbox from abuse.

Retention: we do not store any data from the check. Cloudflare processes it only for the purpose of the check and retains it in accordance with its own privacy rules.

2.3. Technical data when you visit the site

On every visit, the servers that host the site and the Cloudflare network process technical data without which the site cannot be shown or protected: IP address, date and time of the request, the page loaded, browser and device type, and the page you came from.

Purpose: delivering the site, keeping it secure, protecting it against attacks and fixing technical problems.

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in a secure, working online service.

Retention: access logs are kept for up to 180 days, unless they are needed for longer to investigate a specific security incident.

2.4. Visitor statistics (Google Analytics 4) — only with your consent

If you accept analytics cookies in the cookie banner, the site loads Google Tag Manager and Google Analytics 4. They collect data about how the site is used: pages visited, visit duration, device and browser type, approximate location (country or city) derived from the IP address, and pseudonymous identifiers stored in cookies. When you send an enquiry, the statistics record only that an enquiry was sent and its type — not its content and not your contact details.

Until you give consent, these tools are not loaded and set no cookies. The site's Google tag is configured without advertising features, and the site does not use advertising or remarketing cookies.

Purpose: to understand how the site is used and to improve it.

Legal basis: Article 6(1)(a) GDPR — your consent. You can withdraw it at any time via the “Cookie settings” link at the bottom of every page. Withdrawal does not affect the lawfulness of processing carried out before it.

Retention: Google Analytics cookies are kept for up to 2 years; data in Google Analytics are kept for [retention set in Google Analytics (2 or 14 months) — to be confirmed] and are then deleted automatically.

You will find more about cookies in our Cookie Policy.

2.5. Record of your cookie choice

When you accept or reject cookies, we record your choice in our own cookie (hubo_consent) in your browser: the version of the Cookie Policy, the date and time of your choice and whether you allowed analytics cookies. Consent is managed by the site itself — no third party is involved and we do not send your choice to an external platform.

Purpose: to respect your choice and to be able to show that we obtained consent before loading the analytics tools.

Legal basis: Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR — the obligation to be able to demonstrate consent.

Retention: the cookie holding your choice is kept in your browser for up to 12 months, after which we will ask you again. We do not keep a separate consent record on our servers.

2.6. Requests to exercise your rights and complaints

When you write to us to exercise your rights under section 6 or to make a complaint, we process your name, your contact details and the content of your request.

Purpose: to fulfil our obligations under Articles 12–22 GDPR and to be able to show that we have done so.

Legal basis: Article 6(1)(c) GDPR — legal obligation; Article 6(1)(f) GDPR — our legitimate interest in defending against possible claims.

Retention: up to 3 years after the case is closed.

2.7. Renting a power bank

The site only presents the huboGO service. When you rent a power bank from a station through the huboGO mobile app or through the payment web page that opens when you scan the station's QR code, the processing of your data for the rental and the payment is described in the service's terms and privacy notice, which you receive before you rent.

2.8. Opening a scanned station in the app after installation

When you scan a station's QR code and open its page in a browser while the huboGO app is not yet installed, the site may briefly keep the code of the station you scanned, so that the same station opens in the app on its first launch — including after installing it from an app store. For this purpose we store a one-way hash (HMAC-SHA256) of your IP address, computed with a secret key held on the server, together with the scanned address, the platform and the operating-system version. The IP address itself is neither stored nor written to the logs.

Purpose: carrying the scanned station into the app after installation, without asking you to scan again.

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in the link between the site and the app working.

Retention: up to 60 minutes, or until the app claims the record, after which it is deleted.

3. Recipients and processors

We do not sell your personal data and do not share it with third parties for their own marketing. Your data may be accessible to:

  • authorised staff of „ХъбоГо“ ООД who handle enquiries — only to the extent necessary;
  • [hosting and e-mail provider — to be completed] — provides and maintains the servers in the EU on which the site and the content management system that stores enquiries run, as well as the e-mail services through which we receive the new-enquiry notification and correspond with you;
  • Cloudflare, Inc. — content delivery (CDN), encrypted connections, protection against attacks and the Cloudflare Turnstile check;
  • Google Ireland Limited and Google LLC — Google Tag Manager and Google Analytics 4, only if you have consented to analytics cookies;
  • public authorities, where the law requires us to provide data to them.

With providers that process data on our behalf, we apply contractual terms under Article 28 GDPR.

4. Transfers outside the European Union

Cloudflare and Google are companies headquartered in the United States, and using their services may involve transferring data outside the European Union and the European Economic Area. Such transfers rely on the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework — for recipients certified under it — and/or on standard contractual clauses approved by the European Commission.

5. Retention at a glance

  • contact form enquiries — up to 3 years after they are closed;
  • requests to exercise rights and complaints — up to 3 years after they are closed;
  • data related to a concluded contract — up to 10 years after it ends;
  • technical access logs — up to 180 days;
  • your cookie choice — as set out in section 2.5;
  • Google Analytics data — as set out in section 2.4, and only with consent;
  • the hash that carries a scanned station into the app — up to 60 minutes (section 2.8);
  • backups — up to 30 days.

When these periods expire, the data are deleted or irreversibly anonymised. Data deleted from our working systems remain in backups until their 30-day period expires, after which they are erased from the backups as well.

6. Your rights

Under the GDPR, you have the right:

  • of access — to find out whether and which of your data we process, and to receive a copy;
  • to rectification — to have inaccurate or incomplete data corrected;
  • to erasure — to have your data deleted where we have no ground to keep them;
  • to restriction of processing in the cases provided for by law;
  • to data portability — to receive the data you have given us in a structured, machine-readable format, where processing is based on consent or a contract and is carried out by automated means;
  • to object to processing based on legitimate interest;
  • to withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.

You can exercise your rights by writing to [email protected] or to our correspondence address. We reply within one month of receiving the request. For complex cases or a large number of requests, this period may be extended by a further two months, and we will let you know. Before replying, we may ask for additional information to confirm your identity — only as much as is necessary. Exercising your rights is free of charge.

7. Right to lodge a complaint

If you believe that we process your data unlawfully, you have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection:

  • Commission for Personal Data Protection (КЗЛД / CPDP)
  • address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
  • e-mail: [email protected]
  • website: www.cpdp.bg

We would, however, appreciate the chance to resolve the matter with you first.

8. Automated decision-making

The site does not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

9. Data security

We apply technical and organisational measures to protect personal data against unauthorised access, loss or alteration: encrypted connections (HTTPS), individual accounts with access limited to authorised persons, the principle of least privilege, and regular backups. Staff with access to personal data are trained and bound by confidentiality.

10. Changes to this policy

We may update this policy when we change how we process data or when changes in the law require it. The current version is published on this page, and the date of the last change is shown at the top.