1. GENERAL PROVISIONS AND CONTROLLER  

1.1. "Danube Bridge Vidin - Calafat" AD, UIC: 202501062, with its registered office and management address at: Republic of Bulgaria, Vidin Region, Vidin Municipality, Antimovo Village 3776, "Grinduri" Area, 96th Str., No. 4 (hereinafter referred to as the "Company", "we", or "Controller"), respects the privacy of your personal data and guarantees its protection in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679 - GDPR) and the national legislation of the Republic of Bulgaria and Romania.

1.2. This Policy explains how we collect, process, store, and protect your personal data when you use the website https://www.vidincalafatbridge.bg (hereinafter referred to as the "Website"), when making online payments for toll fees, as well as during physical crossing through the bridge facility.

2. CATEGORIES OF PERSONAL DATA WE PROCESS  

Depending on how you use our services, we process the following data: 

• When making an online toll payment (Category 1): Vehicle registration plate number, country of registration, email address (for sending an electronic receipt/confirmation), and IP address.
• During physical crossing through the toll collection station: Video recordings from surveillance cameras (CCTV) and data from automated number plate recognition systems (ANPR).  

• When sending inquiries, complaints, or reports: First name, last name, email address, contact phone number, and any other information you voluntarily provide to us within the text of your message.  

   

3. PURPOSES AND LEGAL BASES FOR PROCESSING 

We process your data solely upon available legal bases pursuant to Art. 6 of the GDPR: 

• For the performance of a contract or pre-contractual relations (Art. 6, para. 1, b. "b" of the GDPR): Processing your registration plate number and email is necessary for administering the electronic payment and granting the right of passage across the bridge.
• For compliance with a legal obligation (Art. 6, para. 1, b. "c" of the GDPR): Data processing for the purposes of tax and accounting reporting (issuing financial documents) and for the implementation of international agreements between Bulgaria and Romania regarding the operation of the facility.

• For legitimate interest (Art. 6, para. 1, b. "f" of the GDPR): Video surveillance and traffic control at the toll station are carried out to ensure infrastructure security, prevent abuse, protect the Company's property, and handle complaints or incidents.

   

4. ONLINE PAYMENT SECURITY (BANK CARDS)

4.1."Danube Bridge Vidin - Calafat" AD DOES NOT collect, process, or store details of your payment instruments (credit/debit card numbers, CVC codes, PIN codes, etc.).

4.2.When making an online payment, you are redirected to the secure payment environment of our partner – a licensed payment operator / servicing bank. The transaction is carried out in accordance with international PCI-DSS security standards. 

5. RECIPIENTS OF PERSONAL DATA (WITH WHOM DO WE SHARE THE DATA?)

We do not sell or provide your data to third parties for marketing purposes. Your data may only be shared with:

• State and regulatory authorities: National toll administrations (BGTOLL / CNAIR), Customs Agency, Border Police, Ministry of Interior, and respective Romanian authorities upon legal request.

• Service providers: Licensed payment operators (banks), IT companies supporting the website and payment system, as well as accounting/legal consultants (all bound by confidentiality agreements).

   

6. DATA RETENTION PERIOD

• Data from electronic payments and accounting documents are stored for a period of 10 years, in accordance with the requirements of the Accountancy Act.
• Video recordings from the station's security and surveillance systems (CCTV) are stored for a short period (usually up to 30 days), unless they are required for investigating an incident or a crime.

• Data from general correspondence (inquiries and reports) are stored for a period of up to 5 years from the resolution of the case for the purpose of protection against legal claims.

   

7. YOUR RIGHTS UNDER THE GDPR

As a data subject, you possess the following rights:

• Right of access: To receive confirmation as to whether we process your data and a copy thereof.
• Right to rectification: To request the correction of inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten"): Applicable if the legal basis for their retention no longer exists (e.g., video recordings). Data from financial transactions cannot be deleted before the expiration of the statutory accounting retention period.
• Right to restriction of processing and Right to data portability.

To exercise your rights, you can send a written application via email to dpo@vidincalafatbridge.bg or by post to the Company's management address.

8. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

If you believe that your data is being processed unlawfully, you have the right to lodge a complaint with the competent supervisory authority. Since the company is based in Bulgaria, the main regulator is:

Commission for Personal Data Protection (CPDP)

• Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.

• Website: www.cpdp.bg

• E-mail: kzld@cpdp.bg

   

9. CHANGES TO THE PRIVACY POLICY 

We reserve the right to update this Policy in the event of changes to legislation or the technical functionalities of the Website. All changes will be published in a timely manner on this page.