Privacy Policy
Last updated: 2026-10-20.1 · Version 2026-10-20.1
This is a translation. If it differs from the Bulgarian text, the Bulgarian text prevails.
This policy explains how Pintle (“we”) processes personal data when you visit pintletms.eu and use Pintle TMS. It follows Regulation (EU) 2016/679 (GDPR) and Bulgarian law.
An important distinction: for the data you enter into the Service as a customer (drivers, counterparties, documents, vehicle positions) you are the controller and we are the processor. That is set out in the Data Processing Agreement (DPA). This policy covers the data we control: accounts, payments and website visits.
1. Who the controller is
Controller: Pintle. Contact and registration details are on the Legal notice page. For data-protection questions: [e-mail].
2. What we process, why and for how long
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, e-mail, password (as a hash only), role, language, optional photo | Creating and running an account, sign-in, access management | Contract (Art. 6(1)(b)) | While the account exists; deleted or anonymised within 30 days after it is closed |
| Data from Google when you choose “Continue with Google”: Google account identifier, e-mail, name (we receive it only if you choose this sign-in) | Signing in and creating an account without a password | Contract (Art. 6(1)(b)) | While the account exists; the link to Google ends when it is closed |
| Phone number (drivers, SMS code sign-in) | Driver sign-in, sending the code | Contract; legitimate interest — security of sign-in | While the driver is in the company’s system |
| Company data (name, company ID, VAT number, address) and payment data (Stripe customer and subscription id, status, invoices) | Billing, invoicing, managing the subscription | Contract; legal obligation (accounting and tax) | Accounting documents — for the period required by applicable accounting and tax law |
| Activity in the account (audit log, last seen, online presence) | Security, traceability of actions, showing who is online | Legitimate interest — security and reliability | While the account exists |
| Technical data: IP address, browser, requests to the server | Security, abuse protection, limiting sign-in attempts, fixing errors | Legitimate interest | In automatically rotating logs, usually a few weeks; the counter limiting attempts — minutes to hours |
| Messages to us (e-mail, the enquiry form on the pricing page: name, company, e-mail, phone, number of trucks, message, IP address for abuse protection) | Answering the enquiry, support, protecting the form from automated requests | Legitimate interest; pre-contractual steps | As long as needed to answer and a reasonable time afterwards (the enquiry is kept in our database and e-mailed to our team) |
Messages between users: the text, attached files, delivery and read times and online presence (when you are online and last seen) are processed to run the internal communication (contract; legitimate interest). A conversation is visible only to its participants. Between different companies a stranger may send one text-only request, which the recipient accepts, ignores or blocks; your company can stay out of the search and you choose which roles may write to you. You can hide when you were last online. A browser notification or an e-mail about unread messages is sent where the company’s plan provides it. If you press “Translate” on a message or an exchange listing, only that text is sent to our artificial-intelligence provider (see Sub-processors) and the translation is kept on our servers; nothing is translated without your action.
Payment reminder: when a transport is entered, the Service may show subscribers on a paid plan an orange light when, for a Bulgarian legal-entity customer (by a valid company ID or VAT number), there are at least 5 invoices not marked as paid that are more than 30 days past their due date, issued by at least 3 different companies that keep their payments up to date. Only “yes/no” is shown, without issuers, count, amounts or invoices, and it is worked out at the moment of the check and not stored. Sole traders and private persons are technically not checked. For this function we are an independent controller; basis: legitimate interest (protecting participants from unpaid receivables), with a documented balancing test (LIA) and impact assessment (DPIA). Source: status and due date of invoices that participants issue and maintain themselves. It is not a statement of debt, an assessment or a decision; a person decides. Every company can keep its invoices out and not get the reminder; the company concerned can dispute at any time at /payment-reminder/dispute (the reminder is switched off at once, reply within 3 working days) and has the right to object under Article 21 and to complain to the Commission for Personal Data Protection. Details: /payment-reminder.
Register of companies and customer suggestions: when a participant enters a company (a customer on an order, the buyer on an invoice), it is added once to a shared register of companies — whatever it is to the participant — if it is a Bulgarian legal entity with a valid company ID; duplicates are avoided by company ID, and sole traders and private persons (a 10-digit code, which is a personal number) are not added. When a customer is entered the Service suggests companies from the register by part of the name, company ID or VAT number and fills in name, company ID, VAT number, address and representative (details that companies state on their invoices anyway). These are details companies state on their invoices anyway and that are available in the commercial register; contacts, plan or other information are not shown. Basis: legitimate interest (convenience and accuracy of documents). A company that does not wish to be suggested can write to [e-mail].
What is mandatory: name, e-mail and password are needed to create an account — without them we cannot provide the Service. Anything else you enter is your choice. We receive the data directly from you; for people added by a customer (for example drivers), from that customer.
The legitimate interest we rely on: the security of the Service, preventing abuse and fraud, and keeping it running. You may object to processing on that basis — see section 7.
We do not sell personal data. We do not use your data for advertising or profiling and we do not take automated decisions with legal effect on you.
If we send you a newsletter or marketing messages in future, we will do so only with your consent, which you can withdraw at any time.
3. If you are a driver or an employee of our customer
If your employer or the company that engages you has added you to the Service, that company — not us — is the controller of your data. It decides what is entered about you (for example courses, documents, the vehicle’s position if a tracking system is connected) and on what basis. We process that data only on its instructions.
For requests to access, correct or delete data, or to learn what is processed, please contact your employer first. If you write to us at [e-mail] we will direct you or help the controller to answer.
4. Who we share data with
We use sub-processors that process data on our behalf (hosting, file storage, payments, e-mail and SMS, maps and address search, artificial intelligence for document recognition and translation). The current list with purposes, countries and safeguards is on the Sub-processors page.
We may disclose data to public authorities where the law requires and to professional advisers under a duty of confidentiality.
5. Transfers outside the EEA
Some of our sub-processors are in the United States or may process data outside the European Economic Area. In those cases we rely on an adequacy decision of the European Commission (for example the EU–US Data Privacy Framework, where the provider is certified) or on standard contractual clauses and, where needed, additional measures. You can ask for information about the safeguards at [e-mail].
6. Security
We apply technical and organisational measures appropriate to the risk — encrypted connection (HTTPS), hashed passwords, encrypted session cookies, access separated by role and by company, limits on sign-in attempts, signed and expiring links to files, encrypted backups. They are described on the Security page. No system is completely safe; if a breach affects data we will notify the competent authority and the people concerned where the law requires.
7. Your rights
You have the right to: access your data; rectification; erasure (“to be forgotten”) under the conditions of the law; restriction of processing; data portability; object to processing based on legitimate interest; and withdraw consent where processing is based on consent.
Write to us at [e-mail]. We answer without undue delay and at the latest within one month. We may ask you to prove your identity.
You have the right to complain to the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg — or to the supervisory authority of the country where you live or work.
9. Children
The Service is for business customers and is not intended for people under 18. We do not knowingly collect data from children.
10. Changes
We will publish changes to this policy on this page with a new date. For material changes we will also notify you. Version: 2026-10-20.1.