XParko

XParko

Privacy Policy

XParko Paid Parking Mobile Application

1. General Information

This Privacy Policy describes how Infosystems International EAD, UIC 203773538, with registered office at: Sofia, 105A Prof. Dr. Tsvetan Lazarov Blvd. (hereinafter referred to as the "Company") processes personal data in connection with the use of the XParko paid parking mobile application (hereinafter referred to as the "Application"), available for iOS and Android devices.

Through the XParko website, access is also provided to XParko Business — a web portal designed for business clients that enables the purchase of credit and its distribution among various sub-accounts.

2. Categories of Personal Data

Depending on the functionalities of the Application used, the Company processes the following categories of personal data:

2.1. Registration Data

  • name
  • email address
  • phone number

2.2. Profile Data

  • vehicle registration number
  • list of vehicles
  • history of services used

2.3. Payment Data

  • information on completed payments
  • transaction status

The Company does not store payment card data and has no access to payment instrument data. Payments are processed by a licensed bank through a secure payment environment, in accordance with applicable security requirements.

2.4. Location Data (GPS)

  • current device location

Location data is used to determine the parking zone, visualise the vehicle's location, and provide parking-related functionalities. It is processed only with the user's permission and can be disabled at any time through the device settings.

2.5. Technical Data

  • IP address
  • device and operating system
  • logs and activity data

2.6. Data from Third-Party Login Services

When logging in via Google or other external providers, the Company may receive the following personal data: name and email address. The data is provided depending on the settings of the respective service and the permissions granted by the user.

3. Purposes of Processing

  • creating and managing a user profile
  • providing parking services
  • processing and executing payments
  • user identification
  • sending notifications (push notifications)
  • parking expiry reminders
  • improving services
  • ensuring security and preventing abuse
  • fulfilling and protecting the Company's legitimate interests

4. Legal Bases for Processing

  • contract for the provision of services
  • fulfilment of a legal obligation
  • legitimate interest — fraud prevention and security
  • consent — for location data, push notifications, and third-party login

5. Recipients of Personal Data

5.1. Payment Institutions

  • banks
  • payment service providers (including operators of virtual POS terminals and mobile payment solutions)

5.2. Parking Operators and Administrative Authorities

  • administrative authorities (including municipalities)
  • parking zone operators

5.3. Service Providers

  • hosting services
  • IT support services
  • communication services (push notifications)

5.4. Competent Public Authorities

Where required by law or upon request from a competent authority.

6. Communication and Notifications

The Company uses push notifications for parking-related alerts (including expiry reminders, information on imposed fines, wheel clamps, and towing). Delivery can be managed through the device settings. Notifications are not used for marketing purposes without explicit consent.

7. Data Retention

  • user profile data — for the duration of the account's activity
  • payment data — up to 5 years in accordance with accounting and tax requirements
  • technical data — for a limited period necessary for the security of the Application
  • upon account deletion, data is deleted or anonymised, except where required by a legal obligation

8. Data Security

The Company applies appropriate technical and organisational measures to protect data, including encryption, secure connections, access controls, and secure payment environments. No system can guarantee absolute security.

9. User Rights

  • right of access to processed personal data
  • right to rectification of inaccurate or incomplete data
  • right to erasure ("right to be forgotten")
  • right to restriction of processing
  • right to object to processing
  • right to data portability
  • right to lodge a complaint with the Commission for Personal Data Protection (CPDP)

10. Third-Party Services

The Company may use third-party services (e.g. Google), which act as independent controllers and apply their own data processing rules. The Company recommends that users familiarise themselves with the terms of the respective providers and accepts no responsibility for the manner in which they process personal data.

11. Changes to the Policy

The Company reserves the right to amend this Policy as necessary. The current version is available in the Application. In the event of significant changes, users may be additionally notified. Where consent is required for new purposes, the Company will request it from users.

12. Contact

Infosystems International EAD

Address: Sofia 1582, 105A Prof. Dr. Tsvetan Lazarov Blvd.

Email: office@infosys.bg

Phone: +359 876 252 344