Privacy Policy

1. Who is the data controller

The controller of personal data processed through the DRIVER REGISTER platform is „Пикник Транс" ЕООД (PIKNIK TRANS EOOD), company registration number 203321508 (VAT No. BG203321508), with its registered office at 10 Stefan Karadzha St., 5400 Sevlievo, Bulgaria, represented by Krasimir Tsankov Georgiev.

For questions about the protection of personal data and to exercise your rights, you can contact: office@driverregister.eu.

2. What personal data we process

2.1. Details of member companies and contact persons

Name and EIC of the company, address, name of manager/contact person, e-mail and contact telephone number, materially responsible person (MPO) and invoicing data.

2.2. Data of drivers (subjects of employment records)

Name and personal identifier (EGN, PESEL or CNP), employer, and employment start and end dates. The name and personal identifier are processed temporarily when a record is submitted; they are not stored in readable form in the permanent online database.

Drivers are not users of the platform and do not have access to it. They are data subjects whose limited employment records are being processed. Their rights are described in Section 9.

2.3. Files for manual processing

When a member company requests manual processing, the original file submitted, its name and size, the user account identifier and email address, the company, language and submission date are processed to fulfil the request. The file may contain personal data included by the member company.

3. Purposes of processing

Preliminary verification of claimed work history of a specific candidate for a professional driver.

Creation and management of the company's membership profile.

Invoicing and execution of contractual relations.

Security, abuse prevention and audit log keeping.

Manual processing of files submitted by companies when automatic reading does not produce a correct result, and communication concerning the request.

4. Legal basis

For the drivers' data: legitimate interest under Art. 6, §1, b. "f" of Regulation (EU) 2016/679 — the specific, real and immediate interest of the future transport employer to check the claimed professional history before employment. A balance judgment has been made between this interest and the rights of subjects. The model has been submitted for an opinion to the Commission for the Protection of Personal Data (КЗЛД) before actual use.

For the data of the member companies: contract performance (Art. 6, §1, b. "b") and compliance with legal obligations, including accounting (Art. 6, §1, b. "c").

5. Data Minimization

Only the minimum necessary for the purpose is processed: employer and period of employment. The platform does not evaluate professional qualities, does not profile and does not rank individuals.

6. Technical and organizational measures

The personal identifier is protected by a cryptographic function and an additional secret value that is not stored in the database or provided to the browser.

The permanent online database does not contain readable names or personal identifiers; even a copy of it is not a readable list of individuals.

Archive data is stored encrypted (AES-256-GCM), and the encryption key is protected with RSA-OAEP 4096-bit; the private decryption key is not located on the server.

Access is closed — only invited and verified companies; demand limits are applied and an audit log is maintained.

7. Recipients and processors of personal data

The data is not provided to third parties beyond what is necessary for the functioning of the service. We use the following categories of processors (subcontractors), all established in the European Union / European Economic Area (EEA):

application hosting provider (in the EU);

database and authentication provider (in the EU);

email service provider (in the EU).

The processing takes place within the EEA. We do not transfer personal data outside the EEA.

8. Period of storage

Employment records and archive: kept as long as they serve the purpose of the register (verification of claimed employment history); are reviewed periodically and deleted upon reasonable request of the data subject.

Data of the member companies (profile): for the duration of the membership and up to 12 months after its termination.

Accounting documents (invoices): 10 years according to the law.

Search audit log: 12 months.

Files for manual processing: retained in the service mailbox until processing and related communication are complete, after which they are deleted, unless an applicable legal obligation requires longer retention.

9. Rights of data subjects

Every data subject, including a driver, has the right to: access their data; correcting; deletion; restriction of processing; objection to processing based on legitimate interest; portability where applicable.

The rights are exercised by requesting: office@driverregister.eu. We respond within a month. You also have the right to appeal to the Commission for the Protection of Personal Data (КЗЛД), Sofia, Prof. Tsvetan Lazarov Blvd. No. 2, www.cpdp.bg.

10. Automated Decision Making

The Platform does not perform automated decision-making with legal consequences. The result of the inspection is only informative and does not replace the assessment and other stages of the selection carried out by the employer.

11. Cookies

The Platform uses only the strictly necessary technical means in the browser to maintain your login and session security. We do not use analytical, advertising or tracking cookies and do not monitor your behavior.

12. Security Breaches

In the event of a security breach that may pose a risk to the rights of subjects, we notify КЗЛД within 72 hours and, where applicable, the affected individuals.

13. Policy Changes

We may update this policy. The current version is available at driverregister.eu, with the effective date indicated (September 27, 2026).