Privacy Policy
Last updated: 20 October 2026
This policy explains how KHL Moto Travel EOOD processes your personal data when you use khlmototravel.com, book a tour or a rental, contact us or visit our workshop. It follows Regulation (EU) 2016/679 (GDPR) and Bulgarian law.
1. Who is responsible for your data
The controller is KHL Moto Travel EOOD, company ID (EIK/BULSTAT) 206060692, registered office: Burgas 8000, Alexandur Stamboliisky 5, Bulgaria. Workshop and pick-up: Tsiklama 1, Kazichene, Sofia. Email: info@khlmototravel.com. Phone: +359 898 754 877. For any question or request about your personal data, write to the email address above.
2. What data we process, why and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| Booking and running a guided tour | For every participant: name, date of birth, country, phone, email, driving licence category and riding experience (riders), clothing size, motorcycle and room choice, special requests | Performing the contract with you (Art. 6(1)(b) GDPR) |
| Booking and running a rental | Name, date of birth, contact details, driving licence number, category and issue date, planned route, ID/passport and licence shown at pick-up | Performing the contract (Art. 6(1)(b)); checking the legal requirements for the rider |
| Payment | Order, amount, payment status and reference numbers from BORICA. We never see or store your card number. It is entered on the secure BORICA page | Performing the contract; legal obligations (Art. 6(1)(c)) |
| Enquiries and customer service | Name, email, phone, the content of your message, the tour, dates and motorcycle you ask about | Steps at your request before a contract (Art. 6(1)(b)); our legitimate interest in answering (Art. 6(1)(f)) |
| Accounting, invoicing and tax | Order and invoice data, billing name and address | Legal obligation (Art. 6(1)(c)) |
| Security, fraud prevention, claims | Technical data (IP address, browser), order and enquiry logs, anti-spam checks on forms | Legitimate interest (Art. 6(1)(f)); defending legal claims |
| Reminders about your booking | Email address and booking details | Performing the contract |
| Newsletter and marketing (only if you sign up) | Email address | Your consent (Art. 6(1)(a)). You can withdraw it at any time |
| Photos and video from tours | Images of participants taken by our guides | Our legitimate interest in promoting our tours, with your right to object (see section 7) |
| Website analytics and marketing cookies (only if enabled) | See the Cookie Policy | Your consent (Art. 6(1)(a)) |
Providing the data marked as required in the booking forms is necessary to conclude the contract. Without it we cannot confirm a booking. Some data, such as a driving licence, is also needed to check legal and insurance requirements.
3. Who receives your data
- BORICA (payment provider and card processor) for card payments and refunds.
- Service providers who help us run the website and send emails: hosting, email delivery, spam protection (Cloudflare Turnstile, if enabled) and similar processors. They act on our instructions.
- Local partners who deliver parts of a tour, such as hotels, guides, bike suppliers and transport at the destination. They receive only the data they need, for example your name, dates and the motorcycle you ride.
- Insurers, where a claim or the insurance requires it.
- Accountants, auditors and legal advisers, bound by confidentiality.
- Public authorities (tax, police, courts) where the law requires or allows it.
We do not sell your data.
4. Transfers outside the EU
Many of our tours take place outside the European Union (for example Morocco, Georgia, Pakistan, Colombia, South Africa and Namibia). To run the tour we must give our local partners there the data they need. Where the country has no EU adequacy decision, we do this because it is necessary to perform the contract with you (Art. 49(1)(b) GDPR), or we use standard contractual clauses where this is possible.
5. How long we keep your data
- Booking and order data: for the period required by accounting and tax law, and afterwards only as long as needed to handle claims within the limitation periods.
- Enquiries that do not lead to a booking: up to 2 years.
- Driving licence and ID details of renters: while the rental runs and for as long as needed to handle damage, fines and claims.
- Newsletter: until you unsubscribe.
- Cookies: see the Cookie Policy.
6. Security
The website uses HTTPS. Card data is handled only by BORICA. Access to bookings is limited to authorised staff, forms are protected against abuse, and we use trusted processors. No system is perfectly secure, but we take reasonable technical and organisational measures and report data breaches as the law requires.
7. Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw a consent you gave at any time (this does not affect processing before the withdrawal). To object to our use of your photos or videos, write to us and we will stop using them where possible. We answer within one month. We do not make decisions about you based only on automated processing.
If you think we process your data unlawfully, you can lodge a complaint with the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg) or with the supervisory authority in your country.
8. Children
Our tours and rentals are for adults. We do not knowingly collect data from persons under 18 without the consent of a parent or guardian.
9. Changes
We may update this policy. The date at the top shows the latest version. If a change is important, we will tell you by a notice on the website or by email.