PRIVACY POLICY
Version: 1.0
Effective Date: 19.09.2026
Data Controller: MINING LTD
1. Introduction
1.1 Role of the Controller and Processors - MINING LTD acts as the data controller for all personal data processed through the mobile application, Backoffice, and Owners Portal. Parking owners act as independent controllers for the data they process in relation to their facilities (reservations, financial reports, license plates). Hosting, infrastructure, communication, and technical support providers act as processors under Article 28 GDPR and operate under Data Processing Agreements (DPAs). MINING LTD is not required to appoint a Data Protection Officer (DPO) under Article 37 GDPR.
2. Categories of Users and Personal Data
2.1 Administrators and Operators Backoffice - Identification data: first name, last name, email address, phone number (if provided). Access data: username, hashed password, role, status, last login. Audit logs: actions related to managing parking facilities, devices, clients, owners, reservations, vouchers, system settings, log clearing. System settings: automatic log clearing, retention periods, configuration parameters.
2.2 Clients Mobile Application - Identification data: name, email, phone number, email verification status, last login. Vehicles: license plate number, name, category, fuel type, primary vehicle, date added. Reservations: reference number, status, location, period, duration, price, history, current stay. Payments: status, identifier, MyPOS transaction, amount, date, reason for failure. Interaction data: language, navigation, payment attempts, preferences.
2.3 Parking Owners Owners Portal - Company data: name, UIC/VAT, email, phone, billing address, notes. Access: username, hashed password, status, last login, change history. Parking facilities: name, address, description, contacts, geolocation, status, capacity, blocked spaces, prices, working hours, amenities, vehicle types. Photos: up to 20 photos, cover image, upload date. License plates: number, description, status, date added. Vouchers: code, description, discount, validity, status. Reservations: reference number, status, period, history, price. Financials: payments, refunds, revenue, commissions, fees, subscriptions, rate history, transactions.
2.4 Device and System Logs - Device ID, type, firmware, status, last connection, associated parking facility, logs, commands, connectivity.
2.5 Social Login Google and Facebook - Processed data: name, email, User ID, profile picture, verified email. The platform does not receive passwords, contacts, posts, or friend lists. Legal bases: Article 6(1)(b) – contract; Article 6(1)(a) – consent. Recipients: Google Ireland Ltd., Meta Platforms Ireland Ltd. Purposes: authentication, account creation, login, synchronization. Retention: while the account is active + 12 months archive. Withdrawal: Google Account → Security → Thirdparty apps; Facebook → Settings → Apps and Websites.
2.6 Data Sources - Data may be obtained directly from the user; from Google/Facebook; from MyPOS; from devices; from parking owners.
2.7 Geolocation - The platform may process client geolocation data (precise or approximate) when the user explicitly enables or permits this functionality through device or app settings. Geolocation is used solely to display nearby parking facilities, improve navigation, and optimize the user experience.
Processing is carried out on the basis of Article 6(1)(a) GDPR – consent, which can be withdrawn at any time via device or app settings. Geolocation data is not stored and not used for profiling or marketing purposes.
3. Legal Bases for Processing
Contract performance; Legal obligation; Legitimate interest; Consent; Vital interest; Device data; Financial data.
3.1 Special Categories of Data - MINING LTD does not process sensitive data under Article 9 GDPR.
3.2 Legitimate Interest - MINING LTD may process personal data based on legitimate interest when necessary to prevent abuse, detect and investigate violations, protect platform security, protect parking infrastructure, safeguard the rights and interests of MINING LTD, parking owners, clients, or third parties, and resolve disputes related to the service. Processing is carried out only when the legitimate interest does not override the rights and freedoms of data subjects.
4. Purposes of Processing
Service provision and maintenance; Reservation and access management; Payments; Financial operations; Security and fraud prevention; Functionality improvement; Communication; Legal obligations; Vital interest protection; Marketing (only with consent).
4.1 Automated Decision-Making - The platform uses automated processes through LPR cameras and devices. These do not produce legal or significant effects, and human intervention is always possible.
4.2 Violations and Incidents - MINING LTD may process personal data in cases of parking rule violations, unlawful actions, antisocial behavior, or incidents at parking facilities. Data may include license plates, access device data, logs, stay history, and other information necessary to establish facts, protect legitimate interests, prevent abuse, and support parking owners in managing their facilities.
4.3 Complaints Reports and Disputes - MINING LTD may process personal data when receiving, reviewing, and resolving complaints, reports, requests, or disputes between clients, parking owners, or other platform participants. Data may include reservation information, license plates, device logs, action history, and communication, when necessary to establish facts, protect legitimate interests, and comply with legal obligations.
5. Categories of Data Recipients
Parking owners; MyPOS; hosting providers; communication providers; technical support; public authorities; internal teams; devices and automated systems; third parties under legal obligation. Never shared: passwords, full payment card data, sensitive data, data about other parking facilities, marketing data without consent.
5.1 Abandoned Vehicles In cases of abandoned vehicles - MINING LTD may process license plates, stay history, device logs, and reservation information to identify the owner, notify authorities, and assist the parking owner in taking action.
5.2 Video Surveillance - Some parking facilities accessible through the platform have video surveillance and DVR systems managed by the respective parking owner. MINING LTD does not record, store, or process video footage unless provided by the parking owner under legal obligation or legitimate request from competent authorities.
Video surveillance is used for: security and asset protection; incident and abuse prevention; access control; supporting investigations of violations.
The parking owner is the controller of video footage and determines: retention periods; technical and organizational measures; access rights; disclosure to authorities.
MINING LTD processes only automated access data (LPR cameras, barriers, communication modules) and does not process video content.
5.3 Sharing Data with Property and Facility Managers - Personal data may be shared with parking owners and their authorized representatives, including property management companies, homeowners’ associations, facility operators, or other entities managing the parking facility. Shared data may include reservation information, license plates, stay history, access data, and other information necessary for facility management, security, legal compliance, and service provision.
These recipients act as independent controllers for the data they process and are responsible for their own privacy policies, retention periods, and security measures.
MINING LTD does not share personal data with third parties outside these categories unless legally required.
6. Data Retention Periods
client profiles – until deletion + 12 months; vehicles – until deletion; reservations – 5 years; payment data – 10 years; access logs – 12 months; company data – contract + 10 years; parking facility data – active use + 24 months; license plates – until deletion; vouchers – 24 months; financial reports – 10 years; administrators/operators – until deletion + 12 months; audit logs – 24 months; device logs – 5 days; commands – 30 days; connectivity – 30 days; checks – as required; legal proceedings – + 5 years; security – 12 months; fraud – 24 months; diagnostics – 30 days.
7. Rights of Data Subjects
access; rectification; erasure; restriction; portability; objection; optout of automated decisions; withdrawal of consent; complaint; judicial protection. Response time: 30 days (extendable by 60 days).
7.1 Right to Lodge a Complaint Commission for Personal Data Protection (CPDP) – Prof. Tsvetan Lazarov Blvd. 2, Sofia 1592
7.2 Portability Format - Personal data is provided in a structured, commonly used, and machinereadable format, depending on the technical capabilities of the Platform at the time of the request. The format may include tabular or text files suitable for transfer to another controller.
8. Security of Processing
MQTTS, TLS, AES128 + HMAC256; device security; encryption at rest; rolebased access; DDoS protection; backups; incident procedures; DPIA for new technologies.
8.1 Breach Notification - Notification to CPDP within 72 hours + notification to affected individuals when required.
8.2 Incidents Damage and Infrastructure Protection - In cases of equipment damage or other incidents, MINING LTD may process license plates, device logs, command history, and access information to determine causes, identify involved parties, and protect infrastructure.
9. International Data Transfers
adequate countries; SCC; technical and organizational measures; cloud providers; payment operators; technical support; legal transfers.
9.4 Transfers to the USA Google Meta - SCC + TLS + encryption + restricted access are used.
10. Cookies and Tracking Technologies
strictly necessary; functional; analytical; no marketing cookies. Managed through browser settings.
11. Children’s Data Protection
The platform is not intended for individuals under 16 years of age. If such a profile is detected, it is deleted immediately.
12. Changes to the Policy
Users are notified of significant changes. The new version becomes effective on the date of publication.
13. Contact Information
MINING LTD
Address: BULGARIA, Sofia (1113), Slatina district, Shipchenski Prohod Blvd. 18, Galaxy Business Center, 2nd floor, Office 206–210.
Email: service@0km.space
Phone: +359 876345677
Website: https://0km.space/