PERSONAL DATA PROTECTION POLICY OF “YELLOW 333” JSC

Important—language precedence. This English translation is provided for convenience. In the event of any discrepancy, ambiguity, or conflict between this English version and the original Bulgarian version, the Bulgarian version prevails and shall be binding.

“Yellow 333” JSC (“Yellow”, “we”, “us”) is a personal data controller. We take a highly responsible approach to all personal data you provide for the purposes of our activity—namely, taxi transport and related services. We have created this Privacy Policy to inform clients of our services (“you”, “your”) about the categories of personal data we collect and the ways we process and store them, in accordance with applicable national and European data protection legislation.

We collect your personal data mainly in relation to and for the purposes of:
(i) the way you choose to use our taxi services (subscription or one-off orders) and/or request a taxi (by phone, online, via mobile app) and/or express services (by phone, online, via mobile app)[1];
(ii) your use of our website;
(iii) registration in “Become a Driver”;
(iv) completing contact forms when you reach out to us online (e.g., for subscription services via our website or to use the “taxi button” service, etc.).

WHAT DATA WE COLLECT AND FOR WHAT PURPOSES (PROCESSING PURPOSES)

1. Ordering a taxi and contacting us by phone

When you order a taxi at 02/91119 or 1219, for service provision we require a contact phone number, the pickup address, and the desired direction (final destination). For operational and accounting purposes—and to provide a comfortable trip every time—we record the route and end point of your trip, as well as other additions (payment method, traveling with pets, and any information provided by the user).

For your convenience on subsequent calls (and again for accounting), we store your phone number and the last few addresses from which you requested a taxi.

Additionally, when ordering a taxi—or calling for another reason (complaint, lost property, etc.)—including to our call center at 02/4911108, the call is recorded to improve service. Order recordings are kept for up to 3 months and then automatically deleted. In case of a dispute, a particular recording may be kept until its final resolution.

Please note that if you do not want these data to be stored and used by us during your subsequent use of our services, it is technically impossible for us to delete them automatically. You must request deletion by email to office@yellow333.com. Be aware this will result in loss of your order history. Data may also not be deleted if we are required to retain them under a specific legal act or an official request, as well as where our legitimate interest allows retaining part of your data.

2. Ordering a taxi via the mobile application

You can order a taxi via our Yellow taxi mobile app (on the platform of our partner Autocab). For registration (Google Play or App Store app) you provide your first and last name, email, and contact phone. For operations and accounting, we record your pickup address, the route, and final destination. You may optionally store home/work and other “favorite addresses” for faster ordering.

If you enable location services on your device, the app automatically recognizes your location and you do not need to enter a pickup address. You can also add several addresses as “via points” en route to your destination. These via points are stored in the app’s order history and in Autocab to facilitate future trips.

When ordering to/from Sofia Airport we may request additional information needed to perform the service (number of passengers, luggage, etc.).

When you pay through our app, payment processing is performed by Stripe, our trusted payment service provider.
If you choose Google Pay or Apple Pay, your actual card data and any biometric data are first processed by Google Ireland Ltd. or Apple Distribution International Ltd., who tokenize the information and forward it to Stripe to complete the payment.
Yellow has no access to actual card data or biometric data. We receive only the minimum transaction information—tokenized card identifier, amount, currency, date/time, transaction status, and in some cases name or email if shared by the payment service. These data are necessary to perform the contract with you, ensure accountability, and handle disputes/refunds.

More details can be found in the following privacy policies:
Stripe: https://stripe.com/en-bg/privacy
Google Pay: https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en-GB
Apple Pay: https://www.apple.com/legal/privacy/data/en/apple-pay/

Please note that if you do not want these data to be stored and used by us during later use of our services, it is technically impossible for us to delete them automatically. Request deletion by email to office@yellow333.com. Data may not be deleted if a specific legal act or authority requires retention, or where our legitimate interest allows retaining part of your data. Also note that if you delete the data in the mobile app—i.e., your account—you will no longer be able to use this service unless you register again.

Additionally, by installing our app on your device you obtain personal data of our drivers who serve you (or have served you) so that you can identify which driver is fulfilling your order. These data may remain on your app for a certain time for your convenience (lost property, complaint, driver rating, or other info you wish to share with us). It is entirely your responsibility not to use drivers’ personal data for purposes other than those listed here.

3. Ordering a taxi via the online platform

You can also order online through our web-based platform: https://eb3.autocab.net/#/30410.

You may register to order, providing your first and last name (a pseudonym may be used), email, and contact phone. This creates your web-ordering profile.

To place an order, we require your pickup address and desired direction (final destination). For operations and accounting, we record the route and end point of your trip. You may also provide other information such as number of passengers, luggage, payment method.

When you pay via our web platform, payments are processed by Stripe. If you choose Google Pay or Apple Pay, your actual card and any biometric data are first processed by Google Ireland Ltd. or Apple Distribution International Ltd., who tokenize the data and forward it to Stripe.

Yellow has no access to actual card or biometric data. We receive only the minimal transaction information listed above, required to perform the contract, ensure accountability, and process disputes/refunds.

Privacy policies:
Stripe: https://stripe.com/en-bg/privacy
Google Pay: https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en-GB
Apple Pay: https://www.apple.com/legal/privacy/data/en/apple-pay/

Please note that if, as a registered user of the web platform, you do not want your data to be stored and used by us during later use, it is technically impossible for us to delete them automatically. Request deletion by email to office@yellow333.com. Data may not be deleted if retention is required by law/authority or permitted under our legitimate interest. Note that if you delete your data in the web platform, you will be able to order taxis only without registration (unless you register again), which will significantly reduce the convenience of fast ordering.

[1] For more detailed information on ways to order a taxi and/or express service, see Yellow’s Terms and Conditions, available on our website.

4. Ordering express services

If you use our additional Express Services (“Deliveries”, “Assistant”, “Tours”), we keep the same scope of data as for taxi orders. Express orders are placed by phone only. Our legitimate purposes and needs for your data are again to perform the services and to provide a smoother experience for repeat orders.

5. Use of vouchers / Yellow Subscribers

If you are a subscription client, you and/or your organization’s employees use our taxi services and pay with e-vouchers.

Yellow applies reliable technical and organizational measures to protect the personal data contained therein. All subscriber orders placed via e-voucher are processed in our Autocab system as described below. Separately, subscription clients receive access to our CAP system where they can enter their employees, vouchers used, and monitor reporting under the contract. Yellow has no access to this system; it is maintained for the convenience of subscription clients. They determine the processing purposes and the data entered in CAP, and a separate data processing agreement is executed between the parties.

Subscribers often use our airport transfer services. In this context Yellow receives data of third parties—guests or employees of subscribers. The information is forwarded to our drivers who prepare signs (paper or tablet) with the passenger’s first and last name for identification. We process: name and surname, contact phone, flight number, terminal, destination, and payment method.
Vouchers under subscription programs may also be used to pay for express services.

6. Personal data in customer rating (scoring)

As detailed in Yellow’s Terms and Conditions, section “Customer rating”, you may be rated by Yellow with respect to your proper conduct towards us, our drivers, and operators.

Typically, client assessment is done manually: feedback from drivers is recorded against your phone number (e.g., unpaid fare, no-show after ordering, etc.). This helps us decide whether, and at what times, to accept orders from you. We also manually enter ratings for clients to be rewarded (e.g., for many orders/completed trips).

Part of the assessment is done with automated processing—an algorithm in our ordering system calculates the share of orders you placed but did not use. This is an automatic setting but not entirely—it is under our control. Based on your rating we determine whether to continue serving you and whether to serve you during peak hours. Clients are grouped into categories (e.g., “perfect client”, “client soon to be limited”, “limited client”). Status may change automatically depending on usage. We regularly review our system and algorithms and retain the ability to change status manually where appropriate.

Please note that even if you do not use our services for a longer period and/or request full deletion of your personal data (name, pickup address, route, etc.), it is in our legitimate interest to retain at least your phone number and client status for a certain period so we can recognize improper clients and protect against abuse (and to protect our legal rights and interests in potential disputes). The retained data are minimal and used solely for the purposes described here, without significantly affecting your rights and freedoms.

Ratings are used for both taxi and express services.

7. Autocab / Other necessary information

We use the international Autocab system (www.autocab.com) to provide our services. When you confirm a taxi or express order (via any available channel), the data you provide are securely stored in Autocab’s online booking system, which complies with applicable data protection law. If you apply in “Become a Driver” in our app, your data are also stored in Autocab until a contract is signed (after which they are stored in your capacity as a driver, along with other data) or deleted if no contract is signed.

Data stored via Autocab are kept on servers within Europe. Autocab fully follows our instructions regarding your data and their storage.

We may use and analyze aggregate information (collective data relating to groups or categories of services or clients from which individual identities/characteristics are removed) to administer, maintain, improve, and develop our services.

In connection with specific requests (e.g., health conditions or disability level, number/age of children, data about pets), we may incidentally record such details. This information is processed with appropriate technical and organizational measures and in line with applicable law.

If you pay via POS terminal in a car equipped with one, your card data may be processed to provide the requested service. This is done through a card reader operated by myPOS (https://www.mypos.eu/bg) in accordance with applicable data protection laws.

For the services “Ordering via mobile app” and “Ordering via online platform”, please also note that these platforms may collect information about you on their own legal basis. You should check their respective privacy policies (e.g., Stripe, Google Play, App Store, Google Pay, Apple Pay, browsers used by the e-booker) to understand how they use your information and how to opt out or delete it.

When you book a taxi or use our other services, your data are used responsibly by our operational staff solely to provide the service. Our staff and drivers are trained and we monitor compliance with our data protection rules. We base all processing on our internal data protection policies aligned with applicable national and EU legislation.

8. Website

Through our official website https://www.yellow333.com/ we provide various options to contact us, such as:
• inquiries about subscription services;
• inquiries about the “taxi button” service;
• contacting us for advertising;
• rating a driver or car;
• contacting us about lost property, etc.

For these purposes we collect: first and last name, email, and contact phone. When submitting a report you may optionally provide other data (e.g., in “Subject” and/or “Message”). We store only the information necessary to contact you back. Any additional personal data you provide are not processed or stored by Yellow, and we are not responsible for such data if you choose to provide them. Data in these cases are kept until service performance, response to the client, or completion of the check and resolution of the specific case/dispute.

From https://www.yellow333.com/avtomobili-yellow-taxi/sistema-za-obyavi you may access the independent classifieds page https://borsa.yellow333.com. There you register with a username, email, and phone number. Free ads for cars can be exchanged there. A separate privacy policy is available at https://borsa.yellow333.com/24/zld, which we strictly follow.

Please note that without the minimum data listed above, our contact systems cannot function properly and we cannot provide services to you.

When you visit our website, we collect standard web log information and details about visitor behavior patterns to determine, for example, the number of visitors to various parts of the site. We collect this information in a way that does not identify anyone. We do not attempt to discover the identity of visitors using these data and do not associate log data with personally identifying information from any source.

Our website may contain links to other websites of interest. Once you use these links and leave our site, you should know we have no control over those websites. We cannot be responsible for the protection and privacy of any information you provide while visiting such sites, as they are not governed by Yellow’s Privacy Policy.

9. Registration in “Become a Driver” in our mobile app

Through our app you can quickly submit a request to become our driver, and we may invite you to sign a contract. After submission you will receive an automatic email; after review we will contact you regarding a contract. Data provided by you are retained only if a contract is concluded; otherwise they are deleted once no longer needed. If you become our driver, a separate Driver Privacy Policy will apply.

10. Platforms we use

We use Instagram (https://www.instagram.com/yellowtaxibg/), YouTube (https://www.youtube.com/channel/UCG9hjWJ4riXMJ2PlQgKzqwQ), and Facebook (https://www.facebook.com/YellowTaxiBGMobile/). We use these platforms to stay in touch with followers; they are not intended for processing your personal data, nor do we have access to such data. Review the privacy policies of these platforms to learn what data they process.

Our pages integrate plugins from Facebook and Instagram. When you visit our pages, the plugins create a direct connection between your browser and the platforms’ servers. As the page provider, we do not receive information about the content of transmitted data or their use by these platforms. See the privacy policies of Facebook, Instagram, Twitter, and LinkedIn. If you do not want a platform to link visits to our pages with your user profile there, simply log out of your account on that platform.

When logged into YouTube, your browsing behavior may be mapped to your user profile. You can prevent this by logging out. More information: https://www.google.com/intl/bg/policies/privacy.

WHAT IS OUR LEGAL BASIS FOR PROCESSING?

Yellow lawfully processes your personal data on the basis of:
a) our legitimate interests in providing taxi and express services as described above;
b) our legitimate interests in maintaining our website, mobile app, and platform pages in good working order to inform you about our services and communicate with you conveniently;
c) contractual necessity (e.g., subscription agreements); and
d) legal obligations under applicable national and EU law.

WHO HAS ACCESS TO YOUR DATA? THIRD PARTIES / RECIPIENTS

Yellow does not grant access or transfer your data to third parties, except in the cases strictly related to providing our services.

Your data may be used by our technology partners enabling communication and service delivery (e.g., Autocab, Google Play, Stripe, Google Pay, Apple Pay, etc.). The provider dispatching SMS notifications about your order status also has access to your mobile number.

Depending on the communication channel you used, our drivers receive access to personal data necessary to perform the transport service. All drivers strictly follow our customer data protection policies and are personally responsible to use these data only for providing taxi services. Some channels enable (without Yellow’s knowledge/will) direct contact between drivers and passengers (you). Drivers are expressly informed they may not use such data to contact you for purposes other than providing the service (unless you explicitly agree). Yellow is not responsible if, despite this, a driver and/or you decide to contact each other for other purposes via, for example, personal Viber profiles. Yellow cannot delete data from personal profiles.

Where lawful and under our legitimate interest, we may provide your data to our legal advisors in specific cases and only if necessary.

DATA TRANSFERS

Yellow does not transfer your data outside the EU/EEA. Our website servers are located in Bulgaria. Autocab stores your data in Europe.

With respect to Stripe, Google Play, and App Store, which may store some of your data (even fragmentary and/or non-identifying) in third countries (e.g., the USA), we have reviewed their privacy policies and safeguards. You can review them on their official pages. Transfers to the USA and the provision of adequate protection are based on the Standard Contractual Clauses currently in force.

INFORMATION SECURITY

We are committed to ensuring that the information you provide is protected. To prevent unauthorized access or disclosure, we have implemented appropriate physical, electronic, and managerial procedures for safeguarding and storing the information we collect online. We maintain up-to-date technical and organizational measures to keep your data secure and protect against risks.

HOW LONG DO WE STORE YOUR DATA?

Beyond the specific retention terms stated above, we store different categories of your personal data for as long as necessary to meet legal, regulatory, or internal requirements and to achieve the processing purposes described in this Policy, in accordance with Bulgarian and EU law. In any case, retention does not exceed 4 years. For more details about specific retention periods, please contact us using the details below.

YOUR RIGHTS

You have the right to request information, a copy, access to, or deletion of your personal data, as well as restriction of processing. You may object to processing. You have the right to information and comment regarding automated processing in cases where we use it.

Since we want to ensure your personal data are accurate and up to date, you may also request that we correct or remove any information you believe is inaccurate.

Please note these rights are not absolute and may not apply in all circumstances. There may be situations where we cannot comply—for example, if we cannot verify your identity, or if you request deletion but we have a legal obligation to retain certain data. If we must refuse your request in whole or in part, we will inform you of the refusal and explain our actions and reasons.

For any of the requests above, send a description of the relevant personal data to: office@yellow333.com. We may request additional identity evidence to protect your data against unauthorized access.

If you have concerns about how your personal data are processed or wish to lodge a complaint, contact us at office@yellow333.com for information. If you are not satisfied with our response or believe we are not processing your data lawfully, you may lodge a complaint with the Commission for Personal Data Protection (https://www.cpdp.bg/).

UNSOLICITED DATA

If, in connection with registration, email, or other channels, you provide additional personal data not necessary for our services, you do so voluntarily. Yellow does not store data not required for the purposes above and is not responsible for such data if provided without our explicit request.

CHANGES

This Privacy Policy was last updated in September 2025. We may amend it to comply with applicable data protection laws. Please check the Policy from time to time for changes. It is always available at an easy and visible location on our website. Any amendment applies from the date it is published on the website.

CONTACTS

If you have questions about your rights or specific requests (access, deletion, retention terms, etc.) related to your personal data, please contact our Data Protection Officer: Denitsa Deleva, tel. 02/962 13 33, or the Company’s counsel: attorney Tanya Futekova, Sofia, 56 “Han Asparuh” St., floor 1, office 1, tel. 02/937 01 70.

[1] For all the ways you can book a cab, you can also get more detailed information from the Yellow's Terms&Conditions, which are located in an accessible place on our site.