This is a convenience translation. The Bulgarian version is the authoritative text.
MAGICLINE ENERGY SYSTEMS EOOD · Last updated: 21 October 2026
1. Controller
MAGICLINE ENERGY SYSTEMS EOOD (МЕДЖИКЛАЙН ЕНЕРДЖИ СИСТЕМС ЕООД), UIC 207913813, Sofia, 56 Vitosha Blvd., fl. 1, office 1 (“we”), is the controller of the personal data processed in connection with the “MGLBG Charge” mobile application and the electric vehicle charging service. Contact for personal data matters: info@magiclineenergy.com.
This policy is a notice under Art. 13–14 of Regulation (EU) 2016/679 (“GDPR”). It is not a contract and does not require your consent, except in the cases expressly stated (section 6).
2. What data we process
- Identification and contact data: first name and surname; mobile telephone and e-mail (verified); country, city/district and address; identification number.
- Account data: password (cryptographic hash only); status; accepted versions of contractual documents with date and time; withdrawals of consent; trusted devices (name); sign-in history (incl. IP address).
- Vehicles (optional): registration plate, make, model, colour, year, battery capacity, type.
- Charging sessions: station, charging point, start/end, energy delivered (kWh), interim readings, status and interruption reason, final price; for DC stations — technical data from the vehicle during charging, where available.
- Payment data: approved (blocked) and captured amount, authorisation status, transaction references, bank response code on failure, fiscal receipt data. We do not collect or store card numbers or other card data — these are processed solely by the payment terminal and the acquiring bank.
- Support: content of enquiries and replies, link to session/payment, language.
- Technical data: push notification token, platform, application version, server logs.
- Crash reports: anonymous technical reports (random installation identifier, truncated description), not linked to your profile.
Location: the Application uses the device’s location solely to show nearby stations on the map. No location history is stored on our servers. The permission is optional and can be revoked in the device settings.
Cookies and tracking: the Application uses no cookies and contains no third-party advertising or analytics tools (no Google Analytics, Crashlytics, Meta SDK, ad networks). Only technologies necessary for the service are used: secure local storage on the device (sign-in session, settings), Firebase Cloud Messaging for notifications (after the operating system permission) and Google Maps for the map. Advertising identifiers (IDFA/AAID) are not collected.
3. Purposes and legal bases (Art. 6 GDPR)
| Purpose | Basis |
|---|---|
| Registration, account management, authentication (one-time codes, trusted devices) | (b) — contract |
| Provision of the charging service, metering, pricing, fiscal receipt and invoice | (b); (c) — VAT Act, Ordinance N-18, Accountancy Act |
| Payment handling and abuse prevention | (b); (f) — legitimate interest |
| Support and complaints | (b); (c) (CPA) |
| Essential service messages (charging, payment, account, replies) — notifications, SMS, e-mail | (b) — contract; not marketing |
| Marketing messages about campaigns (push, e-mail, SMS) | (a) — explicit consent (section 6) |
| Security, logs, prevention of unauthorised access | (f) — legitimate interest |
| Technical crash reports (anonymous) | (f) — legitimate interest |
| Charging infrastructure data under Art. 20 of Regulation (EU) 2023/1804 (no personal data) | (c) |
| Establishment, exercise or defence of legal claims | (f) |
No automated decision-making with legal effects under Art. 22 GDPR takes place. The automatic stop of a session upon reaching the approved amount is a contractual feature, not profiling.
4. Recipients
Contracts under Art. 28 GDPR are concluded with our processors:
- Amazon Web Services EMEA SARL — hosting (Frankfurt, Germany, EU); Amazon SES — e-mail;
- SMSAPI (LINK Mobility Group) — one-time-code SMS;
- Google Ireland Ltd — Firebase Cloud Messaging (push notifications); Google Maps — map display (for part of the processing Google acts as an independent controller);
- the acquiring bank and the payment terminal provider — independent controllers / payment service providers: the card payment is processed entirely by the terminal and the bank; we receive only the result;
- accounting, audit and legal advisers; public authorities (NRA, CCP, CPDP, courts) — where legally required.
Personal data is not sold and not shared for third-party marketing.
5. Transfers outside the EU/EEA
Data is stored in the EU (AWS, Frankfurt region). For Google services and LINK Mobility group providers, limited transfers to third countries (incl. the USA) are possible on the basis of the EU-U.S. Data Privacy Framework and/or standard contractual clauses under Art. 46(2) GDPR.
6. Marketing messages (consent)
Marketing messages about campaigns (push, e-mail, SMS) are sent only with your explicit consent — the optional “Campaign notifications” consent at registration or later in the profile. The consent is a single one for all three channels, is not a condition for the service, and can be withdrawn at any time from the profile or via the unsubscribe link in every e-mail. Withdrawal does not affect the lawfulness of prior processing. The date and version of consent and withdrawal are documented. Service messages do not depend on this consent.
7. Retention periods
| Data | Period |
|---|---|
| Account and profile data | until account deletion |
| Accepted contractual documents and consents | for the duration of the account and until expiry of limitation periods |
| Sessions (summary data), payment records, fiscal documents | 10 years + the current year (Art. 38 Tax-Insurance Procedure Code; Accountancy Act) |
| Interim metering readings | 30 days after the end of the session |
| Real-time DC charging technical data | 90 days |
| Crash reports | 30 days |
| Sign-in history (incl. IP) | for the duration of the account; IPs deleted upon account deletion |
8. Account deletion
The account is deleted from the Application (Profile → Delete account) after confirmation with password and a one-time code, or by a request from the registered e-mail to info@magiclineenergy.com after an equivalent identity check. Deletion is not performed during an active charging session.
Deleted or anonymised immediately: name and surname; identification number; e-mail and telephone; address; password; active sessions and tokens on all devices; trusted devices; IP addresses in the sign-in history; notification tokens; vehicle registration plates; records of sent e-mails.
Retained, separated from your name and linked only to an internal identifier: session and payment data and fiscal documents — for the statutory accounting and tax periods (Art. 17(3)(b) GDPR), and records of accepted documents and consents — for defence against claims (Art. 17(3)(e)).
Deletion is final; a new registration with the same e-mail/telephone creates an entirely new account. Payment obligations for services already provided remain.
9. Security
Encrypted communication (HTTPS/TLS, also within the internal network); passwords as cryptographic hashes only; access to the payment terminal only via an encrypted private tunnel (VPN); separated databases with per-module access rights; logging of administrative actions; backups. No card data is stored with us.
10. Your rights
You have the right of: access (Art. 15 GDPR); rectification (Art. 16); erasure (Art. 17); restriction (Art. 18); portability (Art. 20); objection to processing based on legitimate interest (Art. 21); withdrawal of consent at any time (Art. 7(3)). Rights are exercised through the Application or at info@magiclineenergy.com; we reply within one month.
You may lodge a complaint with the Commission for Personal Data Protection: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., www.cpdp.bg, kzld@cpdp.bg, and with the competent court.
11. Whether providing data is mandatory
Data marked as mandatory at registration is necessary for the conclusion and performance of the contract; without it registration is impossible. Vehicle data and the location and notification permissions are optional.
12. Changes
The new version is published in the Application and on our website with an update date; for material changes we will notify you through the Application or by e-mail.