Privacy Policy

General information

As of 25 May 2018, a new General Data Protection Regulation (GDPR) adopted by the European Union comes into force. The Regulation aims to ensure the protection of data of individuals from all EU Member States and to harmonise the regulations for their processing.

As a data controller for the provision of training, translation and legalisation services, …………………….. complies with all the requirements of the new regulation by only collecting individuals’ data insofar as it is necessary for the provision of the service, and storing it responsibly and lawfully.

Information about the Data Controller

1. Name ……………………..
2. BULSTAT: ……………………..
3. Headquarters: ……………………..
4. Address: ……………………..;
5. Contact person: ……………………..
6. E-mail: ……………………..
7. Phone.: ……………………..
8. Personal data controller certificate number No……………………..

Information on the Data Protection Officer

1. Data Controller: ……………………..
2. Contact person: ……………………..
3. Phone: ……………………..
4. Email: ……………………..

Information on the competent supervisory authority

1. Name: Commission for Personal Data Protection
2. Registered office and registered address. Registered office and registered office: 1592 Sofia Blvd. “1592, Proff. No. 2 Tsvetan Lazarov
3. Correspondence data. Registered office and registered office: 1592 Sofia Blvd. “1592, Proff. No. 2 Tsvetan Lazarov
4. Phone: 02 915 3 518
5. Email: kzld@government.bg, kzld@cpdp.bg
6. Website: www.cpdp.bg

…………………….. operates in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

Basis for collecting, processing and storing your personal data

Art. 1. (1) …………………….. collects and processes your personal data in connection with the provision of training, translation and legalization on the basis of Art. 1, Regulation (EU) 2016/679, and in particular on the basis of the following:

• Your explicit consent as a customer;
• Performance of ……………………..’s obligations under a contract with you;
• Compliance with a legal obligation that applies to ……………………..;
• For the purposes of the legitimate interest of ………………………

(2) …………………….. is the data controller with respect to your data as users of our services. With respect to personal data that you process using our services, …………………….. acts as a processor.

Purposes and principles for the collection, processing and storage of your personal data

Art. 2. (1) …………………….. collects and processes the personal data you provide to us in connection with the use of our services and to enter into a contract with the company, as well as to register for participation in our events, including for the following purposes:

• individualization of a contracting party;
• accounting purposes;
• statistical purposes;
• information security protection;
• securing the performance of the service contract;
• sending information and service change messages;
• Improve and personalise the service by offering relevant service offers that may be of interest to you;

(2) …………………….. complies with the following principles when processing your personal data:

• legality, fairness and transparency;
• limitation of the purposes of processing;
• relevance to the purposes of the processing and minimisation of the data collected;
• data accuracy and timeliness;
• limitation of storage to achieve the objectives;
• integrity and confidentiality of processing and ensuring an appropriate level of security of personal data.

(3) In processing and storing personal data, …………………….. may process and store personal data in order to protect its legitimate interests:

• performance of its obligations to the National Revenue Agency, the Ministry of the Interior and other state and municipal authorities.

What types of personal data does …………………….. Ltd collect, process and store?

Art. 3. (1) …………………….. performs the following operations with personal data for the following purposes:

• Registering users of training and translation services in a client management system. The Data Protection Officer considers that the operation “Conclusion of a training/translation contract” is admissible and provides sufficient guarantees for the protection of the rights and legitimate interests of data subjects in accordance with the requirements of the GDPR.
• Conclusion and execution of a commercial transaction with a customer or partner – the purpose of this operation is the conclusion and execution of a contract with a commercial partner or customer and its administration;
• Sending information messages – the purpose of this activity is to administer the process of sending messages to customers that relate to improvements or changes to the services under the service contract.
• Newsletter Sending – the purpose of this operation is to administer the process of sending newsletters to customers who have opted in to receive them;

(2) …………………….. processes the following categories of personal data and information for the following purposes and on the following grounds:

• Data: your personal data (name and surname, e-mail, telephone, date of birth)
  • Purpose for which the data is collected: 1) Registering a user in a customer management system; 2) Contacting the user and sending information to the user, including – if requested – sending newsletters and promotional messages; 3) When completing and sending a request or inquiry through one of the forms on the current site;
  • Basis for processing your personal data – By accepting the terms and conditions and purchasing a service, a contractual relationship is established between …………………….. and you, on the basis of which we process your personal data – Art. 1 (b) GDPR.
• Other data processed by …………………….. – When you log in to our website or your account, …………………….. collects data about the IP address used.
  • Purpose for which the data is collected: improving the security of the service and interface localization, statistical and marketing research.
  • Grounds for data processing: The processing is necessary for the performance of a contract to which the data subject is a party – Art. 6, para. 1 (b) of the GDPR. Until the creation of a user profile, the IP address is collected on the basis of the pursuit of the legitimate interests of the controller – Art. 6 para. 1 (f) of the GDPR;
• Your details for issuing an invoice to an individual – If you wish to be issued with an invoice as an individual, you must provide your unique identification number.
  • Purpose for which the data is collected: Issuing an invoice for making payments under a contract for the provision of services for the use of the e-commerce platform.
  • Basis for processing your personal data – By accepting the terms and conditions or by entering into a written contract, a contractual relationship is established between …………………….. and you, on the basis of which we process your personal data – Art. 1 (b) GDPR.

(3) …………………….. does not collect or process personal data relating to the following:

• reveal racial or ethnic origin;
• reveal political, religious or philosophical beliefs, or trade union membership;
• genetic and biometric data, health data or data on sex life or sexual orientation.

(4) Personal data is collected by …………………….. from the persons to whom it relates or their authorized representatives.

(5) The Company shall not carry out automated decision-making with data.

Storage period of your personal data

Art. 4. (1) …………………….. stores your personal data for a period of five years. After this period, …………………….. shall take reasonable care to erase and destroy all your data without undue delay.

(2) …………………….. retains the personal data that it is required to retain under applicable law for the relevant period provided for, which may exceed the duration of your registration.

Transfer of your personal data for processing

Art. 5. (1) …………………….. may, at its own discretion, transfer some or all of your personal data to processors for the purposes of processing, subject to the requirements of Regulation (EU) 2016/679.

(2) …………………….. notifies you if it intends to transfer some or all of your personal data to third countries or international organisations.

Your rights in the collection, processing and storage of your personal data

Withdrawal of consent to the processing of your personal data

Art. 6. (1) If you do not wish all or part of your personal data to continue to be processed by …………………….. for any or all processing purposes, you may withdraw your consent to processing at any time by completing the form in your customer profile or by making a free text request.

(2) …………………….. may ask you to verify your identity and identity with the person to whom the data relates.

(3) By withdrawing consent to the processing of personal data that is required for the creation and maintenance of your registration to use the services, any information on training received or transfers made will be unavailable.

Right of access

Art. 7. (1) You have the right to request and obtain confirmation from …………………….. as to whether personal data relating to you is being processed.

(2) You have the right to access the data relating to it, as well as the information relating to the collection, processing and storage of your personal data.

(3) …………………….. shall provide you, upon request, with a copy of the processed personal data relating to you in electronic or other appropriate form, in the event of an excessive number of requests, …………………….. reserves the right to charge an administrative fee.

Right of correction or completion

Art. 8. You may correct or complete inaccurate or incomplete personal data by sending a request to ……………………….

Right to erasure (“being forgotten”)

Art. 9.(1) You have the right to request from …………………….. the deletion of personal data relating to you, and …………………….. has the obligation to delete them without undue delay where one of the following grounds applies:

• the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• You withdraw your consent on which the processing is based and there is no other legal basis for the processing;
• You object to the processing of personal data relating to you, including for direct marketing purposes, and there are no legitimate grounds for the processing that override;
• personal data have been unlawfully processed;
• personal data must be erased in order to comply with a legal obligation under EU or Member State law that applies to ……………………..;

(2) …………………….. is not obliged to delete personal data if it stores and processes them:

• to exercise the right to freedom of expression and the right to information;
• to comply with a legal obligation requiring processing provided for in EU or Member State law to which the Controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
• for public health reasons;
• for archiving purposes in the public interest, for scientific or historical research or for statistical purposes;
• for the establishment, exercise or defence of legal claims.

(3) In order to exercise your right to be “forgotten”, you must submit a request via the option in your profile /in case you have a registration/ or a written request sent to …………………….., as well as verify your identity and identity with the person to whom the data relates before …………………….. by presenting your identification document on the spot.

(4) …………………….. does not delete data that it has a legal obligation to store, including for the purpose of defending legal claims made against it or proving its rights.

Right to restriction

Art. 10. You have the right to require …………………….. to restrict the processing of data relating to you where:

• challenge the accuracy of the personal data, for a period that allows …………………….. to verify the accuracy of the personal data;
• the processing is unlawful, but you do not wish your personal data to be erased, but only for its use to be restricted;
• …………………….. no longer needs the personal data for processing purposes, but you require it for the establishment, exercise or defence of legal claims;
• You have objected to processing pending verification that ……………………..’s legitimate grounds override your interests.

Right to portability

Art. 11. (1) You may, at any time, retrieve the data that is stored and processed about you in connection with your use of the services of …………………….. by email request.

Right to receive information

Art. 12. You may request …………………….. to inform you of any recipients to whom the personal data for which rectification, erasure or restriction of processing has been requested has been disclosed. …………………….. may refuse to provide this information if it would be impossible or involve a disproportionate effort.

Right to object

Art. 13. You may object at any time to the processing of personal data concerning you by …………………….., including if it is processed for profiling or direct marketing purposes.

Your rights in the event of a personal data breach

Art. 14. (1) If …………………….. identifies a breach of the security of your personal data that may pose a high risk to your rights and freedoms, we will notify you without undue delay of the breach and of the measures that have been taken or are to be taken.

(2) …………………….. is not required to notify you if:

• has taken appropriate technical and organisational measures to protect the data affected by the security breach;
• has subsequently taken measures to ensure that the infringement will not result in a high risk to your rights;
• notification would require a disproportionate effort.

Other provisions

Art. 15. In the event of a violation of your rights under the foregoing or applicable data protection law, you have the right to file a complaint with the Personal Data Protection Commission as follows:

1. Name: Commission for Personal Data Protection
2. Registered office and registered address. Registered office and registered office: 1592 Sofia Blvd. “1592, Proff. No. 2 Tsvetan Lazarov
3. Correspondence data. Registered office and registered office: 1592 Sofia Blvd. “1592, Proff. No. 2 Tsvetan Lazarov
4. Phone: 02 915 3 518
5. Email: kzld@government.bg, kzld@cpdp.bg
6. Website: www.cpdp.bg

Art. 16(1). Where you instruct …………………….. to process personal data of a third party for the purposes of using the service, …………………….. acts as a processor of the personal data.

(2). In the cases referred to in par. 1, …………………….. acts solely on your instruction as a user of the service and only insofar as it can have control over the personal data that you process.

Advertisement

At this time, we do not use personal data for advertising purposes, nor do we provide personal data to others (data processors) for advertising purposes.

However, by confirming your request, you agree that …………………….. has the right to use the personal data collected for the following purposes:

• Incorporating consumer evaluation and opinion into marketing research via electronic methods – e-mail or messenger.
• Incorporating consumer evaluation and opinion into marketing research via electronic methods – e-mail or messenger.
• Any other objectives related to direct marketing;
• Profiling and sending personalized advertising that is tailored to the user’s preferences. Customization is based on an evaluation of user behavior data;
• Sending personalised sales offers tailored to the user’s behaviour and relevant to their preferences by email, post or messenger. For this purpose, the user’s consumption data based on their purchasing behaviour, their participation in promotional campaigns as well as their use of the website can be subject to analysis and forecasting of the user’s interests;
• Sending non-personalised advertising. Users will also receive information about current products, services, initiatives and other advertising messages.

Where we process personal data for direct marketing purposes, the data subject shall have the right to object, free of charge and at any time, to processing, including profiling, insofar as it relates to direct marketing, whether initial or further processing.