Privacy Notice and Personal Data Protection

PRIVACY NOTICE AND PROTECTION OF PERSONAL DATA PROCESSED BY EUROBUILD LTD.

 

I. INTRODUCTION:

In relation to the principles for awareness of the data subjects, lawfulness, fairness and transparency of the processing of personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, also referred to as Regulation (EU) 2016/679/the Regulation/GDPR) and the Personal Data Protection Act (PDPA) we present to your attention this notice.     

Please, read the Notice carefully and in case of having any questions about its contents, please contact us at the address and contact details specified below.

II. DEFINITIONS, USED FOR THE PURPOSES OF THE PRESENT NOTICE:

         - ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

         - ‘special categories of personal data’ are personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation; 

         - ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

         - ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

         - ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

         - ‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;

         - ‘third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;

         - ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

         - ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

III. INFORMATION FOR IDENTIFICATION OF EUROBUILD LTD. IN ITS CAPACITY OF PERSONAL DATA CONTROLLER:

Name: EUROBUILD LTD. (also referred to as ‘the Controller’);

UIC: 102851367

Seat and registered address: Fl.7, 1 Stara Planina St, Bratya Miladinovi residential complex, 8000 Burgas

Contact details:

Address: Fl.7, 1 Stara Planina St, Bratya Miladinovi residential complex, 8000 Burgas

Telephone: +359 56 803-120

Fax: +359 56 803-121

E-mail: office@eurobuild.bg

Contact person: Tenko Yanev

 

IV. INFORMATION ABOUT THE COMPETENT SUPERVISORY AUTHORITY:

Name: Commission for Personal data Protection (CPDP);

Contact details:

Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592 

Telephone: +359 2 91-53-519

Fax: +359 2 91-53-525

E-mail: kzld@cpdp.bg

V. CATEGORIES OF PERSONAL DATA WHICH WE COLLECT, THE PURPOSES FOR WHICH WE PROCESS THEM AND THE LEGAL GROUND FOR THEIR PROCESSING:

 

1. Personal data of natural persons, collected directly from them for the purposes of conclusion of labour contracts, the maintenance of labour records of the personnel and the payment of labour remunerations and compensations:

 

1.1. Personal identity and contact information:

• Personal data as per identity document (three names, Personal Identity Number (Personal Number of Foreigner), number and date of issuance of identity document, address), electronic address and telephone for contact – they are processed on the ground of compliance with a legal obligation on the part of EUROBUILD Ltd. under the power of labour and insurance law.

 

1.2. Social identity:

• Data regarding the education and/or the qualification (document for acquired education, speciality; document for acquired professional qualification or legal capacity, etc.) – the data are required for the purposes of compliance with normative or established with schedule of positions requirements for occupying, respectively for discharge from particular positions and are processed on the ground of legal obligation in all cases where necessary.
• Professional experience (professional biography, documents attesting length of service) – the data are of importance in the choosing of suitable person for the respective position and are processed on the ground of legal obligation in all cases where necessary.
• Data regarding the marital status of the person (presence of marriage, number of family members, including children under the age of 18), necessary in the establishing the rights of the individuals for receiving of family allowance and paid leave for children up to 18 years of age, leave for performance of civil, public and other obligation, and for charging deductions from the labour remuneration (if applicable) – they are processed on the ground of legal obligation of the Controller.

1.3. Data regarding the state of health of the natural person:

• Data from a medical certificate (card) for performed mandatory preliminary medical examination in the conclusion of labour contracts (they are required also in case that the individual to whom they refer is in interrupted employment relations with EUROBUILD Ltd. for period longer than 3 months). The data are collected and processed on the ground of performance of obligations under the power of labour law and the law in the field of social security and social protection or on the ground of the legitimate interest of EUROBUILD Ltd. for the purpose of establishment, exercise or defence of legal claims.  
• Data from expert decision of Labour Expert Medical Commission (if available) – the data are processed on the ground of legal obligation (for possible use of tax concession by individuals with 50 and over 50 per cent disablement, as well as in labour readjustment of worker or employee and also in relation with exercising the right to use increased amount of paid annual leave).
• Data from a patient's chart for temporary incapacity for work because of general illness or maternity – the data are processed on the ground of legal obligation.
• Data from performed periodic medical examination – the data are processed on the ground of performance of obligations under the power of labour law and the law in the field of social security and social protection.

1.4. Personal data regarding the conviction of the natural persons:

• Data from a certificate of conviction – they are processed on the ground of legal obligation (whenever it is legally required verification of judicial history with regard to occupying of specific position), and in any other cases they are required in relation with the protection of the legitimate interest of the employer in the conclusion of labour contracts.

1.5. Data regarding number of personal bank account and the account’s issuing bank:

• Data on personal bank account – they are processed in relation to non-cash payment of labour remuneration and compensations to the employee/worker on the ground of the legitimate interests of EUROBUILD Ltd. in relation to administration the financial activity of the company.

 

2. Personal data of natural persons, collected directly from them for the purposes of participation in personnel selection procedure:

2.1. Personal identity and contact information:

• Personal data as per identity document (three names, date of birth, address), electronic address, telephone for contact – the data are processed on the ground of the consent of the data subject.

2.2. Social identity:

• Data for the education and/or qualification (data from document for acquired education, speciality; data from document for acquired professional qualification and/or legal capacity); professional experience (professional biography) – they are processed on the ground of consent of the data subject.

 

3. Personal data of natural persons, collected directly from them or from public registers in providing or using of goods and or/services, conclusion of contracts and execution of contracts:

3.1. Data of counterparties – natural persons:

• Personal identity: three names and address – the data are collected directly form the natural persons subjects of these data and are processed on the ground of legal obligation in issuance of invoices for goods or services for the sale or provision of which has no written contract concluded..
• Personal identity and contact information: personal data as per identity document (three names, Personal Identity Number (Personal Number of Foreigner), number and date of issuance of identity document, address), electronic address, and telephone for contact – the data are collected directly from the natural persons to whom they refer in relation to conclusion and execution of contract.
• Number of personal bank account and account’s issuing bank: the data are collected directly from the natural persons in relation to conclusion and execution of contract.

3.2. Personal data of natural persons – representing or part of the personnel of counterparties (legal entities, unincorporated companies, sole traders):

• Personal identity: three names and position of the person representing the legal entity, the unincorporated company under the Obligations and Contracts Act or the sole trader, party to a contract with EUROBUILD Ltd.) – the data are collected directly from the natural persons or from public registers and are processed for the purpose of identification of the person representing the company according to the Trade Act, and in conclusion of contract in notarial form – also the Personal Identity Number of the persons representing the legal entities, unincorporated companies or sole traders and/or their proxies in accordance with the requirements of the regulatory framework.
• Personal identity: three names and position of natural persons – part of the personnel of the counterparty or individuals hired by it which participate in the execution of the contract concluded between the counterparty and EUROBUILD Ltd. for the purpose of identification of these persons – the data are collected from the counterparty in relation to the conclusion and the execution of a contract.

4. Personal data collected automatically by the Access and Working Time Control System or directly form the natural persons for the purposes of protection of property, ensuring of physical security and information security and control of working time of the personnel of EUROBUILD Ltd.:

 

4.1. Personal data of company’s personnel or personnel of leaseholders:

• Personal identity and others: name and last name, organization and date and time of provided automatic access for entrance/exit through RFID cards to zones with access control (for Administrative building of EUROBUILD Ltd. in the town of Burgas, located in 1 Stara Planina St.) – the data are recorded automatically in an access and working time control system for the purposes of ensuring of physical and information security on the ground of legitimate interest of the Controller.
• Personal identity and others: name and last name, organization and date and time of provided automatic access for entrance/exit through RFID cards to zones with access control (for Administrative building of EUROBUILD Ltd. in the town of Burgas, located in 1 Stara Planina St.) – the data are recorded automatically in an access and working time control system for the purposes of the working time control for personnel of the company for the management purposes (the observance of the working time established in the Interior Labour Regulations) on the ground of performance of a contractual obligation.  

4.2. Personal data of visitors in the offices of EUROBUILD Ltd. in the town of Burgas and in the Production and Technical Centre in the village of Ravadinovo, Sozopol Municipality:

• Personal identity and others: name and last name, organization and date and time of provided access – the data are collected directly from the data subjects for the purposes of protection of property and ensuring of physical and information security on the ground of legitimate interest of the Controller.

5. Personal data of natural persons, collected directly from the systems for video surveillance of the motion to the approaches of the buildings of EUROBUILD Ltd. and the premises/zones with a definite statute in and around the respective buildings:

• Data from video surveillance (video image) are processed with security purpose (ensuring of security of employees and visitors (including personnel of leaseholders) and protection of property; ensuring of information security) on the ground of legitimate interest of the company with regard to establishment, exercise or defence of legal claims.

6. Personal data, collected directly from the natural persons in receipt, consideration and reply to requests from natural persons for exercising their rights as data subjects:

• Personal identity: three names of the person and other data which identifies them (as Personal Identity Number, Personal Number of Foreigner, manual or electronic signature, correspondence address. In submitting of request by representative – a Power of Attorney or other document verifying the legal right of access to/receipt of information. The data are collected for verifying the identity of the person – data subject and contact with them with regard to adherence to a legal obligation to which the controller is subject.

 

7. Personal data of natural persons – representatives of third party suppliers or users which have access to information of means for processing of information in the absence of concluded contract with explicit confidentiality clauses or concluded express confidentiality agreement, collected directly from the individuals in relation to regulation of the roles and the responsibilities regarding the information security:

• The Declaration by Third Party for Confidentiality, Non-distribution of Information and Personal Data Protection, as well as the personal data of the individual (names, position, company/organization, in what capacity the person is acting, signature) are processed for the purposes of the legitimate interest of EUROBUILD Ltd., namely ensuring of information security, establishment, exercise or defence of legal claims in occurrence of breach of the company’s information security.

8. Personal data of natural persons, collected directly from them in submission of report for personal data breach or from the Controller, other persons or organizations in management of such breach:

• Data of the person submitting a report for breach or notification/signal for irregularity: three names, position (if applicable), organization (if applicable), UIC (Unified Identification Code) / BULSTAT / Personal Identification Number (whichever is applicable), contact telephone, electronic address – the data are collected directly from the data subjects for the purposes of the registration, the investigation and the documentation of personal data breaches on the ground of legitimate interests of the Controller.
• Data of affected natural persons: according to the specifics of the breach – the data are collected from the sources applicable for the case and are processed for the purposes of the registration, the investigation and the documentation of personal data breaches on the ground of legitimate interest of the Controller.

9. When the company intends to process the personal data for purpose other than that for which they were collected/received, EUROBUILD Ltd. informs the respective data subject about this. In this case the Controller provides the data subject prior to that further processing with information on that other purpose and with any relevant further information.

10. EUROBUILD Ltd. does not collect data of data subjects – persons below the age of 14 years without a consent given by the parent exercising the parental rights or by the guardian of the data subject or without other legal ground for this.

11. EUROBUILD Ltd. does not collect and process personal data for the direct marketing purposes.

 

12. Personal data (as names, address, electronic address, telephone number) which are submitted by natural persons in the process of correspondence/contact with EUROBUILD Ltd. (via email, by post, on the telephone or through the direct contact form at the company’s website https://www.eurobuild.bg) may be collected and processed by the Controller on the ground of consent on the part of the data subjects given through a clear affirmative action for the purpose for which they were submitted.

13. The personal data is collected on paper, as well as electronically (including from generally accessible electronic platforms) and are processed and stored on paper or electronically in strict compliance of procedures for processing of documents in accordance with the Integrated Management System of EUROBUILD Ltd., the information security policies, as well as the personal data protection policies and procedures of the company.

14. EUROBUILD Ltd. undertakes measures the personal data which it processes to be adequate, relevant and limited to what is necessary for achieving the purpose for which they are processed, as the periods for which the personal data will be stored to be limited to a strict minimum. The company undertakes technical and organizational measures ensuring the adherence to Regulation (EU) 2016/679 and Personal Data Protection Act related to the securing of continuous confidentiality, integrity, availability and stability of the information (including personal data) and of the systems and services for processing of data, as well as ensuring of the work continuity in case of emergency situations as part of the integrated in the company Information Security Management System in accordance with the international standard ISO/IEC 27001:2013. The personal data are treated as confidential and are processed in a way which guarantees the appropriate level of security of these data, including protection against unauthorized or unlawful processing, accidental loss, destruction or damage, alteration or dissemination and unlawful access to personal data.

VI. RECIPIENTS TO WHOM THE PERSONAL DATA MIGHT BE TRANSFERRED/DISCLOSED:

1. Personal data, collected and processed by EUROBUILD Ltd. might be transferred/disclosed to the natural persons to whom they refer (the subjects of the respective personal data).

2. Data, collected and processed by EUROBUILD Ltd. for the activities for conclusion of labour contracts, maintenance of labour records of the personnel and payment of labour remunerations and compensations, might be transferred/disclosed to other processors in strictly defined cases, as: the respective state authorities in execution of statutory obligations (National Revenue Agency, National Social Security Institute, Executive Agency General Labour Inspectorate, etc.); bank institutions with purpose non-cash payment of labour remuneration and others; labour medicine service for execution of contractual obligations for ensuring of occupational health and safety; the insurer in relation with the compulsory insurance of the workers and employees for the risk ‘employment accident’; companies carrying out a technical maintenance of the information systems of EUROBUILD Ltd., including of the specialized software (in rare occasions when it is not possible the maintenance to be carried out in other way and in strict control on the part of the Controller); the competent body on the ground of legitimate interest of the company for the purpose of establishment, exercise or defence of legal claims; lawyers and/or law firms which consult EUROBUILD Ltd. on labour law matters; Contracting entities of public procurement under the Public Procurement Act (PPA) in accordance with the provisions of the Rules for its implementation (Rules on the Implementation of the Public Procurement Act, RIPPA); operators licensed for performing the services under Art.39 of the Postal Services Act.
3. Data, collected and processed by EUROBUILD Ltd. for the activities for selection of personnel, might be transferred/disclosed in particular cases to: the competent body on the ground of legitimate interest of the company for the purpose of establishment, exercise or defence of legal claims; lawyers and/or law firms which consult EUROBUILD Ltd. on labour law matters.

4. Data, collected and processed by EUROBUILD Ltd. For the activities for providing or using of goods and or/services, conclusion of contracts and execution of contracts, might be transferred/disclosed in particular cases to: state authorities under a written order in execution of statutory obligations (National Revenue Agency, National Social Security Institute, Police, etc.); the competent body on the ground of legitimate interest of the company for the purpose of establishment, exercise or defence of legal claims; lawyers and/or law firms which consult EUROBUILD Ltd. on labour law matters; operators licensed for performing the services under Art.39 of the Postal Services Act.
5. Data, collected and processed by EUROBUILD Ltd. for the activities for access control, working time control, protection (security), might be transferred/disclosed in particular cases to: the competent body on the ground of legitimate interest of the company for the purpose of establishment, exercise or defence of legal claims; lawyers and/or law firms which consult EUROBUILD Ltd. on civil law matters.

 

6. Data, collected and processed by EUROBUILD Ltd. for the activities for video surveillance, might be transferred/disclosed in particular cases to: state authorities (investigators, prosecutor's office, police, etc.) under a written or oral order in execution of statutory obligations; the competent body on the ground of legitimate interest of the company for the purpose of establishment, exercise or defence of legal claims; lawyers and/or law firms which consult EUROBUILD Ltd. on civil law matters.

 

7. Data, collected and processed by EUROBUILD ltd. for the activities for receipt, consideration and reply to requests from natural persons for exercising their rights as data subjects, might be transferred/disclosed in particular cases to: state authorities in execution of statutory obligations (CPDP, etc.); the competent body on the ground of legitimate interest of the company for the purpose of establishment, exercise or defence of legal claims; lawyers and/or law firms which consult EUROBUILD Ltd. on civil law matters; operators licensed for performing the services under Art.39 of the Postal Services Act.

8. Data, collected and processed by EUROBUILD Ltd. for the activities for regulation of the roles and the responsibilities of third parties regarding the information security, might be transferred/disclosed in particular cases to: the competent body on the ground of legitimate interest of the company for the purpose of establishment, exercise or defence of legal claims; lawyers and/or law firms which consult EUROBUILD Ltd. on civil law (including commerce) matters.

9. Data, collected and processed by EUROBUILD Ltd. for the activities for management of the personal data breaches, might be transferred/disclosed in particular cases to: the competent body on the ground of legitimate interest of the company for the purpose of establishment, exercise or defence of legal claims; lawyers and/or law firms which consult EUROBUILD Ltd. on civil law (including commerce) matters.

 

10. The personal data which EUROBUILD Ltd. transfers/discloses in the cases described above are reduced to the absolute necessary minimum for achieving the particular purpose.

11. EUROBUILD Ltd. does not transfer personal data to a third countries (countries outside the European Union), as well as to international organisations.

 

VII. PERIODS FOR WHICH WE STORE PERSONAL DATA:

 

1. For data, collected and processed by EUROBUILD Ltd. for the activities for conclusion of labour contracts, maintenance of labour records of the personnel and payment of labour remunerations and compensations:

• The data regarding the personal identity, contact information, social identity, conviction, state of health and the number of personal bank account and the account’s issuing bank are stored during the entire period of continuation of labour relationships.  
• The payroll ledgers, as well as the salary slips and other documents certifying the accrual and the payment of labour remunerations are stored for a period of 50 /fifty/ years.
• The nominal schedules for working time are stored for a period of 3 /three/ years after expiration of the period for which is established the summed calculation of the working time.
• The employment books, logs and exemplars of issued certificates (Form UP-2 Certificate for assurance income, Form UP-3 Certificate for assurance (employment) length of service) which are unreceived by the workers or the employees are stored for a period of 50 /fifty/ years.  

2. For personal data of applicants for work whit whom is not concluded a labour contract in result of conducting of a personnel selection procedure for particular position: the data are stored up to 6 /six/ months after the end of the procedure.

 

3. For personal data, collected and processed by EUROBUILD Ltd. for the activities for providing or using of goods and or/services, conclusion of contracts and execution of contracts:

• Financial-accounting documents – 11 /eleven/ years since their issuance.
• Concluded contracts and agreements for construction and installation works (CIW) – during the entire period of execution of the obligations under the contract/agreement (including warranty maintenance) or until expiration of the term of the contract whichever occurs later.   
• All other concluded contracts and agreements – 5 /five/ years after execution of the obligations under the contract or until expiration of the term of the contract whichever occurs later.
• Data related to participations on tender procedures, carried out under the provisions of the Public Procurement Act (PPA) – up to 6 /six/ months after conclusion of the tender procedure if the participation had not led to conclusion of contract for execution of the procurement and during the entire period of execution of the obligations under the contract/agreement (including warranty maintenance) or until expiration of the term of the contract whichever occurs later in case that the procurement is assigned to EUROBUILD Ltd. or a Partnership under the Obligations and Contracts Act (OCA) in which EUROBUILD Ltd. is a partner.  

4. For data, collected and processed by EUROBUILD Ltd. for the activities for access control, working time control, protection (security): the data are stored for a period of the maximum 5 /five/ years from the making of the recording.

5. For data, collected and processed by EUROBUILD Ltd. for the activities for video surveillance: the data are stored for a period of 14 /fourteen/ days from the capture of the video image.

6. For data, collected and processed by EUROBUILD Ltd. for the activities for receipt, consideration and reply to requests from natural persons for exercising their rights as data subjects: the data are stored in a period of 3 /three/ years from the date of submission of the request.

7. For data, collected and processed by EUROBUILD Ltd. for the activities for regulation of the roles and the responsibilities of third parties regarding the information security: the Declarations by Third Party for Confidentiality, Non-distribution of Information and Personal Data Protection and respectively the personal data of the natural person filled in in them are stored for a period up to 5 /five/ years after termination of the relationships between the Controller and the data subject.   

8.   For data, collected and processed by EUROBUILD Ltd. for the activities for management of the personal data breaches: the data are stored for a period of 3 /three/ years from the date of notification to the supervisory authority and, if applicable, from the date of communication to the data subject regarding personal data breach, and in case of non-submission of notification(s) – 3 /three/ years from the date of the report for the breach or otherwise received notification/signal for irregularity.

9. After expiry of the period for storage and after the purpose for which the personal data are collected, processed and stored by EUROBUILD Ltd. is achieved, the data are destructed in the proper manner (through erasure or physical destruction for which actions protocols for destruction are duly prepared).

10. Exceptions:

The periods for storage of personal data might be extended in the following cases:  

• There is a not finished investigation of crimes or offences on the part of the investigating authorities (police, prosecutor’s office, supervisory authority, responsible for providing and applying of the rules for personal data protection or another authority) of Republic of Bulgaria or of the Member States of European Union (the Union) and the processing of the personal data is necessary in order the execution of the statutory obligations by EUROBUILD Ltd. to be proven, in which case the company duly notifies the investigation authority for the extension of the period for storage of the data;
• The processing is necessary for exercising the legal rights of EUROBUILD Ltd. in conducting lawsuits and defence of/from legal claims.  

VIII. RIGHTS WHICH THE DATA SUBJECTS MAY EXERCISE:

 

1. The data subject has the right to obtain from EUROBUILD Ltd. confirmation as to whether the company processes his or hers personal data, and, and where that is the case, to obtain access to the personal data.

 

2. The data subject has the right to obtain from EUROBUILD Ltd. a copy of his or hers personal data which are undergoing processing.

 

3. The data subject has the right to request from EUROBUILD Ltd. to rectify without undue delay inaccurate or incomplete personal data concerning him or her.

 

4. The data subject has the right to request from EUROBUILD Ltd. erasure of personal data concerning him or her without undue delay and EUROBUILD Ltd. shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• the data subject withdraws his or hers consent (including explicit consent given by the data subject to when special categories of his or hers personal data are being processed), and where this is the sole ground for the processing of his or hers personal data and there is no other legal ground for the processing;
• the data subject objects to the processing and there are no legal grounds for the processing which override;
• the personal data have been unlawfully processed;
• the personal data should be erased for the purposes of observing of legal obligation under the law of the European Union or the law of Republic of Bulgaria;
• the personal data have been collected in relation to the offer of information society services.

 

5. The data subject has the right to request from EUROBUILD Ltd. restriction of processing where one of the following hypotheses applies:

• the accuracy of the personal data is contested by the data subject, for a period enabling EUROBUILD Ltd. to verify the accuracy of the personal data;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• EUROBUILD Ltd. no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
• the data subject has objected to processing pending the verification whether the legitimate grounds of EUROBUILD ltd. override his or hers interests.

 

6. In relation with the obligation for notification in case of rectification or erasure of personal data or restriction of processing EUROBUILD Ltd. communicates any carried out rectification, erasure or restriction of personal data processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. EUROBUILD Ltd. shall inform the data subject about those recipients if the data subject requests it.

 

7. The data subject has the right to receive the personal data concerning him or her, which he or she has provided to EUROBUILD Ltd., in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from EUROBUILD Ltd. to which the personal data have been provided, where the following conditions are simultaneously present:

• the processing is based on consent given beforehand by the data subject or on a contractual obligation to which contract the data subject is a party;
• the personal data are concerning the data subject and are being submitted by him or her;
• the processing is carried out in automated manner (by automated means, but not processing on paper medium);
• the exercising of the right to data portability does not adversely affect the rights and freedoms of third parties (other data subjects) whose personal data are contained in the data for which the data subject exercises his or hers rights (considering that these other data subjects have not given their consent to personal data concerning them to be transmitted to the data subject which exercises his or hers rights or to another data controller).

When exercising the above right to data portability the data subject shall have the right to have the personal data transmitted directly from EUROBUILD Ltd. to another controller, where technically feasible.

 

The data subjects should bear in mind that not all of their personal data which EUROBUILD Ltd. processes may be provided to them or to another personal data controller in a structured, commonly used and machine-readable format.

 

8. The data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on legitimate interests pursued by the controller or by a third party. EUROBUILD Ltd. shall no longer process the personal data unless it demonstrates that there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

9. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, as this provision of the Regulation shall not apply if the decision:

• is necessary for entering into, or performance of, a contract between the data subject and EUROBUILD Ltd.;
• is authorised by European Union or Republic of Bulgaria law and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or
• is based on the data subject's explicit consent.

 

In the cases referred to in the first and the third suggestions above, the Data Controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of EUROBUILD Ltd., to express his or her point of view and to contest the decision.

 

10. In case of breach of the personal data which the Controller is processing where the breach is likely to result in a high risk to the rights and freedoms of natural persons, EUROBUILD Ltd. shall communicate the personal data breach to the concerned natural persons without undue delay.

 

11. The above obligations and rights are not absolute. By way of legislative measure in the European Union or Republic of Bulgaria law may be enforced restrictions in the scope of these obligations and rights for the purpose of safeguarding:

• national security;
• defence;
• public security;
• the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;
• other important objectives of general public interest of the Union or of Republic of Bulgaria, in particular an important economic or financial interest of the Union or of Republic of Bulgaria, including monetary, budgetary and taxation a matters, public health and social security;
• the protection of judicial independence and judicial proceedings;
• the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;
• a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in suggestions from first to fifth and the seventh one above;
• the protection of the data subject or the rights and freedoms of other persons;
• the enforcement of civil law claims.

The data subjects have the right to be informed for the restriction, unless that may be prejudicial to the purpose of the restriction in accordance with the specific legislative measure.  

 

12. The data subject has right to lodge a complaint with the Commission for Personal data Protection if he or she considers that the processing by EUROBUILD Ltd. of personal data concerning him or her infringes the provisions of the Regulation.

 

13. The data subject has the right of effective judicial remedy against the Controller when he or she considers that his or hers rights under GDPR have been infringed in result of processing of his or hers personal data which is not compliant with the Regulation.  

 

14. The receipt, consideration and reply to requests from natural persons for exercising their rights as data subjects is carried out in accordance with the approved procedures in EUROBUILD Ltd.

 

14.1. The natural persons whose personal data are collected and processed by EUROBUILD Ltd. exercise their rights as data subjects by submitting of written request in approved form (OD PRZLD 12-01 Request from Data Subject), including electronically, in person or by authorized representative. Notwithstanding, EUROBUILD Ltd. receives also requests by data subjects which are submitted in other form (as letters in free form containing the necessary requisites and sent by the conventional post or electronic mail). The submission of the request is free of charge. For confirmation of the identity of the person who submits the request there may be required the provision of identity document or authentication of the electronic document with electronic signature. In case that EUROBUILD Ltd. has valid concerns in relation with the identity of the natural person submitting a request, the Controller may require provision of additional information necessary for confirmation of the identity of the data subject. The required additional information serves for confirmation of the identity of particular person and does not exceed the necessary for achieving the objective.

 

14.2. The request should contain: information about the data subject (obligatory: three names and other data that identify the person (as Personal Identity Number, Personal Number of Foreigner, contact information (correspondence address, telephone number, electronic address), and by decision of the person other data that may identify him or her); in case of submission of the request by a representative (authorized person, parent, guardian or other) – information about representative of data subject (obligatory: three names, date of birth, contact information (correspondence address, telephone number, electronic address), information about the representation, description and provision of Power of Attorney or other document certifying the right of access to or/and obtaining of the respective information); information about the request (type of the request and description  of the request and the data it refers to); preferred form for obtaining of information under the request; preferred form for provision of access to personal data in case that the request is for access to personal data; declaration for the truth of the provided data; date; signature (manual or electronic).         

 

14.3. When the right of access to the data of the person is exercised, the access is provided in the form preferred by him or her, such as: oral information (provided that the identity of the data subject is proven by other means); written information; review by the person himself or herself or by his or hers representative; or provision of copy of the requested information.      

14.4. The period for consideration of the Request and pronouncement on it on the part of EUROBUILD Ltd. is 30 /thirty/ days and begins from the day of receipt of the request on the part of the Controller. Where necessary the period for pronouncement may be extended by two further months, taking into account the complexity and number of the requests submitted by data subjects or possible difficulties arisen in the Controller’s activity. In such case the company shall inform the data subject of any such extension within one month of receipt of the Request, also indicating the reasons for the delay.  

            The information on actions taken or the response of the Controller are communicated in writing with the person who submitted a request in person or by post with return receipt, unless the person has specified other method for receipt of information under the Request and this method does not breaks the security of transmission. Where the data subject makes the request by electronic form means, the information will be provided by electronic means where possible, unless otherwise requested by the data subject.

             When the Request cannot be fulfilled on the basis of specific legal ground, the person submitted the request is refused in writing with motivated decision about the reasons for actions not being taken within period up to 30 /thirty/ days of receipt of the Request. The refusal may be appealed by the person before the Commission for Personal data Protection (CPDP) or before the court under the provisions Administrative Procedure Code. 

            Any communication and all actions related to requests of natural persons for exercising their rights as data subjects are provided free of charge to the persons who made a request. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, EUROBUILD Ltd. may either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request. 

IX. OBLIGATORY AND/OR VOLUNTARY CHARACTER OF PROVISION OF PERSONAL DATA:

1. The personal data which are collected for the purposes of the conclusion of labour contracts, the maintenance of labour records, the payment of labour remunerations and compensations, the providing or the using of goods and or/services, the conclusion and the execution of commercial contracts are processed by EUROBUILD Ltd. in execution of its statutory obligations, as well as for the purposes of execution of a contract to which the data subject is a party or is representing the respective party, or for taking steps at request by the data subject prior the conclusion of contract. The failure to provide these data on the part of the natural person would result in impossibility for execution of these obligations on the part of EUROBUILD Ltd., as well as in impossibility for entering into contractual or commercial relations with the data subject or the represented by the data subject legal entity, unincorporated company or sole trader.
2. The personal data which are collected from the natural persons for the purposes of applying for particular position in personnel selection procedure are processed on the ground of consent given by the data subjects. The failure to provide the minimum required data for identification of the person (names), type and degree of education, professional qualification and professional biography will result in impossibility EUROBUILD Ltd. to assess whether a certain candidate meets the required criteria for occupying of particular position and respectively the company will not proceed towards conclusion of labour contract with the applicant.

3. The personal data of natural persons – part of the personnel of contracting party or persons hired by it which participate in the execution of a contract concluded between the contracting party and EUROBUILD Ltd. for the purpose of identification of these persons, are processed by EUROBUILD Ltd. on the ground of execution of the said contract and the failure to provide the respective data may result in impossibility on behalf of the contracting party to execute its obligations to EUROBUILD Ltd. under the respective contract.

4. The personal data, processed for the purposes of the access control and the protection, are collected on the ground of legitimate interest of EUROBUILD Ltd. and assist in the protection of property, ensuring of physical security of the personnel and the personnel of leaseholders, as well as of information security of the company.

5. The personal data, processed for the purposes of the working time control are collected on the ground of execution of contractual obligation and assist the monitoring of the personnel for the management purposes (the observance of the working time established in the Rules for Internal Work Order).

6. The personal data, collected by the video surveillance system, are processed by EUROBUILD Ltd. on the ground of legitimate interest of the company with security purpose (ensuring of security of employees and visitors (including personnel of leaseholders), protection of property and ensuring of information security) with regard to establishment, exercise or defence of legal claims.

7. The personal data, processed in receipt, consideration and reply to requests from natural persons for exercising their rights as data subjects, are collected with regard to observance of the provisions of GDPR and the failure their provision may result in refusal or impossibility for providing reply/information on the part of EUROBUILD Ltd.

8. The personal data from Declarations by Third Party for Confidentiality, Non-distribution of Information and Personal Data Protection and the personal data of the individuals, are collected and processed for the purposes of ensuring of information security (including network) and establishment, exercise or defence of legal claims in case of breach of information security on the ground of the legitimate interest of EUROBUILD Ltd.

9. The personal data, collected in the process of personal data breach management, are processed for the purposes of the registration, the investigation and the documentation of the breaches on the ground of legitimate interests of the Controller.

11. EUROBUILD Ltd. guarantees that the personal data which it collects and processes are the minimum required and necessary for achieving the determined purposes and they have not for purpose the invasion in the personal space of the natural persons – data subjects and the breach of the inviolability of their personal life or other their rights and freedoms.

X. RESPONSIBILITY OF THE DATA SUBJECTS OR PERSONS/ORGANIZATIONS SUBMITTING PERSONAL DATA OF OTHER NATURAL PERSONS – DATA SUBJECTS:

Responsibility of the data subjects is to ensure the accuracy, the completeness and the actuality of those of their own personal data which they submit to EUROBUILD Ltd.

Responsibility of the persons or the organizations, which submit to EUROBUILD Ltd. personal data of other natural persons – data subjects, is to collect these data in accordance with applicable legal requirements, to inform the persons whose personal data are submitted for the contents of this Notice and to secure the lawfulness of the processing of this data.

XI. INFORMATION REGARDING PERFORMANCE OF AUTOMATED DECISION-MAKING, INCLUDING PROFILING AND FOR THE CONSEQUENCES OF SUCH PROCESSING FOR THE DATA SUBJECTS:

The collecting and the processing of personal data by EUROBUILD Ltd. have not for purpose and do not lead to decisions based solely on automated processing, including profiling, which produce legal effects concerning the data subject.  

XII. CHANGES IN THE PRIVACY NOTICE AND PROTECTION OF PERSONAL DATA PROCESSED BY EUROBUILD LTD.:

The present Notice substitutes the Privacy Notice and Protection of Personal Data Processed by EUROBUILD Ltd. current as of 16.08.2021 and is current as of 14.08.2023.  

EUROBUILD Ltd. has the right to amend and supplement the present Privacy Notice and Protection of Personal Data at any time when required by the circumstances with purpose to address amendments in the applicable legislation or to reflect amendments in relation with the activities for collecting, processing and storage of personal data on the part of the company.