Principles, objectives and scope of personal data processing
- ELFOR Ltd., UIC 115625440, Sofia, 1616, 12 Reznyovete Str., Contacts@elfor.bg, tel. 032/633450, processes as a controller all personal data in accordance with applicable law, namely the General Regulation on data protection (EU Regulation 2016/679), the Personal Data Protection Act (PDPA) and by-laws Personal data processed by ELFOR are not used illegally or become the property of any unauthorized third party.
- ELFOR processes personal data of its employees, contractors (when they are natural persons) and of the persons representing the contractors (when they are legal entities). The purposes of the processing of these personal data are the implementation of ELFOR's commercial activities and the fulfillment of its obligations under the tax, labor, social security and any other legislation in force in the Republic of Bulgaria.
- ELFOR processes basic personal data for identification and contact (name, pseudonym, PIN, address, e-mail, telephone number, etc.). ELFOR does not process sensitive personal data such as data on health, race or ethnicity, political views, religious beliefs, nor data on the location, traffic and content of communication of personal data subjects. ELFOR processes only the personal data necessary for the purpose of working with the subject.
- ELFOR shall provide personal data to third parties only for the purposes of the above processing purposes, and the correct, reliable and lawful use of third party data shall be guaranteed by contract, where applicable. ELFOR does not provide personal data for processing to third parties for marketing and advertising purposes.
Rules, regulations and timespan for processing personal data
- ELFOR processes personal data where there is explicit consent of the data subject, where personal data are necessary for the performance of a legal obligation by ELFOR, when processing is necessary for the performance of a contract between it and the data subject or for actions on request of the data subject before the conclusion of such a contract, as well as when there is and is applicable another legal basis for the processing of personal data.
- ELFOR stores personal data on paper and in electronic form, supporting various software applications for processing documents. ELFOR ensures the storage and processing of personal data in a secure environment. Access to the personal data of the subjects is provided only to the employees of ELFOR, who need one in order to achieve the purposes of their processing or for whom there is a legal requirement. The processing of personal data may include the collection, recording, organization, structuring, storage, adaptation or modification, retrieval, consultation, use, disclosure, transmission, dissemination or other means of accessing data, arranging or combining, restricting, deleting or destruction.
- ELFOR stores the personal data of the subjects within the time limits in accordance with the legal requirements applicable to its activity. In the absence of such requirements, ELFOR shall retain personal data for a period not exceeding 12 months from the completion of the activities for which the data were processed.
- ELFOR shall ensure and maintain appropriate technical and organizational measures to protect the personal data of data subjects against unauthorized access or unlawful use and / or against their accidental loss, alteration, disclosure, access and / or damage or copying. These measures aim to ensure the continued protection and integrity of personal data. ELFOR re-evaluates the measures regularly in order to achieve permanent security of personal data.
- In the event of a breach of personal data security, ELFOR shall notify the supervisory authority - the Commission for Personal Data Protection (CPDP) - no later than 72 hours after establishing the breach, providing the necessary information. If the breach is likely to pose a high risk to the rights and freedoms of data subjects, ELFOR shall also inform them in due course.
Personal data protection: rights for data subjects
The rights of subjects in connection with the protection of their personal data under the terms of the corresponding legislation are the following:
- Right of access
The subject has the right to receive confirmation from ELFOR whether his personal data are processed by him. This includes the right of access to personal data, the right to receive a free copy of the data (except in cases of excessive and repeated inquiries), unless otherwise provided in the applicable data protection rules, and the right of the subject to a description of the main characteristics related to the processing of his personal data shall be provided.
- Right of adjustment
Every person or entity has the right to correct or request ELFOR to correct without
unnecessary delay, inaccurate, incomplete or outdated personal data.
- Right to be erased (right to be forgotten)
The subject has the right to request ELFOR to delete the relevant and all corresponding personal data without undue delay, where any of the following grounds are applicable:
- the entity objects to the processing, as set out below;
- the personal data of the subject have been processed illegally; or
- the personal data of the subject must be deleted in order to comply with a legal obligation under EU law, the law of a Member State or the law of another country.
ELFOR may refuse to delete the personal data of the subject if their processing is necessary in the following cases:
- to exercise the right to freedom of expression and the right to information;
- to comply with a legal obligation requiring processing or to carry out a task in the public interest; and / or
- for reasons of public interest in the field of public health, for the purposes of scientific or historical research, or for statistical purposes; and / or
- to establish, exercise or defend legal claims.
- Right to limit processing
The subject has the right to request ELFOR to restrict the processing of his personal data in the following cases:
- when challenging the accuracy of personal data as provided by the subject and processed by ELFOR (the restriction is for a certain period of time, which allows ELFOR to verify the accuracy of personal data);
- when the processing is unlawful, but the subject does not want the personal data to be deleted, but instead requests to limit their use;
- when ELFOR no longer needs personal data for the purposes of processing, but the subject requires them to establish, exercise or defend legal claims;
- when the subject has objected to the processing and expects ELFOR to verify whether ELFOR's legal grounds for processing personal data take precedence over the subject's interests.
Where the processing of personal data of the subject is restricted by ELFOR, it will inform the subject in advance, as well as before this processing restriction lifted.
- Right to object
The subject has the right to object at any time on grounds related to his specific situation against the processing of personal data concerning him.
The subject may exercise the right only in respect of the processing of his personal data, which is carried out by ELFOR for the purposes of his legitimate interests.
If the objection is justified, ELFOR will terminate the processing of personal data concerning the objected entity, unless ELFOR demonstrates that there are compelling legal grounds for the processing that take precedence over the interests of the subject.
- Right to data portability
This right includes the following options:
- obtain personal data in a structured, widely used and machine-readable format for transfer to another controller, or
- to obtain a direct transfer of personal data to another controller, if technically feasible.
Given the legal basis on which ELFOR processes personal data, the application of this right to the subject is limited.
- Right of appeal
The subject has the right to file a complaint regarding the processing of his / her personal data from ELFOR to the Commission for Personal Data Protection (CPDP), which is the competent state body.
The subject may proceed to exercise his rights by written communication to ELFOR. The subject may at any time object to the processing by ELFOR of personal data concerning him, in writing.
ELFOR's personal data protection policy has been in force since 25.05.2018. In the event of a change in any of its aspects, ELFOR will update it in a timely manner, providing access to it to personal data subjects and all other stakeholders.