Contact us

Notice regarding the processing of personal data

In the course of its activities, “SLAVLEN” AD, a company registered in the Commercial Register under UIC 831643461 (the “Company”), interacts with various parties – natural persons and legal entities. Natural persons act on their own behalf, while legal entities act through their legal representatives, employees or other persons who are authorised to represent them and/or bind them through their actions and declarations of intent.

This notice explains how the Company processes personal information which identifies or can be used to identify a natural person (“Personal Data”), when such person acts on its own behalf or as representing/acting on behalf of a legal entity with which “SLAVLEN” AD has or maintains relations.

1. Who processes the Personal Data?

The data controller is:

“SLAVLEN” AD, UIC 831643461, registered seat and address of management: 1172 Sofia, 126 “Tintyava” Street, office No. 4.1, website: www.slavlen.eu

“SLAVLEN” AD processes Personal Data as a controller within the meaning of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), whereby it independently determines the purposes and means of the processing.

2. Which persons’ Personal Data do we process?

For the conclusion, performance and administration of transactions – most often bilateral contracts – the Company processes Personal Data of at least one of the following persons:

  • legal representatives of the counterparty;
  • attorneys / authorised representatives of the counterparty;
  • contact persons of the counterparty expressly designated as such in a contract or in correspondence from the counterparty;
  • employees or other persons whose professional functions are related to the performance of the contract;
  • counterparties – natural persons.

Personal Data may also be processed in relation to other natural persons, insofar as this is necessary in connection with specific contractual, pre-contractual, commercial or legal relations.

3. What Personal Data do we process?

In connection with the conclusion and performance of contracts, the Company generally processes the following categories of Personal Data:

  • identification data – names, Unified Civil Number (EGN) or other identifier, position/role held;
  • contact details – business or correspondence address, business or mobile telephone number, e-mail address.

The specific scope of Personal Data depends on the capacity of the natural person (representative, employee, counterparty – natural person) and their functions under the contract.

For the purposes of entering into legally binding agreements, “SLAVLEN” AD identifies counterparties – natural persons or legal representatives of legal entities (e.g. as registered in the Commercial Register) in order to ensure that the contract is valid and binding upon the parties. The Personal Data of legal representatives, attorneys or employees of counterparties are often used as contact details so that the Company can maintain communication with the counterparty.

Personal Data are collected both directly from the respective natural person or from the counterparty and, where necessary, from publicly available registers and official sources (for example, the Commercial Register).

4. For what purposes do we process Personal Data?

“SLAVLEN” AD processes Personal Data in connection with the establishment, development and proper settlement of contractual and commercial relations. The main purposes include:

  • establishing the proper representation of the counterparty under the contract;
  • entering into a valid and legally binding contract;
  • performance, amendment and termination of the contract;
  • maintaining contact and exchanging correspondence with the counterparty;
  • protecting and enforcing the rights and legitimate interests of the Company under the contract, including in case of disputes and claims;
  • maintaining and developing commercial relations with the counterparty.

Personal Data may also be processed for the fulfilment of statutory obligations of “SLAVLEN” AD (e.g. tax and accounting requirements, requirements for retention of documents for certain periods, etc.).

5. On what legal basis do we process Personal Data?

“SLAVLEN” AD processes Personal Data on one or more of the following legal grounds under Article 6 of the GDPR:

  • Necessity for the performance of a contract or for taking steps at the request of the natural person prior to entering into a contract – for example, where the person is a party to the contract or represents a party.
  • Necessity for compliance with a legal obligation to which the Company is subject – e.g. requirements of tax and accounting legislation, regulatory requirements on document flow and retention.
  • Legitimate interest of the Company – for example, entering into and performing valid and binding contracts, protecting the rights and legitimate interests of “SLAVLEN” AD in disputes, claims and proceedings, as well as maintaining commercial relations. In such cases, the Company assesses whether its legitimate interests are not overridden by the rights and freedoms of natural persons; where the interests of the persons prevail, the data are not processed on this basis.

Where processing is based on legitimate interest, this interest essentially consists of: (i) entering into and performing a valid contract; (ii) protecting the rights and legitimate interests of “SLAVLEN” AD in connection with that contract.

6. How do we store and process Personal Data?

The Company stores Personal Data both in electronic format and on paper, depending on the nature of the documentation and the applicable storage requirements. The data are processed in an environment in which security measures are applied, commensurate with the nature and volume of the information processed.

Access to Personal Data is granted only to employees and other persons acting on behalf of “SLAVLEN” AD for whom such access is necessary to achieve the purposes set out in this notice or where access is required by law (for example accountants, lawyers, authorised administrative staff).

The processing of Personal Data may include: collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission or otherwise making available, alignment or combination, restriction, erasure or destruction.

“SLAVLEN” AD maintains a data protection regime with a view to ensuring effective and secure processing in accordance with the requirements of the GDPR and the Personal Data Protection Act.

7. For how long do we store Personal Data?

“SLAVLEN” AD stores Personal Data for periods necessary to achieve the purposes for which they are processed and/or as provided for in the applicable legislation.

Data are not erased in the presence of outstanding contractual obligations, pending disputes or claims, as well as before the expiry of the relevant limitation or preclusive periods. After the grounds for processing cease to exist and/or after the expiry of the relevant periods, the Personal Data are erased, destroyed or anonymised in accordance with the procedures established within the Company, unless another legal basis exists for their further storage.

8. Is disclosure of Personal Data possible?

Personal Data may be disclosed by “SLAVLEN” AD where this is provided for or required by law.

Disclosure of Personal Data is possible, for example, where this is necessary to protect the vital interests of the natural person, to protect the legitimate interests of “SLAVLEN” AD (provided that such interests are not overridden by the rights and freedoms of the natural person), as well as where, at the Company’s discretion, this is necessary in order to comply with applicable law, to fulfil its legal obligations or to respond to requests or inspections by competent investigative, control or supervisory authorities (e.g. courts, police, prosecution, administrative bodies).

Even in such cases, disclosure of Personal Data is carried out only to the extent necessary and in compliance with the legal requirements.

9. Are Personal Data protected?

“SLAVLEN” AD applies and maintains appropriate technical and organisational measures to protect Personal Data against unauthorised access, unlawful use, accidental loss, alteration, disclosure, damage or copying. The purpose of these measures is to ensure the ongoing confidentiality, integrity and availability of Personal Data.

The Company periodically reviews and updates its security measures in order to ensure a sustainable level of protection.

10. What are the rights of natural persons in relation to Personal Data protection?

Under the GDPR and the applicable national legislation, natural persons have the following rights with respect to their Personal Data:

  • right to be informed;
  • right of access;
  • right to rectification;
  • right to erasure (“right to be forgotten”);
  • right to restriction of processing;
  • right to data portability (where applicable);
  • right to object;
  • right not to be subject to a decision based solely on automated processing, including profiling (where applicable);
  • right to lodge a complaint with the supervisory authority and with the courts.

A detailed description of these rights is contained in Annex No. 1 – “Rights of the Data Subject”, which forms an integral part of this notice.

A natural person may exercise their rights personally or through an authorised representative by submitting a written request to the controller at the Company’s head office (at the address of management) or by post via a licensed postal operator.

11. Do you have questions?

For any questions regarding this notice or the processing of Personal Data, you may contact the controller at the following e-mail address: office@slavlen.eu

12. What happens in case of changes?

In the event of a material change in the manner in which “SLAVLEN” AD processes Personal Data, in the types of Personal Data processed or in any other aspect of this notice, the Company will publish an updated version of the notice on its corporate website www.slavlen.eu

13. Annexes, issuance and copies

This notice includes Annex No. 1 “Rights of the Data Subject”, which forms an integral part hereof. The notice is issued by “SLAVLEN” AD and is addressed to all affected natural persons in accordance with the General Data Protection Regulation and the Personal Data Protection Act.

ANNEX No. 1: RIGHTS OF THE DATA SUBJECT IN RELATION TO THE PROCESSING OF PERSONAL DATA

As a data subject, you have the following rights in relation to the processing of your Personal Data by “SLAVLEN” AD:

1. Right to information and access

You have the right to obtain information as to whether “SLAVLEN” AD processes your Personal Data, which data it processes, on what grounds and for what purposes, as well as to receive a copy of the Personal Data concerning you.

2. Right to rectification

If you find that your Personal Data are inaccurate or incomplete, you have the right to request their rectification or completion. “SLAVLEN” AD must carry out the rectification without undue delay.

3. Right to erasure (“right to be forgotten”)

Subject to the conditions laid down by law, you have the right to request the erasure of your Personal Data, for example where they are no longer necessary for the purposes for which they were collected, where they have been unlawfully processed, or where you have objected to the processing and there are no overriding legitimate grounds for further processing. “SLAVLEN” AD may refuse erasure in the cases provided for in the GDPR (for example where the processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims).

4. Right to restriction of processing

In certain cases, for example where you contest the accuracy of the data or where the processing is unlawful but you do not want the data to be erased, you may request restriction of the processing. Where processing is restricted, the data are stored but, as a rule, not used while the restriction is in force.

5. Right to data portability

Where processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used and machine-readable format and/or to request that they be transmitted directly to another controller, where technically feasible.

6. Right to object

Where the processing of your Personal Data is carried out on the basis of the legitimate interest of “SLAVLEN” AD, you have the right to object at any time to such processing on grounds relating to your particular situation. In such case, “SLAVLEN” AD will cease the processing unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or shows that the data are necessary for the establishment, exercise or defence of legal claims.

7. Right not to be subject to a decision based solely on automated processing

In cases where automated decision-making, including profiling, would be applied and such decision would produce legal effects concerning you or similarly significantly affect you, you have the right not to be subject to such a decision and to request human intervention (human review).

8. Right to lodge a complaint

If you consider that the processing of your Personal Data infringes the requirements of the GDPR or Bulgarian legislation, you have the right to lodge a complaint with:

Commission for Personal Data Protection (CPDP),1592 Sofia, 2 “Prof. Tsvetan Lazarov” Blvd., website: www.cpdp.bg

How can you exercise your rights?

You may exercise any of the above rights by contacting “SLAVLEN” AD at: office@slavlen.eu or by submitting a written request at the Company’s address of management.