Privacy Notice

We, VELPA-91 AD, UIC 104004627, 5150 Strazhitsa, 36 Gladston Str., Bulgaria (Our company), acting as data controller within the meaning of the General Data Protection Regulation (GDPR, (EU) 2016/679), in force as of 25 May 2018 and  Personal Data Protection Act In force as from 1 January 2002, have committed to ensure full compliance with the EU and Bulgarian legislation regarding the processing of personal data and the protection of the “rights and freedoms” of the persons whose personal data we collect and process, in view of which we provide you with a present information. 

Under the General Data Protection Regulation, personal data is defined as: “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person “. 

This document applies to you, in your capacity as a representative of our CONTRACTORS, as a CANDIDATE willing to work with us, as VISITOR to our production stage in Strajitsa, and as a USER of our website (www.velpa91.com) 

1. PRIVACYof the our CONTRACTORS ‘ data – natural persons – contractors and representatives (statutory, by proxy, contact persons, etc.) of contractors  

The personal data we collect and process: In reference with establishment and fulfilment of legal relations with our Contractors, we process their personal data when they are physical persons, sole traders, as well as personal data of their representatives (legal, by proxy, contact persons, etc.), such as (personal data category, description): civil status (up to three names , PIN/date of birth), contact details (phone, e-mail, address); occupied position or position. 

Source: We receive the above personal data from you personally, as well as from the available public records. 

We declare that the personal data we collect will only be used for legitimate purposes, such as: establishment of representative power of a contractor, conclusion and proper execution of the contract, active / passive legal protection, exercising of direct marketing (offers and marketing proposals). 

The grounds that entitle us to process your data: the processing is necessary for performance of our contractual relationships with the contractor you are or you represent, as well as for the purposes of our legitimate interest of duly establishment and exercise of representative powers ( asp per Bulgarian Law on Obligation and Contracts and Bulgarian Commercial act). For the purpose of direct marketing with our long-term contractors to provide them with products / services from our core product range the processing is based on our legitimate interest, and in other direct marketing cases, we will ask for additional consent. You alone can give such consent HERE (link here). 

Processing period: We will keep your personal data throughout the lifetime of the legal relationship, after which the data will be archived until the expiry of the limitation periods for liability to the entity and / or by a public authority in relation to the relationship (5 years in the general case) unless a special law requires otherwise. 

1. PRIVACYof DATA of the CANDIDATES for WORK in VELPA-91 AD 

Personal data we collect and process: In case you apply to work with us, you need to provide us with your personal data, such as (personal data category, description): civil status (three names, age), education (professional knowledge and experience), data for length of working and experience, contact details (tel., e-mail), others (at your own discretion). 

Source: The above personal data we receive from you, personally and directly. 

We declare that the personal data we collect will only be used for legitimate purposes, such as: assessment whether you are eligible for a vacant position and whether you are the most suitable candidate for it. The provision of your personal data as specified in the job advertisements is a mandatory condition for participation in a selection procedure. If you do not provide us with any of the required categories of personal information, this may prevent us from analyzing your application in view of the requirements for that position, which may result in you assessment that you are not suitable for it. If you have provided us with more personal data than stated in the job advert, please note that we will not process these categories of personal data otherwise than their storage as part of the documents you submitted in the application. If you do not apply for a specific job offer, we will process your personal data you have provided to us only to the extent necessary for the purposes of the current selection procedure. 

The grounds that entitle us to process your data: processing is based on your explicit consent. 

Processing period: Your personal data will be processed until the selection procedure for the position for which the application has been submitted and will be kept for no more than 6 months after the selection process for this item has ended. Subject to your explicit and voluntary written consent that allows your data to be processed for a longer period (i.e. for participation in future recruitment procedures), personal data will be retained for a period specified in the relevant statement to obtain consent. Upon expiration of this period, we will delete or destroy the stored documents with personal data unless a special law provides otherwise. You have the right to withdraw your consent at any time without affecting the legality of the processing at the time of withdrawal. 

1. C.PRIVACYof data of the VISITORS to our production stage in Strazhitsa, where VIDEO SURVEILLANCE is performing 

The personal data we collect and process: In conjunction with the video surveillance we carry on the portal, the production premises and the loading platform of the enterprise, we collect and process your data for image and behavior, giving information about the human image and the features, the image of your behavior, habits, committed offenses and other visible information as well as data to establish your location when entering and moving within the range of cameras. 

The above data, we “Velpa-91” AD process with “Velpa Trade” EOOD, UIC 130943036, Strazhitsa 5150, 36 Gladstone str. as joint controllers. 

Source: The above personal data we receive from you, personally. 

We declare that the personal data we collect in video surveillance will only be used for legitimate purposes, such as: security of property, assurance of security, safety and order in the enterprise, prevention and avoidance of theft and other abuses. 

Grounds that give us the right to process your data for image and behavior are: our legitimate interest in assurance of protection and security of people and property on the site of the organization. Apart from the above, through the video surveillance, we could also perform our legal duties to support the competent public authorities within the limits of their powers and upon request from a competent public authority to provide information contained in the stored video recordings. 

Processing period: We store your video data for up to 14 days. Typically, this processing is limited to real-time monitoring of guarded area and the storage of relevant records. Under extraordinary circumstances, we may need to review and copy the records stored in our systems for purposes of contractual and / or regulatory compliance and the protection of our business. This may include, for example, checks for the purpose of disclosure of information and / or documentary checks to competent public authorities. To the extent permitted by applicable law, these inspections will be conducted in a reasonable and proportionate manner and will be subject to the approval of our management at an appropriate hierarchical level. We will only process your personal data to the extent necessary to enable us to fulfill the above-described purposes only when we conclude that our processing of information does not harm your privacy in a way that would have an advantage to our legitimate interest in meeting the relevant goals.  

1. PRIVACYof VISITORS data located on the premises of the enterprise where ACCESS CONTROL 

The personal data we collect and process: In reference to control the access of visitors on the territory of the enterprise, we collect your personal data, such as (personal data category, description): civil status (three names); means of transport (when you enter it on the territory of the enterprise): vehicle registration number, time and date of entry and exit of the enterprise recorded by recording your data in a paper register by a portal-keeper. 

The above data, we “Velpa-91” AD process with “Velpa Trade” EOOD, UIC 130943036, Strazhitsa 5150, 36 Gladstone str., as joint controllers. 

Source: The above personal data we receive from you, personally. 

We declare that the personal data we collect will only be used for legitimate purposes such as: control of access to the site of the enterprise. 

The grounds that entitle us to process your data upon your entry, presence, and exit from our premises are our legitimate interest in preventing unauthorized outsiders in order to avoid theft and other types of abuse, providing security and information, property and staff protection. Apart from the above, through the access control, we could also perform our legal duties to support the competent public authorities within the limits of their powers. 

Processing period: Your data processed in access control will be stored for up to one year, unless it is necessary particular data to be stored for longer period (i.i. in case of incidents). 

GENERAL for all cases of processing your personal data (A, B,C, D) discussed above: 

How  we store and preserve your personal data we process: 

We will process your personal data upon taking necessary and sufficient technical and organizational measures for their protection. Among others, we have adopted the necessary internal policies and have taken steps to protect your personal data at the design stage; data officers are well aware of the privacy requirements; the processing of your personal data is limited to the minimum necessary to achieve the relevant goals; we have implemented the necessary security measures, such as guard security, limited access, security systems, etc .; we have put in place measures to ensure permanent confidentiality, integrity, availability and sustainability of processing systems and services, as well as measures in the event of a physical or technical incident for timely recovery of availability and access to personal data; an internal process for the regular testing, assessment and evaluation of the effectiveness of technical and organizational measures has been put in place in order to ensure the processing security; a procedure for storing and destroying data has been developed. We will process (collect, store and use) the information you provide in a manner consistent with the requirements of the General Data Protection Regulation (GDPR). We will strive to keep the information accurate and current. 

We do not perform automated individual decision-making (without human intervention) in the processing of your personal data for any of the above purposes. 

YOUR RIGHTS as a subject of personal data: At any time while we store or process your personal data, you, as a subject of such data, have the following rights: 

• Claimfor confirmation that we process your personal data and, if so, to have access to the data as well as to receive processing information. For additional copies requested by you, a reasonable fee may be imposed for the necessary administrative costs; 
• Claimfor rectification your personal data when it is inaccurate and when it is not up to date, as well as filling in your personal data that is incomplete; 
• Claimto erase personal data (right to be forgotten) without undue delay, if and to the extent applicable to the grounds under Art. 17 of GDPR and / or the relevant national law, in cases inter alia as: personal data are no longer necessary for the purposes for which they have been collected; when you have withdrawn your consent; when you have objected to the processing; where the processing is unlawful; where personal data must be erased in order to comply with a legal obligation under EU law or the law of a Member State that applies to us as a data controller; where personal data has been gathered in connection with the provision of information society services. 
• Claim forrestriction of processing if and to the extent applicable to the grounds under Art. 18 of GDPR and / or the relevant national law, in cases inter alia as ascertaining the accuracy or reason for data processing; restricted data processing is usually simple to store; 
• Claim for andbeing provided with personal data in a structured, commonly used and machine-readable format, as well as request to be transferred to another data controller without obstruction on our part, if and to the extent applicable to the grounds under Art. 20 of GDPR and / or the relevant national law, in cases, inter alia, where the processing has been based on a consent for particular purpose or it is necessary for performance of a contract and it has been carried out in an automated manner; 
• Objectto the processing of your personal data if and to the extent applicable to the grounds under Art. 21 of the GDPR and / or the relevant national law, including, but not limited to, processing in the performance of a public interest task or in the exercise of official authority; processing is necessary for the purposes of our or third party’s legitimate interests, including profiling of the stated grounds; 
• You notto be subject to automated individual decision-making, incl. profiling that will significantly affect you without human intervention if and to the extent applicable to the grounds under Art. 22 GDPR and / or Art. 52 PDPA. 

In most cases, your rights as data subjects are not absolute insofar as they are limited by the rights and freedoms of others. We may deny the exercise of a specific right, for statutory reasons, according to the law, such as, inter alia, most often the grounds for such a denial shall be: compliance with a legal obligation on our part or for the performance of a task of public interest; in the exercise of the public powers granted to us (if applicable); for the establishment, exercise or protection of legal claims. Our refusal must always be explicit, written, and justified by a specific statutory reason. 

Object to the processing of your personal data: You have the right, at any time and on grounds related to your particular situation, to object to processing based on our legitimate interest (for the purposes of direct marketing, CCTV, access control). We will discontinue the processing of personal data by CCTV unless we can prove that there are convincing legal grounds for processing that have priority over your interests, rights and freedoms, or for the establishment, exercise or protection of legal claims. You have the right at any time to object to the processing of personal data for direct marketing purposes relating to you, and in case you object to processing for direct marketing purposes, we will terminate the processing of your personal data for these objectives. 

Consent: When processing of your personal data is based on your consent, according to this Privacy Notice, by your consent you give us permission to process your personal data only for the above specified purposes. You may withdraw your consent at any time by express written notice addressed to us.  

We provide conditions to ensure the exercise of your rights as data subjects, in case you wish to address the processing of your personal data, exercise your right, withdraw your consent, or report or complain, you may please do so in writing by contacting the data controller or by contacting us at 061 61 41 77, e-mail: hr@velpa91.com. We will respond to your comments, questions and requests within one month of receiving them. If necessary, this period may be extended by a further two months, taking into account the complexity and the number of requests for which you will be informed within the initial one month period. Please consider, that for security purposes we might demand to certify your identity in appropriate and sufficient way. 

Apart from the above rights, you have the absolute right to file complaints relating to the processing of your personal data, the processing of your request and your complaint, or the handling of complaints. You can bring your complaints directly to the Supervisory Authority – Commission for personal data protection, address: 2, Prof. Tzvetan Lazarov Str., 1592 Sofia, (www.cpdp.bg) within 6 months of becoming aware of the violation, but no later than two years after it has been committed. 

In case you believe we as data controller or our data processor have violated your rights under the General Data Protection Regulation and the Bulgarian Personal Data Protection Act, you may appeal actions and acts of the data controller and the processor of personal data to the court under the Administrative Procedure Code, in the same proceedings you may want compensation for any damages you suffer as a result of the unauthorized processing of personal data by the data controller.