Personal Data Protection

Association “Bulgarian Society for the Protection of Birds”, UIC 121244539 (hereinafter referred to as “BSPB”), has implemented measures to establish safeguards for the protection of personal data in accordance with the requirements of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation, or “GDPR”), as well as other applicable legislation of the European Union (“EU”) and the Republic of Bulgaria.

This Personal Data Protection Policy (the “Policy”) establishes a framework of general rules and principles for the protection of personal data, serving as guidance for specific notices, policies and procedures designed to achieve the level of legal compliance required by law. This Policy applies to the processing of Personal Data by BSPB concerning any Data Subject.

  1. Personal Data shall be processed lawfully, fairly and in a transparent manner in relation to the Data Subject (“lawfulness, fairness and transparency”).
  2. Personal Data shall be collected for specified, explicit and legitimate purposes and shall not be further processed in a manner incompatible with those purposes (“purpose limitation”).
  3. Personal Data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”).
  4. Personal Data shall be accurate and, where necessary, kept up to date, having regard to the purposes for which they are processed (“accuracy”).
  5. Personal Data shall be kept in a form which permits identification of the Data Subject for no longer than is necessary for the permitted purposes (“storage limitation”).
  6. Personal Data shall be processed in a manner that ensures an appropriate level of security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (“integrity and confidentiality”).
  7. BSPB shall be responsible for, and shall be able to demonstrate, compliance with the above principles (“accountability”).

Legal Grounds for Processing Personal Data

Personal Data may be processed where:

  • The Data Subject has given valid and informed consent to the processing of their Personal Data for one or more specific purposes;
  • Processing is necessary for the performance of a contract to which the Data Subject is party, or in order to take steps at the request of the Data Subject prior to entering into a contract;
  • Processing is necessary for compliance with a legal obligation;
  • Processing is necessary in order to protect the vital interests of the Data Subject; or
  • Processing is necessary for the purposes of the legitimate interests pursued by BSPB or by a third party to whom the data have been disclosed, except where such interests are overridden by the interests and/or fundamental rights and freedoms of the Data Subject.
  • Processing is necessary for the performance of obligations and the exercise of rights of BSPB and/or the Data Subject under applicable employment and social security legislation;
  • Processing is necessary in order to protect the vital interests of the Data Subject;
  • Processing is necessary for the establishment, exercise or defence of legal claims;
  • Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the employee’s working capacity, medical diagnosis, the provision of health or social care or treatment, or for the management of health or social care systems and services.

Information Provided to Data Subjects

The following information shall be provided to Data Subjects:

  1. The identity and contact details of the Controller responsible for the processing of Personal Data;
  2. The contact details of the Data Protection Officer (DPO), where applicable;
  3. The purposes of the processing;
  4. The recipients or categories of recipients of Personal Data;
  5. Where applicable, information concerning the Controller’s intention to transfer Personal Data to a third country, as well as the existence or absence of an adequate level of protection in the event of such a transfer; and
  6. Information concerning the rights of Data Subjects in relation to the processing of their Personal Data.

Recipients of Personal Data

Personal Data may be disclosed to:

  • State authorities and bodies entrusted with public functions, within the scope of their powers (the National Revenue Agency, National Social Security Institute, Executive Agency “General Labour Inspectorate”, Ministry of Interior, Prosecutor’s Office and other similar bodies);
  • Banks, for the purposes of processing payments of remuneration and expenses;
  • EU institutions and agencies, as well as other international organisations, in connection with reporting on activities under projects funded by such organisations, where the Data Subject participates in the implementation of the respective project;
  • Courier companies and postal operators, for the purposes of correspondence with Data Subjects.

Rights of Data Subjects

Data Subjects have the right:

  1. To submit an inquiry to BSPB as to whether their Personal Data are being processed and, if so, to receive a copy of the Personal Data processed by BSPB, as well as information regarding the purpose of the processing, the period for which the data will be processed, and the recipients to whom the data have been or will be disclosed (right of access, pursuant to Article 15 of the GDPR);
  2. To request the correction of inaccurate Personal Data or the completion of incomplete Personal Data in the event of a technical error or inaccuracy (right to rectification, pursuant to Article 16 of the GDPR);
  3. To request BSPB to erase Personal Data relating to them where there is no legal basis for processing, where the Data Subject has withdrawn their consent to processing, or where the Data Subject has expressly and legitimately objected to the processing (right to erasure / “right to be forgotten”, pursuant to Article 17 of the GDPR);
  4. To request BSPB to restrict the processing of their Personal Data (i.e. for their Personal Data to continue to be stored by BSPB without being otherwise processed) where the accuracy of the Personal Data or the lawfulness of the processing is contested by the Data Subject, or where BSPB no longer needs the Personal Data but the Data Subject requires them to be retained for the establishment, exercise or defence of legal claims (right to restriction of processing, pursuant to Article 18 of the GDPR);
  5. To request BSPB to provide them with the Personal Data concerning them in a structured, commonly used and machine-readable format (right to data portability, pursuant to Article 20 of the GDPR);
  6. Right to object (pursuant to Article 21 of the GDPR); and
  7. To lodge a complaint with the Commission for Personal Data Protection (CPDP) (address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria; website: www.cpdp.bg) if they consider that applicable legislation concerning their Personal Data has been violated (right to lodge a complaint, pursuant to Article 77 of the GDPR).