Mandatory information on the rights of persons about personal data protection

Information about the Company that processes your data:

Name: SSARM LTD.

UIC/BULSTAT: 201231296

Registered office and address of management: Sofia city, Strelbishte district, building 93, entrance A, apt. 51

Address for correspondence: Sofia city, 87 Alexander Malinov Blvd., 2^nd floor, office 1

Telephone number: +359 2 474 43 03;

Office email address: office@ssarm.bg

Website: http://ssarm.bg

Information about the competent supervisory authority for the protection of personal data

Name: Commission for Personal Data Protection

Registered office and address of management: 1592 Sofia city, 2 Prof. Tsvetan Lazarov Blvd.

Address for correspondence: 1592 Sofia city, 2 Prof. Tsvetan Lazarov Blvd.

Telephone number: 02/ 915 3 518

Website: www.cpdp.bg

Grounds for the collection, processing, and storage of your personal data

Article 1. SSARM Ltd. collects and processes your personal data in connection with the conclusion and execution of contracts with the Company based on Art. 6, para. 1 and Art. 9, para. 2, Regulation (EU) 2016/679 (GDPR), and more specifically on the following grounds:

• To take action at your request in connection with the conclusion of a contract if you are a candidate for employment with us;
• To execute a contract or take steps to conclude one with the Contracting Authority under the Public Procurement Act.
• To execute a contract or take steps to conclude one with a trading partner.
• Compliance with a legal obligation that applies to the Administrator;
• For the purposes of the legitimate interests of the Administrator or a third party;
• For the fulfillment of obligations and the exercise of special rights of the administrator under the labor law and the law in the field of social security for the processing of special categories of personal data

Purposes and principles in the collection, processing, and storage of your personal data

Article 2. (1) When concluding a contract with a commercial partner or a Contracting Party under the Public Procurement Act, we collect and process personal data about the name of the legal representative of the legal entity – party to the contract, for the purposes of individualizing the party to the contract and its execution.

(2) The contact information of the legal representative or contact officer are business information and as such are not considered personal data.

Article 3. (1) We collect and process the personal data that you provide us when you apply for a job at SSARM Ltd., including for the following purposes:

• To individualize the candidate;

SSARM EOOD (hereinafter referred to as “Administrator” or SSARM Ltd.) carries out its activities in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27^th, 2016 on the protection of natural persons with regard to the processing of personal data and regarding the free movement of such data. This information is intended to inform you about all aspects of the processing of your personal data by the Company and the rights you have in relation to this processing.

• In order to contact you and communicate;
• To select candidates.

(2) We keep your personal data that you have provided to us for the entire duration of the job offer, and if we would like to continue to store your data after this period for the purposes of future communication with you, we will send you an inquiry by email to request your express consent for the continuation of your personal data storage.

Article 4. We observe the following principles when processing your personal data:

• Legality, good faith and transparency;
• Limitation of processing purposes;
• Relevance to the purposes of the processing and minimizing the amount of data collected;

• Accuracy and actuality of data;
• Limitation of storage in order to achieve the goals;
• Integrity and confidentiality of processing and ensuring an appropriate level of personal data protection.

Article 5. When processing and storing personal data, the Administrator may process and store personal data to protect his legitimate interests in connection with:

• Fulfillment of obligations to the National Revenue Agency, the Ministry of the Interior and other state, and municipal bodies.

Article 6. (1) SSARM Ltd. performs the following operations with the personal data provided by you as job applicants, for the following purposes:

• Conclusion and execution of an employment or civil contract – the purpose of this operation is to carry out a recruitment process for the appointment of employees or persons on a civil contract, conclusion of the relevant contract and its administration and execution by the Company.

Conclusion of the impact assessment: Given the small number of staff employed and the limited volume of personal data being processed, it is not necessary to carry out an impact assessment for the current personal data processing operation.

• The administrator does not collect or process personal data of job applicants that refers to the following:
  • Reveal racial or ethnic origin;
  • Reveal political, religious or philosophical beliefs, or membership in trade unions;
  • Genetic and biometric data or data about sex life or sexual orientation.
• The administrator does not collect and process data on the health status of job applicants, except after a selection made for the purposes of concluding an employment contract and determining appropriate working conditions.
• The personal data is collected by the Administrator from the persons to whom it refers.
• The administrator does not perform automated decision making in connection with the data.

 Article 7. (1) SSARM Ltd. carries out the following operations with the personal data provided by you as legal representatives or proxies of legal entities – business partners/clients, including as natural persons – partners/clients, for the following purposes:

• Conclusion of contracts with the Contracting Authority under the Public Procurement Act – the purpose of this operation is the conclusion and execution of a contract with the Contracting Authority under the Public Procurement Act and its administration;
• Conclusion and execution of a commercial transaction with a partner – the purpose of this operation is the conclusion and execution of a contract with a commercial partner and its administration.

Conclusion of the impact assessment: Given the limited scope of the collected personal data and the fact that some of it is collected from publicly available sources, it is not necessary to carry out an impact assessment.

• The personal data was collected by the Administrator from the persons to whom it relates and from the Commercial Register at the Registration Agency.
• The administrator does not perform automated decision making in connection with the data.

Conclusion of the impact assessment: Given the limited scope of personal data collected, carrying out an impact assessment is not necessary to conduct an impact assessment of the operation.

Storage period of your personal data

Article 9. (1) SSARM Ltd. stores your personal data as a job candidate for a period not longer than the availability of the actual job offer. After the expiration of the job offer period or the end of the selection process, SSARM EOOD takes the necessary care to delete and destroy all your data without unnecessary delay or to anonymize them (namely to reduce them to a form that does not reveal your identity), except if you do not give your explicit consent for your data to continue to be stored and processed in the future.

• SSARM Ltd. stores the personal data of the legal representatives of legal entities – parties to a contract with the company indefinitely, for the purposes of protecting the legitimate interest of SSARM Ltd. and fulfilling its legal obligations to state bodies and institutions.
• SSARM Ltd. stores the personal data of the company’s customers who exercise the right of withdrawal or claim until the termination of the contract and 5 years after that for the purpose of maintaining a register of claims.
• The Administrator notifies you if the data storage period needs to be extended to fulfill a legal obligation or in view of legitimate interests of the Administrator or otherwise.
• The administrator stores the personal data that needs to be stored according to the applicable legislation for the relevant stipulated term, which may exceed the term of the contract.

Transferring of your personal data for processing

Article 10. (1) The administrator may, at its own discretion, transfer part or all your personal data to administrators of personal data for the fulfillment of the processing purposes to which you have agreed, subject to the requirements of Regulation (EU) 2016/679 (GDPR).

(2) The administrator notifies you in case of intention to transfer part or all your personal data to third parties or international organizations.

Your rights in the collection, processing, and storage of your personal data

Withdrawal of consent to the processing of your personal data

Article 11. (1) If you do not want all or part of your personal data to continue to be processed by SSARM Ltd. for specific or all processing purposes, you can withdraw your consent to processing at any time by sending a request in free text.

• The administrator may ask you to verify your identity as the data subject by asking you to present an identity document on the spot.
• The withdrawal of consent does not affect the validity of the processing of the personal data provided by you until the moment of withdrawal of consent.
• SSARM Ltd. may continue to process part or all your data if there is a legal obligation to do so or for the purposes of protecting its legitimate interests.

Right of access

Article 12. (1) You have the right to request and receive confirmation from the Administrator as to whether personal data related to you is being processed.

• You have the right to access the data related to you, as well as the information related to the collection, processing, and storage of your personal data.
• The administrator provides you, upon request, with a copy of the processed personal data related to you, in electronic or other appropriate form.
• Providing access to the data is free of charge, but the Administrator reserves the right to impose an administrative fee in case of repetitive or excessive requests.

Right to correction or completion

Article 13. You have the right to ask the Administrator to:

• correct inaccurate personal data relating to you;
• complete incomplete personal data related to you.

Right to deletion (“to be forgotten”)

Article 14. (1) You have the right to ask the Administrator to delete part or all your personal data, and the Administrator has the obligation to delete them without undue delay, when any of the following grounds are present:

• The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
• You withdraw your consent on which the data processing is based and there is no other legal basis for the processing;
• You object to the processing of your personal data, including for direct marketing purposes, and there are no overriding legal grounds for the processing;
• Personal data has been processed unlawfully;
• Personal data must be deleted in view of the compliance with a legal obligation under EU law or the law of a Member State that applies to the Administrator;
• The personal data was collected in connection with the provision of services to the information society.
•  The Administrator is not obliged to delete the personal data if he stores and processes it:

       o in order to exercise the right to freedom of expression and the right to information;

• • To comply with a legal obligation that requires processing under any EU law or Member State law that applies to the Administrator or for the performance of a task in the public interest or in the exercise of official powers granted to him;
  • For reasons of public interest in the field of public health;
  • For archiving purposes in the public interest, for scientific or historical research or for statistical purposes;
  • For the establishment, exercise, or defense of legal claims.
• In the event of exercising your right to be forgotten, the Company will delete all your data, except for your full name as a job applicant, for reporting purposes.
• To exercise your right to be forgotten, it is necessary to send a request in free text and identify yourself with an identity document on the spot.

Right to limitation

Article 15. You have the right to request the Administrator to limit the processing of your personal data when:

• You dispute the accuracy of the personal data, for a period that allows the Administrator to verify the accuracy of the personal data;
• The processing is illegal, but you do not want the personal data to be deleted, but only to have its use limited;
• The administrator no longer needs the personal data for the purposes of processing, but you require them to establish, exercise or defend your legal claims;
• You have objected to the processing while waiting for verification of whether the legal grounds of the Administrator take precedence over your interests.

Right to portability

Article 16. (1) If you have consented to the processing of your personal data or the processing is necessary for the execution of the contract with the Administrator, or if your data is processed in an automated manner, you may, after identifying yourself to the Administrator:

• Ask the Administrator to provide you with your personal data in a readable format and to transfer it to another Administrator;
• Ask the Administrator to directly transfer your personal data to an administrator specified by you when this is technically feasible.

(2) You can exercise your right to portability by sending a request in free text.

Right to receive information

Article 17. You can ask the Administrator to inform you about all recipients to whom the personal data for which correction, deletion or restriction of processing has been requested has been disclosed. The administrator may refuse to provide this information if it would be impossible or would require a disproportionate effort.

Right to object

Article 18. You may object at any time to the Administrator’s processing of personal data relating to you, including if it is processed for the purposes of profiling or direct marketing.

Your rights in the event of a breach of your personal data protection

Article 19. (1) If the Administrator detects a breach of the security of your personal data, which may create a high risk for your rights and freedoms, he notifies you without undue delay about the violation, as well as about the measures that have been taken or are about to be taken.

(2) The Administrator is not obliged to notify you if:

• He has taken appropriate technical and organizational measures to protect the data affected by the security breach;
• He has subsequently taken measures to ensure that the breach will not result in a high risk to your rights;
• Notification would require a disproportionate effort.

Persons to whom your personal data is provided

Article 20. For the purposes of processing your personal data and fulfilling the concluded contract, SSARM EOOD may provide your data to third parties processing personal data who comply with all requirements for legality and security in the processing and storage of your personal data.

Article 21. The administrator does not transfer your data to countries outside EU.

Article 22. In the event of a violation of your rights under the above or applicable Personal Data Protection Legislation, you have the right to file a complaint with the Commission for Personal Data Protection as follows:

Name: Commission for Personal Data Protection

Registered office and address of management: 1592 Sofia city, No. 2 Prof. Tsvetan Lazarov Blvd.

Address for correspondence: 1592 Sofia city, No. 2 Prof. Tsvetan Lazarov Blvd.

Telephone number: 02/ 915 3 518

Website:  http://www.cpdp.bg/  

Article 23. You can exercise all your rights regarding the protection of your personal data through the forms attached to this information. Of course, these forms are not mandatory and you can make your requests in any form that contains a statement to that effect and identifies you as the data owner.

SSARM Ltd. will provide a link to this Mandatory Information on its website, with a reference or in another appropriate way, ensuring that you can familiarize yourself with its content.