Personal Data Policy

POLICY ON EXERCISING THE RIGHTS OF PERSONAL DATA SUBJECTS

This policy (the “Policy”) determines the terms and procedure under which natural persons whose personal data are processed by NLP BULGARIA EOOD (the “Company”) may exercise their rights under personal data protection legislation.

GENERAL PRINCIPLES

NLP BULGARIA EOOD processes and protects the personal data collected in the course of its activities fairly, lawfully and in accordance with the purposes for which the data have been collected.

Employees who process personal data for the purposes of preparing and delivering educational programmes, courses and training sessions as part of their employment duties comply with the following principles when processing personal data:

Personal data are processed lawfully and fairly. Personal data are collected for specific, clearly defined and lawful purposes and are not further processed in a manner incompatible with those purposes. Personal data collected and processed in relation to human resources management are relevant, related to and do not exceed the purposes for which they are processed. Personal data are accurate and, where necessary, kept up to date. Personal data are erased or corrected when they are found to be inaccurate or disproportionate in relation to the purposes for which they are processed. Personal data are kept in a form which permits the identification of the relevant natural persons for no longer than is necessary for the purposes for which those data have been collected.

Employees who process personal data undergo initial and periodic data confidentiality training and are familiarised with the applicable legislation.

DEFINITIONS

The definitions listed below have the following meanings:

“Personal data” means any information relating to an identified natural person or a natural person who may be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, psychological, mental, economic, cultural or social identity of that natural person;

“Applicable legislation” means the legislation of the European Union and the Republic of Bulgaria relating to the protection of personal data;

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person and, in particular, to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

“Data subject” means a natural person who may be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, psychological, mental, economic, cultural or social identity of that natural person;

“Regulation (EU) 2016/679” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, General Data Protection Regulation, published in the Official Journal of the European Union on 4 May 2016.

RIGHTS OF PERSONAL DATA SUBJECTS

Personal data subjects have the following rights concerning their personal data:

Right of access;

Right to rectification;

Right to data portability;

Right to erasure;

Right to erasure, the “right to be forgotten”;

Right to request restriction of processing;

Right to object to the processing of personal data;

Right of the personal data subject not to be subject to a decision based solely on automated processing, regardless of whether such processing also includes profiling.

RIGHT OF ACCESS

Upon request, NLP BULGARIA EOOD provides a personal data subject with the following information:

Information on whether NLP BULGARIA EOOD processes or does not process the person’s personal data;

A copy of the person’s personal data processed by NLP BULGARIA EOOD;

An explanation regarding the processed data.

The explanation regarding data processing includes the following information concerning the personal data processed by NLP BULGARIA EOOD:

The purposes of the processing;

The relevant categories of personal data;

The recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

Where possible, the envisaged period for which the personal data will be stored or, where this is not possible, the criteria used to determine that period;

The existence of the right to request rectification or erasure of personal data, or restriction of the processing of personal data relating to the data subject, or to object to such processing;

The right to lodge a complaint with a supervisory authority;

Where the personal data are not collected from the data subject, any available information as to their source;

The existence of automated decision-making, regardless of whether such processing also includes profiling, and information regarding the logic involved, as well as the significance and envisaged consequences of such processing for the data subject;

Where personal data are transferred to a third country or an international organisation, the data subject has the right to be informed of the appropriate safeguards relating to the transfer.

The explanation regarding the processed data contains the information which NLP BULGARIA EOOD provides to data subjects through privacy notices.

At the request of the personal data subject, NLP BULGARIA EOOD may provide a copy of the personal data undergoing processing.

When providing a copy of personal data, NLP BULGARIA EOOD must not disclose the following categories of data:

Personal data of third parties, unless they have expressly consented to such disclosure;

Data constituting a trade secret, intellectual property or confidential information;

Other information protected under the applicable legislation.

Providing access to personal data subjects must not adversely affect the rights and freedoms of third parties or result in a breach of a statutory obligation of NLP BULGARIA EOOD.

Where requests for access are manifestly unfounded or excessive, particularly because of their repetitive nature, NLP BULGARIA EOOD may charge a reasonable fee based on the administrative costs of providing the information or refuse to act on the request for access.

NLP BULGARIA EOOD assesses on a case-by-case basis whether a request is manifestly unfounded or excessive.

Where access to personal data is refused, NLP BULGARIA EOOD provides reasons for its refusal and informs the data subject of their right to lodge a complaint with the Commission for Personal Data Protection.

RIGHT TO RECTIFICATION

Data subjects may request the rectification of their personal data processed by NLP BULGARIA EOOD where such data are inaccurate or incomplete.

Where a request for rectification of personal data has been granted, NLP BULGARIA EOOD notifies the other recipients to whom the data have been disclosed, for example public authorities and service providers, so that they may reflect the changes.

RIGHT TO ERASURE, THE “RIGHT TO BE FORGOTTEN”

Upon request, NLP BULGARIA EOOD is obliged to erase personal data where one of the following grounds applies:

The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

The data subject withdraws their consent on which the processing is based and there is no other legal ground for the processing;

The data subject objects to the processing and there are no overriding lawful grounds for the processing;

The data subject objects to the processing of personal data for direct marketing purposes;

The personal data have been unlawfully processed;

The personal data must be erased in order to comply with a legal obligation of NLP BULGARIA EOOD;

The personal data have been collected in relation to the offer of information society services to children within the meaning of
Article 8, paragraph 1 of Regulation (EU) 2016/679.

NLP BULGARIA EOOD is not obliged to erase the personal data to the extent that processing is necessary:

For exercising the right of freedom of expression and the right to information;

For compliance with a legal obligation of NLP BULGARIA EOOD;

For reasons of public interest in the area of public health in accordance with Article 9, paragraph 2, points (h) and (i), and Article 9, paragraph 3 of Regulation (EU) 2016/679;

For archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89, paragraph 1 of Regulation (EU) 2016/679, to the extent that the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing;

For the establishment, exercise or defence of legal claims.

RIGHT TO RESTRICTION OF PROCESSING

The data subject has the right to request restriction of processing where one of the following applies:

The accuracy of the personal data is contested by the data subject. The restriction of processing applies for a period enabling the controller to verify the accuracy of the personal data;

The processing is unlawful, but the data subject does not wish the personal data to be erased and requests the restriction of their use instead;

NLP BULGARIA EOOD no longer needs the personal data for the purposes of the processing, but the data subject requires the data for the establishment, exercise or defence of legal claims;

The data subject has objected to processing based on the legitimate interests of NLP BULGARIA EOOD and verification is pending as to whether the lawful grounds of the controller override the interests of the data subject.

NLP BULGARIA EOOD may process personal data whose processing has been restricted only for the following purposes:
For storage of the data;

With the consent of the data subject;

For the establishment, exercise or defence of legal claims;

For the protection of the rights of another natural person;

For important grounds of public interest.

Where a data subject has requested restriction of processing and one of the grounds set out in the section above applies, NLP
BULGARIA EOOD informs the data subject before the restriction of processing is lifted.

RIGHT TO DATA PORTABILITY

The data subject has the right to receive the personal data concerning them which they have provided to NLP BULGARIA EOOD in a structured, commonly used and machine-readable format.
Upon request, these data may be transferred to another controller specified by the personal data subject where technically feasible.

The personal data subject may exercise the right to data portability in the following cases:

The processing is based on the consent of the personal data subject;

The processing is based on a contractual obligation;

The processing is carried out by automated means.

The right to data portability must not adversely affect the rights and freedoms of other persons.
RIGHT TO OBJECT

The data subject has the right to object to the processing of their personal data by NLP BULGARIA EOOD where the data are processed on one of the following grounds:

The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

The processing is necessary for purposes relating to the legitimate interests of NLP BULGARIA EOOD or a third party;

The processing of data includes profiling.
NLP BULGARIA EOOD terminates the processing of the personal data unless it demonstrates compelling lawful grounds for continuing the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

RIGHT TO OBJECT TO THE PROCESSING OF PERSONAL DATA FOR DIRECT MARKETING PURPOSES

Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data for such purposes, including profiling related to direct marketing.

Where the data subject objects to processing for direct marketing purposes, the processing of the personal data for such purposes is terminated.

RIGHT TO HUMAN INTERVENTION IN AUTOMATED DECISION-MAKING

Where NLP BULGARIA EOOD makes automated individual decisions, regardless of whether such decisions are made with the assistance of profiling, which produce legal effects concerning natural persons or similarly significantly affect them, those persons may request a review of the decision involving human intervention and may express their point of view.

NLP BULGARIA EOOD provides natural persons subject to automated decision-making with meaningful information regarding the logic involved, as well as the significance and envisaged consequences of such processing for the person.

PROCEDURE FOR EXERCISING THE RIGHTS OF PERSONAL DATA SUBJECTS

Personal data subjects may exercise their rights under this Policy by submitting a request to exercise the relevant right.
Requests for exercising the rights of personal data subjects may be submitted in the following ways:

Electronically to the following email address: info@nlpbulgaria.bg

In person at an office of NLP BULGARIA EOOD;

By post to the registered office address of NLP BULGARIA EOOD: 5 Orfey Street, Sofia.

A request to exercise rights relating to the protection of personal data must contain the following information:

Identification of the person, name and Personal Identification Number;

Contact details for correspondence, address, telephone number and email address;

Request, description of the request.

NLP BULGARIA EOOD provides information on the actions taken in relation to a request to exercise the rights of data subjects within one month of receipt of the request.

Where necessary, this period may be extended by a further two months, taking into account the complexity and number of requests submitted by a particular person. NLP BULGARIA EOOD informs the person of any such extension within one month of receipt of the request and states the reasons for the delay.

NLP BULGARIA EOOD is not obliged to respond to a request where it is unable to identify the data subject.

NLP BULGARIA EOOD may request the provision of additional information necessary to confirm the identity of the data subject where there are reasonable concerns regarding the identity of the natural person submitting the request.

Where the request is submitted by electronic means, the information is provided by electronic means where possible, unless otherwise requested by the data subject.
This Policy was adopted by a resolution of the Sole Owner of the Capital dated 7 May 2018.