In accordance with the requirements of Law for the protection of personal data, and the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “EU General Data Protection Regulation” or “GDPR”), as well as the national regulations enacted for the implementation of the EU General Data Protection Regulation, the company Rompetrol Bulgaria, part of the KMG International Group (hereinafter the “Company”), having its registered office in Sofia, Bulgaria 188, Slivnitsa Blvd. fl. 6 registered at the Trade Registry under no. 117599032, is required to safely process, in good faith and in compliance with the legal provisions in effect, your personal data you supply to us, solely for the specified purposes.
1. Personal Data Controller:
Rompetrol Bulgaria is a Bulgarian company organised and existing under the laws of Bulgaria, which, as controller, stores in good faith the personal data of its customers in accordance with the regulations in force, in full compliance with the principles of personal data processing for legitimate purposes, pursuant to the EU General Data Protection Regulation, the national regulations enacted for the implementation of the EU General Data Protection Regulation.
The data processed:
These data are processed by the Company for the following purposes:
In the case where the Company shall decide upon processing your personal data for other purposes, especially under article 6, para. 1, letter a) of the EU General Regulation on data protection, and of the internal legislative acts approved with a view to implementing the EU General Regulation, respectively under your consent, you shall be sent a separate information memorandum, enabling you to give your freely expressed consent.
Within the purposes related to the performance of the agreement concluded with you and the provision of the services and products purchased by you, your personal data shall be stored for a limited period of time in a single place and in accordance with the legal provisions and conditions, as follows:
The data processed for the purposes provided for by item 2 letters a) –d) are necessary with a view to either the conclusion or the performance of the agreement concluded with you or for the observance of a legal obligation of the Controller, so that your refusal in sending these data to the Controller may determine the impossibility for concluding a contractual relationship for certain services, such as Personnel Fill&Drive service.
In the case where you oppose to the processing of your data for the purpose of obtaining your opinion with regards to the services and products offered or purchased as per item 2) letter e), the contractual relationship between you and the Controller shall not be affected in any way.
In the case where you oppose data processing for statistical purposes as per item 2) letter f), we inform you that this option shall be analyzed and, depending on your particular situation, you will receive a reply as per art. 21 of the General Regulation on data protection, your objection for such operation, not having an impact on the continuance of the contractual relationship with the Controller.
Personal data may be sent by the data subject, the representatives of the data subject, other companies within the same Group as the Controller
Personal data may be accessed by other abroad companies within the KMG International Group, with a view to performing joint projects or auditing the activities of the Group entities, as follows:
In the case where your data shall be transferred to other companies abroad, with a view to performing the purpose of the data processing operation, you will be notified and the guarantees provided for by art. 44-49 of the General Regulation on data protection shall apply.
The data sent to third parties shall be appropriate, relevant and non-excessive by reference to the purpose for which these have been collected and which enable the transfer to a certain third party.
In order to be fully informed, you, as the data subject, have the following rights exclusively in respect of your personal rights, pursuant to the EU General Data Protection Regulation:
(a) Right of access means that you are entitled to obtain Controller’s confirmation whether or not your personal data are processed and, if processed, you may have access to the respective data and to information regarding how such data are processed.
(b) Right to data portability means the right to receive the personal data in a standard, structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the Controller, where such data are processed automatically based on consent pursuant to point (a) of Article 6(1) or on a contract pursuant to point (b) of Article 6(1) of the EU General Data Protection Regulation.
(c) Right to object means your right to object, on grounds relating to your particular situation, to processing of your personal data, including profiling based on those data, where processing is necessary pursuant to points (e) and (f) of Article 6(1), to achieve a legitimate interest of the Controller or for the performance of a task carried out in the public interest.
(d) Right to rectification refers to the right the right to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning you. You have the right to have incomplete personal data completed, including by means of providing a supplementary statement, and your rectified data will be transmitted to each data recipient, unless this proves to be impossible or requires disproportionate efforts.
(e) Right to erasure (“right to be forgotten”) represents the right to request erasure of your personal data, without undue delay, where your personal data are no longer necessary in relation to the purposes for which they are collected or otherwise processed; where you withdraw your consent and there is no other lawful basis for processing; where you object to the processing and there are no prevailing legitimate legal grounds; where your personal data have been processed unlawfully; where your personal data must be erased in order to comply a legal obligation; your personal data have been collected in relation to the provision of information society services. The data erasure will be transmitted to each data recipient, unless this proves to be impossible or requires disproportionate efforts.
(f) Right to restriction of processing refers to the case where the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; where the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; where the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; where the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.
g) Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where the decision is necessary for entering into, or performance of, a contract with you, in which case the processing takes place based on the legal provisions in effect or on your free consent.
h) Right to withdraw your consent. Where your personal data are processed based on your consent, you are entitled to withdraw your consent at any time, without effect on the lawfulness of the processing based on such consent prior to the withdrawal thereof.
Furthermore, as data subject you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing or with any competent courts.
All the above rights may be exercised by means of a written signed and dated request transmitted to the headquarter of the Controller Rompetrol Bulgaria. As of May 25th, 2018, for any questions regarding the processing of your personal data, you may contact the Data Protection Officer at: RPBDPO@rompetrol.com.com or you may call us at the telephone number 003599835710.
Moreover, for any questions regarding the processing of your personal data, you may contact the Data Protection Officer by sending a letter to the address.
In the case where you will have any questions regarding the exercise of your data protection rights, these will be answered by the Controller within 30 days, in accordance with the EU General Data Protection Regulation no. 679/2016.
The Data Controller guarantees that your data are processed for legitimate purposes, and that it implements adequate technical and organizational measures to ensure data integrity and confidentiality pursuant to Articles 25 and 32 of the EU General Data Protection Regulation.