Privacy notice

Information about the company that processes your data:

Name: Mladenov Brothers Ltd.

UIC 206197001

Headquarters and address of management:

Country: BULGARIA
District: Shumen, Municipality: Shumen
Locality: Shoumen, p.k. 9700
Blvd. MARITSA str. 24, ent. 3, ap. 43 Phone: +359899137760
Email: mladenovbrothers gmail com 

Website: https : // mladenovbrothers com / 

Information on the competent data protection supervisory authority:

Title: Commission for Personal Data Protection

Headquarters and address of management: Sofia 1592, Blvd. “Prof. Tsvetan Lazarov ”№ 2

Address for correspondence: Sofia 1592, Blvd. “Prof. Tsvetan Lazarov ”№ 2

Phone: 02 915 3 518 

Website:  www.cpdp.bg.

 

Mladenov Brothers Ltd. (hereinafter referred to as the Company or Mladenov Brothers ) operates in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of personal data. individuals in connection with the processing of personal data and on the free movement of such data. This information is intended to inform you about all aspects of the processing of your personal data by the Company and the rights you have in connection with this processing.

Mladenov Brothers Ltd. collects and processes personal data in its capacity of personal data processor by virtue of assignment by personal data controllers, as well as in its capacity of controller in the following operations.

Grounds for collecting, processing and storing your personal data

Art. 1. The company collects and processes your personal data on the basis of art. 6, para. 1, Regulation (EU) 2016/679, and in particular on the basis of the following: 

Explicit consent received from you as a customer; Fulfillment of the obligations of the Company under a contract with you; Compliance with a legal obligation that applies to the Company; Take steps at your request to sign a contract if you are a job applicant.

Goals and principles in the collection, processing and storage of your personal data

Art. 2. (1) We collect and process the personal data that you provide to Mladenov Brothers  for the purposes of concluding contracts with the company, using the company’s website https : // mladenovbrothers . com /, conducting online campaigns for the Company’s clients, including for the following purposes: 

  •  Individualization of a party to the contract;
  •  Accounting purposes;
  •  Statistical objectives;
  •  Protection of information security;
  •  Ensuring the implementation of the contract for the provision of the respective service.
  •  Providing support through the contact form, via email or phone;

(2) We observe the following principles in the processing of your personal data:

 

  •  Legality, good faith and transparency;
  •  Limitation of processing purposes;
  •  Relevance to the purposes of processing and minimizing the data collected;
  •  Accuracy and timeliness of the data;
  •  Limitation of storage in order to achieve the objectives;
  •  Integrity and confidentiality of the processing and ensuring an appropriate level of security of personal data.

(3) In the processing and storage of personal data, the Company may process and store personal data in order to protect its following legitimate interests:

  •  Fulfillment of its obligations to the National Revenue Agency, the Ministry of Interior and other state and municipal bodies.

What types of personal data our company collects, processes and stores

Art. 3. The Company performs the following operations with the personal data provided by you for the following purposes: 

  •  Conclusion and implementation of an employment or civil contract – the purpose of this operation is to conduct a selection for the appointment of employees or persons under a civil contract, the conclusion of the contract and its administration and implementation by the company. Given the small volume of individuals whose data are processed and given the limited amount of personal data that is collected, an impact assessment is not necessary for this operation.
  •  Concluding and executing a contract with a client or partner – the purpose of this operation is concluding and executing a contract with a client / partner and its administration. In some cases, the purpose of the operation may be to protect the legitimate interests of the company in the performance of the contract. Given the limited scope of the personal data collected and the fact that some of it is collected from publicly available sources, an impact assessment is not necessary for this operation.
  •  Organizing and conducting an online campaign for a client – the purpose of the operation is to contact the participant by email for the purposes of awarding prizes or information about the campaign; identification of the data subject as a participant in the event; Providing an opportunity to participate in the online campaign through its functionalities – games, raffles and others; Making an inquiry or request from the individual for the use of products or services and providing feedback to him on this occasion. In its relations with its customers, the Company processes data in its capacity of data processor, which is assigned to it for processing by customers. This also applies in the case of campaigns, landing pages, marketing activities, games, websites, Facebook groups and pages and others. In this case, the Company takes preliminary steps to ensure that your personal data is processed lawfully and in accordance with GDPR requirements and follows the explicit instructions of the client (data controller) in the processing. After the completion of the respective activity, the Company transmits the data to the client (data administrator) and deletes them in its database.
  •  Processing of sent inquiries – the purpose of this operation is to contact the requester by phone or email or through a contact form for the purpose of identifying the data subject as a requester and sending a response to a request. Given the limited scope of the personal data collected, it is not necessary to carry out an impact assessment of the operation.

Art. 4. (1) The company processes the following categories of personal data and information for the following purposes and on the following grounds: 

  •  Data of job candidates: (for the selection of job candidates, we process the personal data that you have sent us in your CV);

o    Purpose for which the data is collected: 1) Individualization of the candidate; 2) Making contact with the candidate and conducting communication; 3) Selection of candidates.

o    Grounds for processing your personal data – The processing is necessary for the performance of a contract to which the data subject is a party, or for taking steps at the request of the data subject before concluding a contract – Art. 6, para. 1, p. (b) GDPR .

  •  Data for concluding a contract with a client or partner – legal entity: (names of the legal representatives of legal entities and names and unique civil number of proxies of legal entities)

o    Purpose for which the data is collected: 1) Identification of the natural person as a legal representative of a legal entity or trader for the purposes of concluding and executing a contract and compiling tax and accounting documents and 2) Identifying the proxy in order to certify his representative power.

o    Grounds for processing your personal data – The processing is necessary for the performance of a contract to which the data subject is a party, or for taking steps at the request of the data subject before concluding a contract – Art. 6, para. 1, p. (b) GDPR .

  •  Data for concluding a contract with a client or partner – natural person: (names, single civil number, address, telephone number, e-mail address)

o    Purpose for which the data is collected: 1) Identification of the person as a partner, 2) Making contact with him and 3) Execution of the contract.

o    Grounds for processing your personal data – The processing is necessary for the performance of a contract to which the data subject is a party, or for taking steps at the request of the data subject before concluding a contract – Art. 6, para. 1, p. (b) GDPR .

  •  Data for sending a response to an inquiry: (names, telephone, e – mail address)

o    Purpose for which the data is collected: 1) Identification of the sender of the inquiry and 2) Sending a response to the inquiry.

o    Grounds for processing your personal data – The data are processed for the purposes of the legitimate interests of the controller – Art. 6, para. 1, p. (f) of the GDPR .

  •  Data usually collected and processed by Mladen Brothers on assignment of clients when conducting online campaigns: names of the individual, email, social network profile, address, telephone.

o    Purpose for which the data is collected: The purposes of processing are determined by the data controller – client of Mladenov Brothers ;

o    Grounds for data processing: The data are processed on the basis of a concluded Contract for personal data processing according to art. 28 of Regulation (EU) 2016/679 between Mladenov Brothers as a processor of personal data and the client of the Company, on whose assignment the online campaign is conducted as a data administrator;

  •  Data: IP address – Improving the security of the service and localization of the interface, statistical and marketing research;

o    Purpose for which the data is collected: The company processes personal data for the IP address of an individual user for the purposes of improving the security of the service and identification of the user as a person using the services from Bulgaria or another country.

o    Grounds for data processing: The IP address is collected without it being possible to identify a specific individual, ie. the data are collected in anonymized form, based on the realization of the legitimate interests of the administrator – Art. 6, para. 1, p. (f) of the GDPR .

o The    collection of this data is necessary for the technical functioning of the site.

(2) Mladenov Brothers does not collect or process personal data, which refer to the following:

reveal racial or ethnic origin; disclose political, religious or philosophical beliefs, or trade union membership; genetic and biometric data, data on health status or data on sexual life or sexual orientation, except for those provided in Art. 9, para. 2 of the GDPR grounds.

(3) The personal data are collected by the Company from the persons to whom they refer or by their legal representatives.

(4) The company does not perform automated decision making with data.

(5) Mladenov Brothers shall not collect or process personal data of persons under 14 years of age except with the explicit consent of their parent or legal representative.

Term of storage of your personal data

Art. 5. (1) Mladenov Brothers Ltd. stores your personal data as a job candidate for a period not longer than 6 months from the moment of final completion of the procedures for recruitment and selection of personnel. After the expiration of the term, Mladenov Brothers Ltd. takes the necessary care to delete and destroy all your data without undue delay or to anonymize them (ie to bring them in a form that does not reveal your identity), unless you give your explicit consent for your data to continue to be stored and processed in the future. 

(2) In case an unapproved candidate for work has provided original or notarized copies of documents certifying physical and mental fitness, qualification degree, length of service or other circumstance, the Company shall return these documents to the candidate within 6 months from the completion of the selection. .

(3) The data of the clients and partners of the company shall be stored for a period of 5 years after termination of the contract or for a longer period, in case of judicial or administrative dispute, in order to protect the legitimate interests of the Company. The data contained in tax and accounting documents shall be stored for the respective term provided by law.

(4) The company shall store the personal data of persons, who have sent an inquiry until the expiration of 1 year from the last realized communication with the inquirer.

(5) The Company notifies you in case the term for data storage needs to be extended in view of fulfillment of a normative obligation or in view of legitimate interests of the Company or otherwise.

Transfer of your personal data for processing

Art. 6. (1) The Company may, at its own discretion, transfer part or all of your personal data to personal data processors for the fulfillment of the processing purposes with which you have agreed, in compliance with the requirements of Regulation (EU) 2016/679 ( GDPR ) . 

(2) The company notifies you in case of intention to transfer part or all of your personal data to third countries or international organizations.

Your rights in the collection, processing and storage of your personal data

Withdrawal of consent for the processing of your personal data

Art. 7 . (1) If you do not wish all or part of your personal data to continue to be processed by the Company for specific or for all purposes of processing, you may at any time withdraw your consent to processing by sending a request in free text.

(2) The administrator may ask you to verify your identity and identity with the person to whom the data relates, by asking you to present an identity document on the spot or in another appropriate manner.

(3) The withdrawal of the consent shall not affect the validity of the processing of the personal data provided by you until the moment of withdrawal of the consent.

(4) The administrator may continue to process part or all of your data if there is a legal obligation for this or for the purposes of protecting its legitimate interests.

Right of access

Art. 8. (1) You have the right to request and receive from the Administrator confirmation whether personal data related to you are processed. 

(2) You have the right to access the data related to you, as well as the information related to the collection, processing and storage of your personal data.

(3) The administrator shall provide you, upon request, with a copy of the processed personal data related to you, in electronic or other appropriate form.

(4) The provision of access to the data is free of charge, but the Administrator reserves the right to impose an administrative fee in case of recurrence or excessiveness of the requests.

Right of correction or completion

Art. 9. You have the right to ask the Administrator to: 

corrects inaccurate personal data related to you; to fill in the incomplete personal data related to you.

Right to delete (“to be forgotten”)

Art. 10. (1) You have the right to request from the Administrator deletion of part or all personal data related to you, and the Administrator has the obligation to delete them without undue delay, when there is any of the following reasons: 

personal data are no longer needed for the purposes for which they were collected or otherwise processed; You withdraw your consent on which the data processing is based and there is no other legal basis for the processing; You object to the processing of personal data related to you, including for the purposes of direct marketing, and there are no legal grounds for processing to take precedence; the personal data has been processed illegally; personal data must be deleted in order to comply with a legal obligation under EU law or the law of a Member State that applies to the Controller; personal data have been collected in connection with the provision of information society services (2) The controller shall not be obliged to delete personal data if it stores and processes them:

to exercise the right to freedom of expression and the right to information, to comply with a legal obligation requiring processing provided for in EU law or the law of a Member State applicable to the Administrator or for the performance of a task in the public interest or in the exercise of of official powers conferred on it, for reasons of public interest in the field of public health, for the purposes of archiving in the public interest, for scientific or historical research or for statistical purposes, for the establishment, exercise or defense of legal claims. ) In case of exercising your right to be forgotten, the Company will delete all your data, except for the following information:

information necessary to certify that your right to be forgotten has been exercised; technical information about the functioning of the website, which information cannot be connected in any way with your identity (4) In order to exercise your right to be forgotten, it is necessary to send a request to the Administrator.

(5) The administrator may request you to certify your identity and identity with the person to whom the data relate.

(6) The administrator shall not delete the data, which he has a legal obligation to store, including for protection on the occasion of court claims against him or proof of his rights.

Right of restriction

Art. 11. You have the right to ask the Administrator to restrict the processing of data related to you when: 

dispute the accuracy of the personal data for a period that allows the Administrator to verify the accuracy of the personal data, the processing is illegal, but you do not want the personal data to be deleted, but only their use to be restricted; The controller no longer needs the personal data for the purposes of processing, but you require them for the establishment, exercise or protection of your legal claims; You have objected to the processing pending verification that the legal grounds of the Administrator take precedence over your interests.

Right of portability

Art. 12. (1) You can at any time download or receive in machine-readable format the data that are stored and processed for you in connection with the use of the services of the Administrator, with a request by email. 

(2) You can ask the Administrator to directly transfer your personal data to an administrator specified by you, when this is technically feasible.

Right to receive information

Art. 13. You can ask the Administrator to inform you about all recipients to whom the personal data for which correction, deletion or restriction of processing has been requested have been disclosed. The administrator may refuse to provide this information if this would be impossible or would require a disproportionate effort. 

Right to object

Art. 14. You may object at any time to the processing of personal data by the Administrator relating to him, including if they are processed for the purposes of profiling or direct marketing. 

Your rights in the event of a breach of the security of your personal data

Art. 15. (1) If the Administrator finds a violation of the security of your personal data, which may pose a high risk to your rights and freedoms, he shall notify you without undue delay of the violation, as well as of the measures that have been taken or are to be taken. . 

(2) The administrator is not obliged to notify you if:

has taken appropriate technical and organizational safeguards against the data affected by the security breach, and has subsequently taken measures to ensure that the breach does not pose a high risk to your rights; notification would require a disproportionate effort.

Persons to whom your personal data is provided

Art. 16. For the purposes of processing your personal data and providing the service in its full functionality and in view of your interests, the Company may provide the data to third parties – processors of personal data. The specified processors of personal data comply with all requirements for legality and security in the processing and storage of your personal data. 

Art. 17. The administrator does not transfer your data to third countries. 

Art. 18. In the event of a breach of your rights under the above or applicable data protection law, you have the right to lodge a complaint with the Data Protection Commission as follows: 

Title: Commission for Personal Data Protection

Headquarters and address of management: Sofia 1592, bul. „Prof. Tsvetan Lazarov ”№ 2

Correspondence address: Sofia 1592, bul. „Prof. Tsvetan Lazarov ”№ 2

Phone: 02 915 3 518 

Website: www . cpdp . bg

Art. 19. You can exercise all your rights regarding the protection of your personal data through the forms attached to this information. Of course, these forms are optional and you can submit your requests in any form that contains a statement to that effect and identifies you as the data owner. 

Art. 20. If the consent relates to a transfer, the controller shall describe the possible risks for the transfer of the data to third countries in the absence of a decision on adequate protection and appropriate means of protection. 

Responsibility of Mladen Brothers when acting as a processor of personal data

Art. 21. (1 ) Mladenov Brothers acts as a processor in relation to the personal data provided by the clients of our partners when organizing online campaigns or events and acts on assignment of the partners, in no way determining the type of data, the ways and the terms for their collection, processing and storage, the purposes and the grounds, nor does it make decisions for the clients, for whom the partner is a controller of personal data. 

(2) The liability of Mladen Brothers is limited to:

compliance with the instructions of the partners to provide the service under the contract with them, as our client, collection and processing of personal data on behalf of the partners and in compliance with our standards for personal data protection.

© 2020 Mldenov Brothers Ltd.

© 2020 Mldenov Brothers Ltd.