Written Information - Job Applicants
INFORMATION ON THE PERSONAL DATA PROCESSING OF THE JOB APPLICANTS IN BDO AFA
1. Identification of BDO AFA
BDO AFA OOD, having UIC 030278596 and BDO AFA CONSULTANTS OOD, having UIC 121813481 (hereinafter referred to as BDO AFA or the Controller), are processing certain categories of personal data in their capacity as employers, performing selection procedures of job applicants with respect to their hiring under an employment contract with the respective company.
BDO AFA OOD and BDO AFA CONSULTANTS OOD are limited liability companies, registered in the Bulgarian Commercial Register with the Registry Agency, with registered seat and address of management: 38 Oborishte Str, Oborishte Region, 1504 Sofia. BDO AFA OOD and BDO AFA CONSULTANTS OOD are members of BDO International Limited, a UK company limited by guarantee, and form part of the international BDO network of independent member firms.
2. Contact with the Controller
You can contact the Controller directly in one of the following ways:
• In writing at the address specified hereinabove;
• By phone: (+359 2) 943 37 00 or (+359 2) 425 02 00;
• By e-mail address: office@bdoafa.bg;
• By website: www.bdoafa.bg.
3. Processed personal data
The personal data, that the Controller collects and processes, may be (without the list being exhaustive):
• Three names;
• PIN/personal number of a foreigner (PNF), date of birth;
• Address, e-mail address, IP address;
• Telephone number;
• Education;
• Labour activity;
• Additional qualification; and
• Other data that you have voluntarily decided to provide us with in order to participate in the selection procedure for the announced vacant position.
4. Legal grounds for the personal data processing by the Controller
The Controller shall process your personal data on the basis of:
1) Art. 6, paragraph 1, letter a) of the General Data Protection Regulation (hereinafter referred to as the GDPR), namely – for inclusion of your data in a database of the Controller for future use and selection of job applicants, only with your explicit consent;
2) Art. 6, paragraph 1, letter b), second proposal of the GDPR, namely – in order to take steps at your request before the conclusion of an employment contract with the Controller;
3) Art. 6, paragraph 1, letter f) of the GDPR, namely – for the protection of the Controller’s legitimate interests in possible proceedings pursuant to the Protection Against Discrimination Act (hereinafter referred to as PADA).
5. Purposes of the personal data processing by the Controller
The specified personal data shall be processed by the Controller for the following purposes:
1) Examining your application within the selection procedure for filling up the job position, announced as vacant by the Controller;
2) Carrying out personnel recruitment and selection procedures for BDO AFA;
3) In view of the business interests of the Controller, manifested in the inclusion of the personal data of job applicants in a database of the Controller for future use and selection of job applicants, only with the explicit consent of the job applicant;
4) Protection of the Controller’s legitimate interests in possible proceedings pursuant to the PADA.
6. The specified personal data of yours may be provided to the following categories of recipients:
1) Competent state bodies – in fulfillment of the obligations of the Controller in accordance with the Bulgarian legislation;
2) Various service providers of the Controller – legal, tax, IT and other services, including providers from the international BDO network.
7. Terms of storage of the provided personal data
1) With respect to the personal data, collected within the selection procedure – 6 (six) months after the completion of the selection procedure (personal data, included in originals or copies of documents provided by the job applicant);
2) With respect to the personal data, collected in connection with the Controller’s obligations pursuant to PADA – 3 (three) years after the completion of the selection procedure (personal data, included in internal documents created during the carrying out of the selection procedures);
3) With respect to the other personal data, collected on the basis of explicit consent for inclusion in a database for future selection – 1 (one) year after the date of granting the consent for their processing by the job applicant.
8. Provision of Personal Data outside of the EU/EEA
The personal data shall not be transferred to any countries outside of the European Union and/or the European Economic Area, unless their transfer is performed:
1) In any country that is considered as providing an adequate level of protection of personal data, in accordance with a decision by the European Commission; or
2) In accordance with the principle of data transfer after ensuring appropriate safeguards within the meaning of Art. 46 of the GDPR; or
3) According to another approved mechanism for the transfer of personal data under the applicable data protection legislation.
9. Rights of the data subjects
You have the right at any time to request from the Controller:
9.1. Rectification of the personal data in case the personal data processed is inaccurate. You also have the right to have any incomplete personal data completed, including by adding a declaration thereto.
9.2. Erasure of the personal data in case:
• The personal data is no longer necessary for the purposes, for which it has been collected and processed;
• The personal data is being processed unlawfully;
• The personal data must be deleted in order to comply with a legal obligation of the Controller in accordance with the Bulgarian legislation and/or the legislation of the European Union.
9.3. Restriction of the processing of the personal data in case:
• You dispute the accuracy of the personal data – for a period that allows the Controller to verify the accuracy of the data;
• The processing of personal data is illegal, but you do not wish to have it erased, but instead to limit its use;
• The Controller no longer needs your personal data for the specified purposes, but you request its retention in order to establish, exercise or protect legal claims.
9.4. Objection to the processing of your personal data in case:
• The processing of the personal data is necessary for the legitimate interests of the Controller or a third party;
• The personal data is processed for direct marketing purposes;
• The personal data is being processed for scientific and/or historical research purposes or for statistical purposes.
You can exercise all rights under item 9 by sending of a written request to the Controller’s address or by sending of an electronic request to the Controller’s e-mail address, specified hereinabove, in item 2 of the present document.
10. Right of appeal to a supervisory authority
You have the right to lodge a complaint with the Bulgarian Personal Data Protection Commission (hereinafter referred to as CPDP) if you believe that your personal data is being processed unlawfully or your rights in relation to your personal data are being violated.
Contacts of the CPDP:
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592,
E-mail: kzld@cpdp.bg,
Website: www.cpdp.bg.
11. Provision of the personal data
The provision of personal data on your part is necessary for participation in the selection procedure for filling up the vacant job position. If you choose not to provide your personal data, you will not have the opportunity to participate in the selection procedure.
12. Usage of a system for automated decision-making
During the processing of your personal data the Controller does not use an automated decision-making system that includes profiling.