Written Information - Job Applicants at Clients
INFORMATION ON THE PERSONAL DATA PROCESSING OF THE JOB APPLICANTS AT CLIENTS OF BDO AFA
1. Identification of BDO AFA
BDO AFA OOD, having UIC 030278596 and BDO AFA CONSULTANTS OOD, having UIC 121813481 (hereinafter referred to as BDO AFA or the Controller), are processing certain categories of personal data as controllers in connection with your application for filling a vacant job position, announced by a client of theirs – assigner under a concluded contract for intermediary activity in recruitment.
BDO AFA OOD and BDO AFA CONSULTANTS OOD are limited liability companies, registered in the Bulgarian Commercial Register with the Registry Agency, with registered seat and address of management: 38 Oborishte Str, Oborishte Region, 1504 Sofia. BDO AFA OOD and BDO AFA CONSULTANTS OOD are members of BDO International Limited, a UK company limited by guarantee, and form part of the international BDO network of independent member firms.
2. Contact with the Controller
You can contact the Controller directly in one of the following ways:
• In writing at the address specified hereinabove;
• By phone: (+359 2) 943 37 00 or (+359 2) 425 02 00;
• By e-mail address: office@bdoafa.bg;
• By website: www.bdoafa.bg.
3. Processed personal data
The personal data, that the Controller collects and processes, may be (without the list being exhaustive):
• Three names;
• Personal identification number (PIN) /personal number of a foreigner (PNF), date of birth;
• Address, e-mail address, IP address;
• Telephone number;
• Place of birth;
• Marital status;
• Education;
• Labour activity;
• Labour and/or social security length of service;
• Additional qualification; and
• Other data that you have voluntarily decided to provide us with in order to participate in the selection procedure for the announced vacant position at a client of BDO AFA.
4. Legal grounds for the personal data processing by the Controller
The Controller shall process your personal data on the basis of:
1) Art. 6, paragraph 1, letter a) of the General Data Protection Regulation (hereinafter referred to as the GDPR), namely – for inclusion of your data in a database of the Controller for future use and selection of job applicants, only with your explicit consent;
2) Art. 6, paragraph 1, letter b), first proposal of the GDPR, namely – for administration of the contracts concluded with clients of the Controller;
3) Art. 6, paragraph 1, letter b), second proposal of the GDPR, namely – in order to take steps at your request before the conclusion of an employment contract with a client of the Controller;
4) Art. 6, paragraph 1, letter c) of the GDPR, namely – for performance of legal obligations of the Controller, assigned by the applicable legislation;
5) Art. 6, paragraph 1, letter f) of the GDPR, namely – for the protection of the Controller’s legitimate interests regarding possible claims concerning the provided services.
5. Purposes of the personal data processing by the Controller
The specified personal data shall be processed by the Controller for the following purposes:
1) Addressing a proposal and conducting negotiations for concluding a contract for filling the vacant position announced by a client of the Controller;
2) Administration of and communication in connection with the concluded contracts for intermediary activity in recruitment with clients of the Controller;
3) In view of the business interests of the Controller, manifested in the inclusion of the personal data of job applicants in a database of the Controller with the purpose of provision of personnel selection and/or temporary provision of personnel services to future clients, only with the explicit consent of the job applicant;
4) Performance of legal obligations of the Controller, assigned by the Employment Promotion Act;
5) Performance of legal obligations of the Controller upon possible check-ups by state authorities;
6) Protection of the Controller’s legitimate interests upon possible claims by clients and/or third interested parties, concerning the provided services.
6. The specified personal data of yours may be provided to the following categories of recipients:
1) Competent state bodies – in fulfillment of the obligations of the Controller in accordance with the Bulgarian legislation;
2) Various service providers of the Controller – of legal, tax, IT and other services, including providers from the international BDO network.
7. Terms of storage of the provided personal data
1) With respect to the personal data, collected within the selection procedure conducted for a client – 6 (six) months after the completion of the selection procedure (personal data, included in originals or copies of documents provided by the job applicant);
2) With respect to the personal data, collected on the basis of explicit consent for inclusion in a database for future selection procedures for clients – 1 (one) year after the date of granting the consent for their processing by the job applicant.
3) With respect to the personal data, collected in connection with the Controller’s obligations pursuant to the Employment Promotion Act and other applicable normative acts – within the terms for check-ups of the Controller provided for by the legislation in force;
4) With respect to the personal data, collected in connection with the protection of the Controller’s legitimate interests upon possible claims by clients and/or third interested parties, concerning the provided services – within the terms, provided for by the legislation in force for valid submission of such claims.
8. Provision of Personal Data outside of the EU/EEA
The Controller shall not provide the collected personal data to recipients in countries outside of the European Economic Area (EEA).
In the event that necessity of such provision arises in the course of the activity, the Controller shall transfer the personal data to countries outside of the EEA only if its transfer is performed:
1) To a country that is considered as providing an adequate level of protection of personal data, in accordance with a decision by the European Commission; or
2) In accordance with the principle of data transfer after ensuring appropriate safeguards within the meaning of Art. 46 of the GDPR; or
3) According to another approved mechanism for the transfer of personal data under the applicable data protection legislation (incl. if you have granted your explicit consent for the transfer of personal data after you have been informed of the possible risks associated with the transfer).
9. Rights of the data subjects
You have the right at any time to request from the Controller:
9.1. Rectification of the personal data in case the personal data processed is inaccurate. You also have the right to have any incomplete personal data completed, including by adding a declaration thereto.
9.2. Erasure of the personal data in case:
• The personal data is no longer necessary for the purposes, for which it has been collected and processed;
• The personal data is being processed unlawfully;
• The personal data must be deleted in order to comply with a legal obligation of the Controller in accordance with the Bulgarian legislation and/or the legislation of the European Union.
9.3. Restriction of the processing of the personal data in case:
• You dispute the accuracy of the personal data – for a period that allows the Controller to verify the accuracy of the data;
• The processing of personal data is illegal, but you do not wish to have it erased, but instead to limit its use;
• The Controller no longer needs your personal data for the specified purposes, but you request its retention in order to establish, exercise or protect legal claims.
9.4. Objection to the processing of your personal data in case:
• The processing of the personal data is necessary for the legitimate interests of the Controller or a third party;
• The personal data is processed for direct marketing purposes;
• The personal data is being processed for scientific and/or historical research purposes or for statistical purposes.
You can exercise all rights under item 9 above by sending of a written request to the Controller’s address or by sending of an electronic request to the Controller’s e-mail address, specified hereinabove, in item 2 of the present document.
10. Right of appeal to a supervisory authority
You have the right to lodge a complaint with the Bulgarian Personal Data Protection Commission (hereinafter referred to as CPDP) if you believe that your personal data is being processed unlawfully or your rights in relation to your personal data are being violated.
Contacts of the CPDP:
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592,
E-mail: kzld@cpdp.bg,
Website: www.cpdp.bg.
11. Provision of the personal data
The provision of personal data on your part is necessary for participation in the selection procedure for filling up the vacant job position at our client. If you choose not to provide your personal data, you will not have the opportunity to participate in the selection procedure.
12. Usage of a system for automated decision-making
During the processing of your personal data the Controller does not use an automated decision-making system that includes profiling.