English translation for information. In case of discrepancy, the Bulgarian version prevails. Read the Bulgarian original.
Privacy and Personal Data Protection Policy of “INS CENTER” OOD
Introduction
1.1. “INS CENTER” OOD, entered in the Commercial Register kept by the Registry Agency under EIK 207560726, with registered office and address of management at 46 Akad. Stefan Mladenov St., office 13A, floor 6, section A, Sofia, represented by the Manager Ivaylo Vasilev Sotirov, and website https://inscenter.bg/
1.2. “INS CENTER” OOD carries on business as an insurance broker, insurance and reinsurance intermediation, consultancy services in the field of insurance and reinsurance, commercial agency, commission business, trade in goods and services, as well as any other activity not prohibited by law.
1.3. “INS CENTER” OOD is a controller of personal data within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “GDPR”), and of the Personal Data Protection Act (hereinafter referred to as the “PDPA”).
1.4. By this Privacy and Personal Data Protection Policy (hereinafter referred to for short as the “Policy”), “INS CENTER” OOD respects the inviolability of the person and makes efforts to protect against the unlawful processing of the personal data of natural persons. In accordance with Bulgarian legislation, the GDPR and good practice, “INS CENTER” OOD has taken the necessary technical and organisational measures to protect the personal data of natural persons.
Familiarisation with this Policy before using our services is essential, as their provision involves the collection of certain categories of personal data which “INS CENTER” OOD needs in order to carry on its business fully.
Objectives and Scope of the Policy
2.1. By this Privacy and Personal Data Protection Policy, “INS CENTER” OOD aims to inform natural persons of:
2.1.1. the purposes and means of processing personal data;
2.1.2. the recipients or categories of recipients to whom the data may be disclosed;
2.1.3. the legal basis for processing personal data (whether the provision of the data is mandatory or voluntary), as well as the consequences of a refusal to provide them;
2.1.4. information on the right of access and on the right to rectification and erasure of the data collected.
Terms and Definitions
3.1. “Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, psychological, mental, economic, cultural or social identity of that natural person;
3.2. “Special categories of personal data” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation;
3.3. “Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, by automated or other means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
3.4. “Controller” means any natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by EU law or Member State law, the controller or the specific criteria for its nomination may be provided for by Union law or Member State law;
3.5. “Joint controllers”: where two or more controllers jointly determine the purposes and means of processing personal data, they are joint controllers;
3.6. “Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
3.7. “Register” means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;
3.8. “Data subject” means any living natural person who is the subject of the personal data held by the controller;
3.9. “Consent of the data subject” means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
3.10. “Child”: the General Regulation defines a child as anyone under the age of 16, although this may be lowered to 13 by Member State law. The processing of a child’s personal data is lawful only if a parent or guardian has given consent. In such cases, the controller makes reasonable efforts to verify that the holder of parental responsibility for the child has given or authorised consent;
3.11. “Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance of professional duties, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
3.12. “Personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
3.13. “Main establishment”: the controller’s seat in the EU shall be the place where it takes the main decisions as to the purposes and means of its data processing activities. As regards the processor, its main establishment in the EU shall be its central administration. If the controller is based outside the EU, it must appoint a representative in the jurisdiction in which the controller operates to act on behalf of the controller and to deal with the supervisory authorities;
3.14. “Recipient” means a natural or legal person, public authority, agency or other body to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union law or Member State law shall not be regarded as “recipients”; the processing of those data by those public authorities shall comply with the applicable data protection rules according to the purposes of the processing;
3.15. “Third party” means any natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or the processor, are authorised to process the personal data;
3.16. “Discloser of personal data” means a party to a Contract which transfers personal data to a Recipient.
Legal Basis for the Processing of Personal Data, Sources of Personal Data and Period for Which the Collected Personal Data Are Stored
4.1. “INS CENTER” OOD processes personal data on the following grounds:
4.1.1. on the basis of the free, informed and explicit consent of the data subject;
4.1.2. where there is a legal obligation to process the data;
4.1.3. upon the conclusion or performance of a contract, as well as for steps preceding the conclusion of a contract;
4.1.4. where this is necessary to protect the vital interests of the natural person or the legitimate interest of the controller, provided that it does not conflict with the lawful interests of the natural person.
4.2. “INS CENTER” OOD processes personal data provided by employees, clients, principals, suppliers, counterparties and other natural persons to whom the data relate, in connection with carrying out the activities within its scope of business, as well as for the preparation and conclusion of contracts.
4.3. “INS CENTER” OOD also processes personal data which have not been obtained from the natural person to whom they relate but have been provided by a third person in connection with a specific contract/service, and the person who provided those data to “INS CENTER” OOD undertakes:
4.3.1. to provide the third person with details of the controller;
4.3.2. to notify the third person of the purposes, the categories of data provided and the categories of recipients of those data;
4.3.3. to provide information on the right of access to and rectification of the available data of the person to whom they relate.
4.4. Personal data are stored for the period necessary in accordance with the purposes for which they were collected or for a period laid down in a legislative act.
Means, Principles and Purposes of Processing
5.1. “INS CENTER” OOD processes personal data through a set of operations which may be performed by automated or other non-automated means, such as collection, recording, organisation, storage, adaptation or alteration, recovery, consultation, use, disclosure by transmission, dissemination, making available, updating or combination, blocking, erasure and destruction.
5.2. “INS CENTER” OOD processes personal data itself or by engaging processors, determining by a written contract the purposes and the scope of the obligations assigned by the controller to the processor, where there is a relevant legal basis, in accordance with the requirements of the GDPR/PDPA. Processors acting on behalf of “INS CENTER” OOD include, for example, the controller’s employees, whose rights and obligations in connection with the processing of personal data of natural persons are duly regulated in the controller’s internal acts, as well as in the job descriptions of the respective employees. Processors also include third persons outside the controller’s structure who have been entrusted with processing personal data on behalf of the controller.
5.3. The said processing operations are performed in compliance with the following principles:
5.3.1. lawfulness, fairness and transparency of the processing of personal data;
5.3.2. appropriateness of the processing of personal data;
5.3.3. proportionality of the processing of personal data;
5.3.4. up-to-dateness of the personal data processed.
5.4. In connection with the fulfilment of statutory obligations and of pre-contractual and contractual relations, in the course of its business, “INS CENTER” OOD processes personal data of its employees, of representatives and/or employees of its clients and counterparties, and of third persons, for the following purposes:
5.4.1. administration of employment relations: personal data of job applicants and of workers/employees in connection with an existing employment relationship, the processing of data being mainly a consequence of the fulfilment of statutory obligations of the controller of personal data arising from the specific requirements of the legislation governing its business, financial and accounting activities, pension, health and social security activities, human resources management, the automatic exchange of information in the field of taxation and social security, as well as for the protection of the legitimate interests of the controller;
5.4.2. administration of contractual relations: personal data of persons who are representatives and/or employees of counterparties/clients prior to a sale/service contract, and of representatives and/or employees of current counterparties/clients, including where explicit consent has been given or the processing is necessary for the performance of obligations under a contract to which the natural person to whom the data relate is a party, as well as for steps preceding the conclusion of a contract taken at the request of that person, and for the protection of the legitimate interests of the controller.
5.4.3. handling requests and reminders through the website inscenter.bg: for a request for a quote or a policy review — name, company/company ID (EIK), phone, email and the information described by the person; for a reminder of the expiry of a policy, vignette, roadworthiness test or vehicle tax — email, registration number and the relevant dates; such reminders are sent at the person's request and can be stopped with one action from any email, which deletes the record. When requesting a motor third-party liability quote through a reminder, the person may send us a photo of the vehicle registration certificate; the photo is kept in a protected location accessible only to employees of "INS CENTER" OOD, is used solely to prepare the quote and is deleted automatically within 30 days of receipt. Requests are kept for up to 24 months unless a contract has been concluded.
5.4.4. Reminders and service notices under concluded insurance contracts. Where you have taken out insurance through our intermediation, we send you reminders of the upcoming expiry of the policy and of the due dates of instalments, as well as a confirmation when a payment is received. The purpose is that you are not left without insurance cover and that you meet your obligations under the contract on time. Instead of separate reminders, clients that are legal entities may receive one summary email per month listing the policies expiring and the instalments falling due that month.
Channels: email (from reminder@inscenter.bg) and text message (SMS) to the phone number you provided. Each message contains a link to a personal page where you can see your upcoming due dates, pay an instalment online or ask for a renewal. The link is personal and valid for 30 days.
Data processed: name/company name, email address, phone, policy number and type, insurer, insured object (including registration number), due/expiry date, amount due and any discount granted, payment status, your renewal response, the last 4 digits of your personal number/company ID (only to confirm your identity when stopping reminders), and technical security data (IP address and time the personal page was opened).
Legal basis: Article 6(1)(b) of Regulation (EU) 2016/679 – performance of the insurance intermediation contract and of the insurance contract (instalment due dates, payments), and Article 6(1)(f) – our legitimate interest in informing you in good time of expiring cover.
Objection: you can stop the reminders at any time and free of charge – through the "I do not want reminders" link in every email, by replying to the message, at info@inscenter.bg or by phone on 0883 990 906. The objection also applies to SMS messages for the same policies. Stopping the reminders does not affect your insurance and does not delete the data we are required by law to keep.
Online payment: an instalment is paid through the IRIS Pay service – a transfer initiated from your online banking to the account of "INS CENTER" OOD. We do not receive card details or access to your online banking; the service provider gives us only the payment confirmation, the payer's name and IBAN. You can also pay by an ordinary bank transfer.
Retention: reminder data is kept for up to 24 months after the due date and then deleted, unless the law requires a longer period.
Categories of Personal Data Processed
6.1. Categories of personal data which “INS CENTER” OOD processes in carrying on its business:
6.1.1. relating to the physical identity of persons: name, Unified Civil Number (EGN), identity document details (identity card, passport, driving licence), address, telephone, email address, etc.;
6.1.2. relating to economic identity: data necessary for identification for the purposes of insurance, tax and social security legislation in the territory of the jurisdiction where the person is resident for tax and social security purposes, as well as for the performance of the functions of supervisory authorities and/or persons, etc.;
6.1.3. relating to social identity: education, employment.
6.2. Personal data concerning health are processed only in respect of employees, in connection with the fulfilment of statutory obligations of “INS CENTER” OOD in the field of labour and social security legislation, in compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and/or of a legal act of the Republic of Bulgaria governing the matter.
6.3. “INS CENTER” OOD does not process personal data which:
6.3.1. reveal racial or ethnic origin;
6.3.2. reveal political, religious or philosophical beliefs, membership of political parties or organisations, or of associations with religious, philosophical, political or trade union aims;
6.3.3. concern genetic and biometric data processed solely for the purpose of identifying a natural person;
6.3.4. concern the sex life or sexual orientation of the natural person or the human genome.
Registers
7.1. “INS CENTER” OOD maintains the following registers of processing activities:
7.1.1. Personnel
7.1.2. Personnel Recruitment
7.1.3. Clients/Counterparties
7.1.4. Video Surveillance
Rights of Data Subjects
8.1. Right to Information, Access to Personal Data and Data Portability
8.1.1. The data subject has the right to information about the purposes of the processing of his or her personal data, which is provided to him or her when his or her personal data are collected and upon any subsequent change in the purposes of the processing.
8.1.2. The data subject has the right to request confirmation as to whether personal data concerning him or her are being processed and to receive information about the type of personal data processed by “INS CENTER” OOD which concern him or her personally. This information shall be provided irrespective of where the personal data are processed. The data subject may submit a request for access to personal data to the controller, including through the data protection officer of “INS CENTER” OOD.
8.1.3. Where personal data are processed by automated means, the data subject also has the right to receive the personal data concerning him or her which he or she has provided to the controller, in a structured, commonly used, machine-readable and interoperable format, and to transmit them to another controller. This right applies where the data subject has provided the personal data on the basis of his or her own consent or the processing is necessary because of a contractual obligation. The right does not apply where the processing is based on a legal basis other than consent or contract. When this right is exercised, “INS CENTER” OOD assists the data subject by providing him or her, where possible, with the personal data processed about him or her in the format he or she requests, which must be structured, commonly used and machine-readable. This information is provided to the data subject in accordance with the Procedure for Providing Information to the Personal Data Subject adopted by “INS CENTER” OOD.
8.2. Right to Rectification
8.2.1. If the personal data stored are inaccurate or incomplete, the data subject may request that they be rectified.
8.2.2. Data subjects are responsible for providing accurate personal data to the controller. In addition, the data subject should inform the controller of any relevant changes to his or her personal data, such as, but not limited to, changes to the data subject’s address or name.
8.3. Restriction of Processing
8.3.1. At any stage of the processing of personal data, the data subject may request the controller to restrict the use of his or her personal data for some or all of the purposes of the processing to which the data subject has consented.
8.3.2. The data subject has the right to request the controller to restrict the processing of his or her data in the following cases:
8.3.2.1. the accuracy of the personal data is contested by the data subject, for the period necessary to verify the accuracy of the personal data
8.3.2.2. where the processing is unlawful but the data subject does not wish his or her personal data to be erased and requests instead that their use be restricted
8.3.2.3. where the controller no longer needs the personal data for the purposes of the processing, but the data subject requires them for the establishment, exercise or defence of legal claims
8.3.2.4. the data subject has objected to the processing and is awaiting verification by the controller as to whether its legitimate grounds override his or her interests.
8.3.3. Where the processing of data has been restricted under the conditions of item 8.3.2., such data are processed, with the exception of their storage, only with the consent of the data subject or where necessary for the establishment, exercise or defence of legal claims or for the protection of the rights of other natural persons or for important reasons of public interest.
8.4. Refusal of a Request for Information, Rectification or Restriction of the Processing of Personal Data
8.4.1. If a request for information, rectification or restriction of processing is refused, the data subject will be informed of the reason for the respective refusal.
8.4.2. The refusal is made in the form in which the request was submitted by the data subject and shall be reasoned.
8.5. Right to Erasure (“Right to Be Forgotten”)
8.5.1. The data subject has the right to request the controller to erase the personal data concerning him or her, and the controller has the obligation to erase them without undue delay where:
8.5.1.1. the data are no longer necessary for the original purpose and there is no new lawful purpose;
8.5.1.2. the legal basis for the processing is the consent of the data subject, he or she withdraws that consent, and there is no other legal basis for the processing;
8.5.1.3. the data subject objects to the processing of data and there is no other legal basis for the processing;
8.5.1.4. the personal data have been processed unlawfully;
8.5.1.5. the personal data must be erased for compliance with a legal obligation arising from legislation applicable to the controller.
8.5.2. When this right is exercised by the data subject, the controller informs the data subject of how the erasure will affect the relations between them in future.
8.5.3. The right to erasure of the data subject’s data shall not be applied by the company to the extent that the processing is necessary:
8.5.3.1. for the performance by the controller of a legal obligation laid down in legislation which requires the processing of the data;
8.5.3.2. for the establishment, exercise or defence of legal claims of the controller.
8.6. Right to Object
8.6.1. The data subject has the right to object to the processing of personal data concerning him or her. The controller ceases the processing of personal data unless there is a legal basis for continuing the processing.
8.6.2. In addition, every data subject has the right to object if his or her personal data are used for advertising purposes (direct marketing) or for purposes related to market or opinion research. In such a case, the personal data shall be blocked and shall not be used for the respective purposes.
8.7. Withdrawal of Consent to the Processing of Personal Data
8.7.1. The personal data subject has the right to withdraw his or her consent to the processing of his or her personal data at any time by a separate request addressed to the controller.
8.7.2. The controller informs the data subject of how the withdrawal of consent will affect the relations between them in future.
8.8. Requests and Complaints. Legal Remedies of the Data Subject.
8.8.1. The data subject has the right to submit requests and complaints to the controller relating to the processing of his or her personal data, to which the controller responds or provides assistance in accordance with a procedure adopted by it.
8.8.2. In order to exercise these rights, the data subject approaches the controller by means of a request in free text sent to the email address sotirov@inscenter.bg or by a letter sent to the address: Sofia, postcode 1407, Lozenets District, Promishlena Zona Hladilnika residential area, Sofia, 46 Akad. Stefan Mladenov St., office 13A, floor 6, section A, to which the controller responds or provides assistance in accordance with a procedure adopted by it.
8.9. Right to Consent to the Processing of His or Her Personal Data
8.9.1. Consent is deemed to exist only in cases where the data subject has been fully informed of the planned processing and has expressed his or her consent without being subjected to pressure. Consent obtained under pressure or on the basis of misleading information is not a valid basis for the processing of personal data.
8.9.2. Consent cannot be inferred from the absence of a response to a communication sent to the data subject. There must be active communication between the controller and the data subject for consent to exist. The controller should be able to demonstrate that consent has been obtained for the processing activities.
8.9.3. In most cases, consent to the processing of personal data is obtained routinely by the controller using standard consent documents, for example when a new client signs a contract or during the recruitment of new staff.
8.9.4. When processing personal data of children, the Company should obtain authorisation from the persons exercising parental rights (parents, guardians, etc.). This requirement applies to children under the age of 16.
8.10. Right of Representation
8.10.1. The data subject may authorise another person to exercise the rights under items 8.1. to 8.8. of this Policy.
8.10.2. The authorisation shall be express and made in writing.
8.10.3. On each occasion on which the data subject’s rights are exercised, the authorised representative is obliged to present a copy of his or her power of attorney to the controller or to the processor acting on behalf of the controller.
General Principles Relating to the Processing and Security of Personal Data
9.1. Permissibility of Data Processing
9.1.1. The processing of personal data is permissible only if the data subject has consented to it, if there is a legal obligation to process the data, upon the conclusion or performance of a contract, or where it is necessary to protect the vital interests of the natural person or the legitimate interest of the controller, provided that it does not conflict with the lawful interests of the natural person. The permissibility of the processing of personal data is a prerequisite for the transfer of personal data.
9.1.2. Consent shall be declared in writing or by other legally permissible means, and the data subject must be notified in advance of the purpose of the processing and of the possibility of personal data being transferred to third parties. Where consent is included in other declarations, emphasis is placed on the giving of consent so that it is clear to the data subject.
9.2. Intended Purpose
9.2.1. Personal data may be collected only for the exhaustively listed purposes and may not be processed for purposes other than those intended.
9.2.2. The purpose for which the data were collected and processed must be taken into account by the controller in any further processing and storage of such data.
9.2.3. Changes of purpose are permissible only with the consent of the data subject or if this is permitted by the local legislation of the respective country from which the personal data were obtained.
9.3. Data Minimisation
9.3.1. The processing of personal data must be necessary for the intended purpose.
9.3.2. The available options for anonymisation or pseudonymisation of personal data must be used at an early stage, in so far as this is possible and cost-effective for the intended protective purpose.
9.4. Data Quality
9.4.1. Personal data must be factually accurate and, where necessary, kept up to date.
9.4.2. The controller takes appropriate and reasonable measures to rectify or erase inaccurate or incomplete data.
9.5. Data Security
9.5.1. The data controller introduces appropriate technical and organisational measures to ensure the necessary security of the data.
9.5.2. These measures relate in particular to computers (servers and workstations), networks and communication links and applications, and are incorporated into the IT security management system through appropriate measures to protect such data against accidental erasure, unauthorised erasure or loss (information in this regard is set out in Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union).
9.6. Confidentiality of Data Processing
9.6.1. Only authorised personnel who have undertaken to comply with data confidentiality requirements are entitled to participate in the processing of personal data.
9.6.2. Employees are prohibited from using such data for personal purposes or from making them available to unauthorised companies and third parties. In this context, unauthorised also means the use of personal data by employees who do not need access to such data in order to perform their official duties.
9.6.3. The confidentiality obligation continues to apply after the termination of the employment/civil/service relationship with the controller.
Personal Data Security Measures
10.1. “INS CENTER” OOD ensures the security of personal data in accordance with the principles set out in the GDPR/PDPA by taking appropriate and sufficient technical and organisational measures to protect the data against loss, theft and misuse, as well as against unauthorised access, disclosure, alteration or destruction.
10.2. Technical Measures for the Protection of Personal Data
10.2.1. In order to ensure sufficient protection of the personal data processed, “INS CENTER” OOD uses technical measures such as, but not limited to, virus protection, a firewall, an encryption/ciphering option and others.
10.2.2. The controller designates secure areas for the storage of physical media containing personal data, access to which is determined in accordance with procedural rules.
10.2.3. The controller introduces the following measures to restrict access to physical data media: high-security locks on the doors of the controller’s office, as well as on the doors providing access to the building in which the office is located; locking of the cabinets in which paper data media are kept.
10.3. Organisational Measures for the Protection of Personal Data
10.3.1. “INS CENTER” OOD adopts internal rules determining the levels of sensitivity of the personal data (information) processed, on the basis of which separate categories of personal data are created, which are processed for specific purposes. The separate categories of personal data are organised into registers of personal data. The internal rules determine both the procedure for access to these registers and the persons who are entitled to access them and, respectively, to process the personal data stored in them.
10.3.2. The controller adopts procedural rules determining the measures and the procedure for physical access to and protection of personal data, which are mandatory for all employees who process personal data.
10.3.3. All personal data shall be accessible only to those employees/processors whose duties include the processing of the specific data, and access shall take place only in accordance with the adopted internal access control rules.
10.3.4. All employees of the controller are responsible for ensuring security in the storage of the data they process, and for ensuring that the data are stored securely and are not disclosed under any circumstances to third persons, unless the controller has granted such rights to those third persons on the basis of a written contract or a confidentiality clause.
10.3.5. The controller introduces a “clean desk” policy, with which all employees who process personal data familiarise themselves and which they apply. Paper records must not be left where they may be accessible to unauthorised persons and may not be removed from the designated secure premises without express permission. As soon as paper documents are no longer needed for current personal data processing work, they shall be archived in the appropriate manner and, if there are no grounds for archiving them, they shall be destroyed in accordance with a procedure established for that purpose.
10.3.6. Personal data may be erased or destroyed only in accordance with the procedure adopted by the controller. Paper records whose processing period has expired shall be shredded and destroyed as “confidential waste”. The data on the hard disks of unused personal computers must be erased or the disks destroyed in accordance with the established procedures.
10.3.7. The processing of personal data outside the controller’s premises takes place in accordance with the relevant procedural rules and is permissible with the express written consent of the direct superior of the person processing personal data or of the controller.
10.3.8. The controller determines by an internal act the procedure for controlling the segregation of personal data. These rules contain measures to ensure that data collected for different purposes can be processed separately by the authorised employees/persons.
10.3.9. In connection with the measures ensuring the protection of personal information against accidental destruction or loss, the controller determines procedures for restoring the availability of personal data after a physical or technical incident. In order to fulfil these obligations, the controller provides the necessary technical means such as, but not limited to, servers, a computer network, and space in which backup and archive copies are stored.
10.4. Data Protection Officer
10.4.1. “INS CENTER” OOD designates a Data Protection Officer (DPO). The DPO is an employee of the controller. The role of this person is to monitor compliance with this Policy within the controller’s undertaking and to ensure the ability to demonstrate that personal data are processed in accordance with data protection legislation.
10.4.2. The DPO develops and implements the personal data protection requirements in accordance with the provisions of this Policy. The DPO carries out security and risk management with regard to compliance with this Policy.
10.4.3. The DPO is responsible for administering and handling the requests and complaints addressed by data subjects to the controller. The DPO provides the necessary clarifications to the controller’s employees regarding compliance with personal data protection.
10.4.4. The DPO periodically prepares and submits reports to the controller in connection with the application of this Policy and of the statutory provisions governing the protection of personal data, as well as on the conformity of the personal data protection provided within the undertaking with the statutory requirements in this field.
Storage, Destruction and Inventory of Personal Data
11.1. Storage
11.1.1. “INS CENTER” OOD does not store personal data in a form which permits identification of data subjects for longer than is necessary for carrying out the processing to which the personal data subject has consented, having regard to the purposes for which they were collected. Storage of personal data for a longer period is permissible even without the express consent of the data subject if provided for in a legislative act of national law or of European Union law.
11.1.2. The controller may store data for longer than is necessary for carrying out the processing to which consent has been given also in cases where the personal data will be processed for archiving purposes in the public interest, scientific or historical research and statistical purposes, and only subject to the implementation of appropriate technical and organisational measures to safeguard the rights and freedoms of the data subject.
11.1.3. The retention period for each category of personal data organised in a separate register is determined in a procedure adopted by the controller. That procedure sets out the criteria used to determine the retention period, including any legal obligations imposed on the controller regarding the storage of data.
11.1.4. The procedure for the storage and destruction of data, as well as the rules for the destruction of information on physical media, apply in all cases.
11.2. Destruction
11.2.1. Personal data must be destroyed securely, in accordance with the principle of ensuring an appropriate level of security and with the procedure adopted by the controller.
11.2.2. Compliance with the procedure is mandatory in order to ensure protection against unauthorised or unlawful processing and against accidental loss, destruction or damage of the data, by applying appropriate technical or organisational measures.
11.3. Inventory
11.3.1. The controller establishes a data inventory process as part of its approach to addressing the possible risks in processing the personal data collected.
11.3.2. During the data inventory and during their processing, a personal data risk impact assessment is carried out, the methodology and elements of which are governed by the Methodology for Carrying Out a Data Protection Impact Assessment adopted by the controller. The identification of risks under this methodology also applies to processing undertaken by other organisations on behalf of the controller.
11.3.3. The controller manages all risks identified in the impact assessment in order to reduce the likelihood of non-compliance with the rules introduced by the GDPR/PDPA. Where a type of processing, in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller should, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single impact assessment may address a set of similar processing operations that present similar high risks;
11.3.4. Where it is clear as a result of the impact assessment that the controller will process personal data which, owing to a high risk, could cause harm to data subjects, the decision as to whether or not the processing should continue must be referred to the DPO for review;
11.3.5. If the DPO has serious concerns either about the potential harm or danger or about the quantity of the data concerned, the DPO should prepare a report to the supervisory authority, the Commission for Personal Data Protection (CPDP);
11.3.6. The DPO periodically reviews the initially inventoried data and reviews the information entered in the “Record of Processing Activities” in the light of any changes in the controller’s activities.
Transfer of Personal Data to Third Persons
12.1. The controller of personal data has the right to disclose the personal data processed only to the following exhaustively listed categories of persons:
12.1.1. the natural persons to whom the data relate
12.1.2. persons for whom the right of access is provided for in a legislative act, or
12.1.3. persons for whom the right arises by virtue of a contract.
12.2. For the purpose of providing services, the controller discloses information (the necessary personal data) for the performance of a contractual obligation undertaken towards the personal data subject. The controller provides personal data to third parties which provide services on its behalf on the basis of an express written instruction/written contract. Those third parties have no right to use or disclose the data outside the purposes for which they were provided to them, except where this is necessary for performing services on behalf of the controller or for complying with legal requirements. The purposes for processing the personal data provided are expressly defined in the written instruction/written contract on the basis of which the data were provided to the third person. The third persons (processors of personal data) are obliged to ensure the necessary technical and organisational measures for the protection of the personal data provided by the controller, or greater ones;
12.3. The controller discloses the personal data received to its business partners on the basis of an express written instruction or a written contract. Those persons may use the information for the purposes described in this Personal Data Protection Policy. Where the personal data subject has given express consent, the data may be shared with third parties on the basis of a written contract for their own purposes, such as offering products and services that may be of interest to the data subject;
12.4. The controller discloses personal data to competent authorities/persons for the purpose of organising the protection of its lawful rights and interests when initiating order for payment, arbitration, interim protection, claim and other proceedings;
12.5. The controller discloses personal data of data subjects whose personal data it processes where it is obliged to do so by law, by a secondary legislative act, by an international treaty or by an act of European Union law, or in connection with a judicial procedure, in response to a request from state authorities (for example, law enforcement or investigating authorities), or where there is a suspicion of a serious and unlawful infringement of the lawful rights and interests of the holders of rights.
12.6. For the operation of the website, the sending of reminders and the processing of payments we use the following processors, which process the data only on our instructions under a written contract:
– SUPERHOSTING.BG EOOD, company ID 131449987, Sofia – hosting of the website, of the notification portal and of the mailboxes from which the messages are sent;
– LINK Mobility Bulgaria EAD, company ID 131384920 (SMSAPI service) – sending SMS;
– Iris Solutions OOD, company ID 204997709, Sofia, licensed payment institution – IRIS Pay service for payment by bank transfer.
The data is processed in the European Union. If a service provider uses a sub-processor outside the EU/EEA, data is transferred only on the basis of standard contractual clauses adopted by the European Commission (Article 46(2)(c) of Regulation (EU) 2016/679).
Training
13.1. Having regard to the legal framework for the protection of the personal data of natural persons and the enhanced personal data protection measures introduced by the GDPR/PDPA, “INS CENTER” OOD recognises the need to provide initial and subsequent training to its personnel whose duties include the processing of personal data of natural persons on behalf of the controller.
13.2. The initial and subsequent training sessions are intended to inform employees of the established rules and procedures for compliance with this Policy and with the applicable legislation in the field of personal data protection, as well as of other matters relating to the protection of personal data and privacy.
13.3. The training of workers and employees is intended to achieve their awareness of existing or newly arising personal data protection requirements, as well as of the measures taken by the controller in accordance with them.
Duties and Roles
14.1. The Data Protection Officer monitors the proper allocation of employees’ responsibilities in connection with data protection in accordance with the controller’s rules and procedures for the processing of personal data.
14.2. The Data Protection Officer should ensure that all employees who have ongoing duties relating to personal data and processing operations, as well as those with permanent/regular access to personal data, demonstrate compliance with the personal data protection requirements.
14.3. Employees must be able to demonstrate competence in their understanding of the requirements for compliance with the statutory requirements and of how those requirements are applied within the controller’s organisation.
14.4. The Data Protection Officer is responsible for ensuring that those employees update their knowledge and are informed of all matters relating to personal data within the scope of their professional duties, by organising ongoing training whenever there is a change in the legislation on personal data protection or a change in the controller’s scope of business, as well as whenever new personal data protection procedures/measures are introduced by the controller.
14.5. The controller promotes training and awareness-raising measures by providing the necessary resources and facilities for that purpose.
14.6. The Data Protection Officer familiarises employees with, and informs them of, the importance of data protection in the performance of their direct duties and in accordance with their role in the organisation.
14.7. The Data Protection Officer is responsible for making sure that employees understand how and why the rules and procedures for the processing of personal data are applied within the controller’s organisation, and draws up the respective reports/minutes for that purpose.
14.8. The Data Protection Officer develops training and information programmes both for all personnel and for each specific role in the organisation that is relevant to the processing of personal data.
14.9. The Data Protection Officer establishes a system for periodic checking of awareness, as well as for updating employees’ knowledge in connection with changes in data protection requirements.
14.10. Employees receive specific training on the processing of personal data related to their permanent job roles and responsibilities and in accordance with the rules and procedures adopted by the controller.
14.11. Employees receive specific training on all information protection requirements and procedures applicable to data protection and data processing within their day-to-day job roles and responsibilities, including the reporting of personal data breaches.
14.12. Employees receive training on requests and complaints received from data subjects for consideration relating to the protection of personal data and the processing of personal data, in accordance with the controller’s rules and procedures.
14.13. The Data Protection Officer organises training for all responsible persons and employees.
14.14. The Data Protection Officer documents every training session held by preparing for that purpose a list/minutes of those who attended the respective training sessions, held at an appropriate time according to the controller’s activities.
14.15. Initial training of employees is carried out upon the entry into effect of this Policy, as well as upon the recruitment of new employees whose job duties include the processing of personal data.
14.16. Subsequent training is carried out periodically (at least once every 6 months) or upon a change in the legislation on personal data protection/a change in the controller’s scope of business with regard to the processing of personal data, or upon the introduction of new protection measures/procedures.
Final Provisions
15.1. This Policy was adopted by Order of the Manager of “INS CENTER” OOD dated 01.02.2024 and enters into force on the same date.
15.2. Personal data subjects may familiarise themselves with this Policy at the controller’s office located at 46 Akad. Stefan Mladenov St., office 13A, floor 6, section A, Sofia, as well as on the controller’s website https://inscenter.bg/
15.3. The Data Protection Officer of “INS CENTER” OOD is:
15.3.1. name: Ivaylo Sotirov/Manager
15.3.2. telephone: +359 883990906
15.3.3. address: 46 Akad. Stefan Mladenov St., office 13A, floor 6, section A, Sofia
15.3.4. email address: info@inscenter.bg
15.4. Items 5.4.3, 5.4.4 and 12.6 were added/updated on 23.10.2026.
