Privacy Policy for the Protection of Personal Data
1. Introduction
1.1. This Privacy Policy for the Protection of Personal Data describes how “KONTRAX” AD collects, processes, and stores personal data in accordance with the requirements of General Regulation on Data Protection – Regulation (EU) 2016/679, the Law for the Protection of Personal Data of the Republic of Bulgaria, and other Bulgarian or international law.
1.2. “KONTRAX” AD, in its capacity as the administrator of personal data and in compliance with the legislation and good practices, applies the necessary technical and organizational measures for the protection of personal data.
1.3. This policy provides information on how and what type of personal data is collected from “KONTRAX” AD, the purpose of the collection, to whom it may be presented or disclosed, and the basis on which it is protected.
2. Information about “KONTRAX” AD in its capacity as the administrator of personal data
2.1. Regarding the processing of your personal data, you may contact us at the following data for contact:
Identification of the administrator of personal data:
- Name: “KONTRAX” AD
- Country: Bulgaria
- Address: bul. Botevgradsko shose 272
- City: Sofia
- Postal code: 1839
- Telephone: + 359 2 960 97 77
- Email: dpo@kontrax.bg
2.2. In case you believe that “KONTRAX” AD violates your rights related to the processing of your personal data, you have the right to file a complaint with the administrator of personal data.
2.3. In case you wish to file a complaint regarding the processing of your personal data by “KONTRAX” AD or regarding the initial basis on which “KONTRAX” AD has processed your complaint, you have the right to file a complaint with the Commission for the Protection of Personal Data.
You may file a complaint using one of the following initial methods:
- In person, at the address of the Commission for the Protection of Personal Data: bul. “Prof. Tsvetan Lazarov” No 2, 1592 Sofia.
- By mail to: bul. “Prof. Tsvetan Lazarov” No 2, 1592 Sofia, Commission for the Protection of Personal Data.
- By fax: 02 9153525.
- By email to the Commission for the Protection of Personal Data (kzld@cpdp.bg). In this case, your complaint must be in the format of a digital document, signed with an electronic signature (not scanned).
- Through the official website of the Commission for the Protection of Personal Data at address https://cpdp.bg, following the descriptions on the website. In this case, your complaint must be in the format of a digital document, signed with an electronic signature.
Regardless of the chosen method for submitting the complaint, it must contain:
- Information about the complainant – name, address, telephone number, email address.
- Substance of the complaint.
- Other information or documentation, which you consider relevant to the complaint.
- Date and signature (for digital documents – electronic signature, for paper holder – handwritten signature).
3. Legal basis
3.1. This Privacy Policy for the Protection of Personal Data (“the Policy”) is based on General Regulation on Data Protection – Regulation (EU) 2016/679 (“GDPR”), the Law for the Protection of Personal Data and the relevant regulations.
3.2. Bulgarian legislation and GDPR provide rules on how “KONTRAX” AD continues to collect, process, and store personal data.
3.3. To process personal data in accordance with the legal requirements, all personal data is collected and used lawfully, ensuring the necessary security of operations for processing and “KONTRAX” AD prioritizes the necessary measures, so that no processed personal data is improperly disclosed. In accordance with the basic principles, followed by “KONTRAX” AD, your personal data are:
3.3.1. Processed lawfully, fairly, and in a transparent manner in relation to the data subject (“lawfulness, fairness, and transparency”);
3.3.2. Collected for specific, legitimate purposes and not further processed in a manner that is incompatible with those purposes (“purpose limitation”);
3.3.3. Appropriate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (“data minimization”);
3.3.4. Accurate and, where necessary, kept up to date; “KONTRAX” AD is responsible for taking all reasonable steps to ensure that personal data which are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (“accuracy”);
3.3.5. Stored in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (“storage limitation”);
3.3.6. Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures (“integrity and confidentiality”);
3.3.7. “KONTRAX” AD is responsible and capable of demonstrating that it observes the basic principles related to the processing of personal data (“accountability”).
4. Objectives of the policy
4.1. With the adoption and application of this policy on “KONTRAX” AD, in accordance with Regulation (EU) 2016/679 and Bulgarian legislation, the rules for the protection of physical persons related to the processing of personal data, as well as the rules for the freedom of movement of personal data are defined.
4.2. With the adoption and application of this policy on “KONTRAX” AD, in accordance with Regulation (EU) 2016/679 and the Law for the Protection of Personal Data, the basic rights and freedoms of physical persons related to the processing of personal data are protected, especially their right to the protection of personal data.
4.3. With this policy “KONTRAKS” AD aims to guarantee:
4.3.1. Legal processing of personal data, performed by “KONTRAKS” AD;
4.3.2. The rights of natural persons, subjects of personal data;
4.3.3. The compliance with the regulations of “KONTRAKS” AD in the capacity of administrator and/or processor, including:
4.3.3.1. Protection of the data;
4.3.3.2. Registers of the activities on processing;
4.3.3.3. Appropriate technical and organizational measures;
4.3.3.4. Measures for risk assessment for the processing of personal data;
4.3.3.5. Compliance with the requirements for processing personal data in third countries (Processors);
4.3.3.6. The obligations of the persons responsible for processing personal data, and/or persons with access to personal data and working under the supervision of the processors, their liability in case of breach of these obligations.
4.3.4. As a preventive measure for the technical progress, the expenses for the application and the nature, scope, context and purposes of the processing, as well as the risks with different probabilities and severity for the rights and freedoms of natural persons, “KONTRAKS” AD, in the capacity of administrator and/or processor of personal data, applies appropriate technical and organizational measures, ensuring a level of security, corresponding to these risks.
4.3.5. Guarantees compliance with the basic principles for providing personal data to third countries or international organizations outside the EU.
5. Overview
5.1. Definitions:
5.1.1. “personal data” means any information related to an identified natural person or a natural person who can be identified (the “data subject”); a natural person who can be identified is a person who can be identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier or to one or more specific characteristics, physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
5.1.2. “processing” means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
5.2. The policy for the protection of personal data applies to the processing of personal data of employees, who have become known to partners, suppliers, as described in the registers of the activities on processing, established in compliance with Article 30 of Regulation (EU) 2016/679 (the “Registers of the activities on processing”).
6. Purposes of the processing of personal data
6.1. In compliance with the requirements of Section I – Transparency and conditions of GDPR – Regulation (EU) 2016/679, “KONTRAKS” AD provides transparent information, communication and conditions for exercising the rights of data subjects in accordance with Article 12 of the Regulation.
6.2. The objectives for collection and processing, as well as the measures for the protection of personal data in “KONTRAX” AD, are presented in accordance with the “Procedure for the protection of personal data”.
6.3. Within the framework of the use of the website of “KONTRAX” AD, it is possible to process online identifiers (such as IP address, identifiers of “cookies”, identifiers of devices), with the aim:
– ensuring the functionality and security of the website;
– analysis of the use and improvement of user experience;
– measuring the effectiveness of marketing and communication campaigns.
Detailed information regarding the used “cookies” and related technologies is available in the Cookie Policy.
6.4. When the processing of personal data is carried out through “cookies” or related technologies for analytical or marketing purposes, the legal basis for this processing is the explicit consent of the data subject according to Art. 6, para. 1, b. “a” of Regulation (EU) 2016/679. Detailed information regarding the used “cookies” and related technologies is available in the Cookie Policy.
7. Transparency. The rights of individuals whose personal data are processed by “KONTRAX” AD
Information regarding the rights related to the processing of personal data, according to Regulation (EU) 2016/679:
| Right | Basis | Description of the right |
|---|---|---|
| Right of access | Article 15 | The right to obtain confirmation for processing and access to your personal data. |
| Right to rectification | Article 16 | Rectification of inaccurate personal data. |
| Right to erasure | Article 17 | The right to request the erasure of your personal data. |
| Right to restriction of processing | Article 18 | The right to request restriction of the processing of your personal data. |
| Obligation to notify | Article 19 | The right to be informed about any rectification or erasure of personal data or restriction of processing. |
| Right to data portability | Article 20 | The right to receive your personal data. |
| Right to complain and effective judicial protection | Articles 77, 78 and 79 | The right to lodge a complaint with the Commission for the protection of personal data in case of violations of Regulation (EU) 2016/679 from April 27, 2016, and the right to effective protection against the Commission for the protection of personal data, the administrator or processor of your personal data. |
| Right to compensation | Article 82 | The right to compensation for material or non-material damages, incurred as a result of violations of Regulation (EU) 2016/679. |
8. Providing personal data to third countries or international organizations
8.1. The provision of personal data, which are processed or are intended for processing after their provision to a third country or international organization outside the EU, is carried out under “KONTRAKS” AD except under the conditions of the General Regulation for the protection of data – Regulation (EU) 2016/679, specified in Chapter V of the Regulation. It is possible to provide personal data to third countries (including the United States) when using services and technologies of third countries, such as analytical and marketing instruments, while observing the guarantees provided in Chapter V of Regulation (EU) 2016/679.
8.2. “KONTRAKS” AD applies all provisions of the Regulation from the beginning, which does not compromise the necessary level of protection for physical persons, provided by the Regulation.
9. Violations and notification of violations
9.1. Violations of personal data indicate violations of security, leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to personal data, provided, stored or processed in another way from “KONTRAKS” AD.
9.2. In the case of a violation of the security of personal data, where there is a likelihood of creating a risk for the rights and freedoms of physical persons, without undue delay and when it is essential – no later than 72 hours after the establishment of the breach, “KONTRAKS” AD notifies the Commission for the protection of personal data about the violation.
9.3. In the case where a specific violation presents a high risk for physical persons, “KONTRAKS” AD prioritizes actions in accordance with “The Procedure for the Protection of Personal Data”.
9.4. “KONTRAKS” AD prioritizes actions in accordance with “The Procedure for the Protection of Personal Data”.
10. Changes in the Privacy Policy
“KONTRAKS” AD has the right to update, as well as amend, the privacy policy for the protection of personal data at any time, when the circumstances require it.
The current version of this document is valid until 01.01.2026.