PRIVACY POLICY (PRIVACY NOTICE)
The right to privacy of personal data is a top priority of the State Reserve and Wartime Stocks Agency (SRWSA), which is seriously committed to the protection and secure storage of the personal data of contractors and partners, as well as visitors and other individuals related to the performance of the Agency's statutory tasks. The DARD processes personal data of individuals ("data subjects") in strict compliance with Regulation (EU) 2016/679 (General Data Protection Regulation), the Data Protection Act and the Agency's Data Protection Policy.
This privacy policy is intended to explain to you how and why we process your personal data.
Under the General Data Protection Regulation, personal data is any information relating to an individual by which that individual can be directly, or indirectly, identified.
Processing of personal data is any operation, or set of operations, which may be performed upon personal data, whether or not by automatic means.
Who processes and is responsible for your personal data?
The controller of personal data is the State Reserve and Wartime Stocks State Agency, a legal entity on budgetary dependence, with its address in the 3 Moskovska str.,1000 Sofia, email:[email protected], tel. 02 9210 201, fax: 02 987 79 77
The State Reserve and War-Time Stocks Agency is a specialised body of the Council of Ministers for the implementation of the state policy in the field of accumulation, storage and use of the state reserves and war-time stocks of the country in accordance with the interests of national security. The Agency also performs the functions of a central structure for the management of emergency stocks of petroleum and petroleum products and earmarked stocks of petroleum products.
Principles we follow and are guided by:
Your personal data is not collected on purpose and without restriction. The MRVWD strictly adheres to the basic principles established as mandatory in the processing of personal data: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability.
Purposes of processing
YES DRWV collects personal data only for specific and legitimate purposes and does not further process it in a way incompatible with those purposes. The SAHRD processes personal data for the following purposes:
- The performance of the legal obligations of the SA RDVVZ in the field of management of state reserves and wartime stocks and management of emergency stocks, in accordance with labour, accounting, tax and social security legislation, or other legal obligations of the agency, as well as other regulations applicable to its activities.
- Compliance with the orders of the competent public authorities.
- Ensuring the security of the Agency's employees, visitors and property by means of CCTV, physical security, access control and registration.
- Ensuring the proper functioning, maintenance and security of the website and IT systems of the SA RDVV.
- Enforcing and protecting the rights and legitimate interests of the SA RDVVZ, including through legal proceedings.
- Concluding contracts and pre-contractual relations including public procurement.
- Recruitment of staff under service and employment relationships.
Legal grounds for processing
The HWRC SA processes personal data of data subjects on the basis of Article 6(1)(b), (c) and (e) of the General Regulation, namely processing is necessary for the performance of a contract, including pre-contractual relations prior to its conclusion, for compliance with a legal obligation to which the controller is subject; for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Mandatory and voluntary nature of the provision of personal data
The personal data of the data subjects shall be provided to the State Data Protection Agency voluntarily by the data subjects themselves and shall be collected by the controller in fulfilment of a legal obligation, in connection with the conclusion and performance of a contract, consideration of proposals and signals, provision of an administrative service, recruitment of staff, etc., in accordance with the provisions of the legislation in force in the Republic of Bulgaria. In the event that the person does not provide the required information, including the required personal data, the State Agency for the Protection of Human Rights and Fundamental Freedoms will not be able to conclude a contract with him/her, respectively will not be able to provide the requested administrative service.
The personal data of visitors to the offices and subdivisions of the SA RDVVZ shall be provided voluntarily by the persons in compliance with the regulatory requirements of the Private Security Activities Act.
To whom is the personal data transmitted or disclosed?
- Competent authorities who, by virtue of a legal act, have the power to require the provision of information by the SA PRWMD, including personal data - court, investigative authorities (police, investigative, prosecutorial authorities), supervisory/regulatory authorities.
- It is possible, where necessary or appropriate, that your personal data may be provided for national security purposes or where issues of public importance arise.
- Other competent public authorities in the performance of an obligation imposed by law.
- Processors of personal data in order to maintain the agency's IT systems, deliver services, provide security, CCTV, etc. In these cases, the relationship between the SAHRD and the processor shall be governed by a contract or other legal instrument which provides for appropriate measures to ensure the security of personal data.
Storage period of personal data
The duration of storage of personal data depends on the purposes of the processing for which they were collected. Your personal data will be stored with us for no longer than the period provided for in the relevant legal act.
Security of personal data
The DPRWH implements all appropriate technical and organisational measures to ensure the security of personal data, including minimising the amount of personal data processed necessary to achieve the relevant purposes; promptly restoring the availability of and access to personal data in the event of a physical or technical incident; making employees explicitly liable for confidentiality; and security and CCTV for safeguarding purposes.
Rights of data subjects
Any natural person whose data is processed by the HWRCS has the following rights:
- The right to access his or her personal data, including to obtain a copy of it;
- the right to rectification or completion of inaccurate or incomplete personal data;
- the right to erasure of personal data which are processed without a legal basis;
- the right to restriction of processing - in the event of a legal dispute between the HWFD and the individual pending its resolution or for the establishment, exercise or defence of legal claims;
- the right to object - at any time and on grounds relating to the individual's particular situation, provided that there are no compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or legal process;
- the right to data portability - only if the personal data are processed automatically on the basis of consent or contract;
- the right not to be subject to a wholly automated decision involving profiling which produces legal effects concerning the data subject or significantly affects him or her.
In accordance with the Personal Data Protection Act, the above rights may be exercised by submitting a written application on the spot to the SA DRVWH. An application may also be made electronically under the Electronic Document and Electronic Certification Services Act. The application shall be made in person by the data subject or by a person expressly authorised by the data subject. The State Data Protection Inspectorate shall decide on the data subject's request within 30 days of its submission. Where the data subject's requests in relation to the exercise of the above rights are manifestly unfounded or excessive, the HIEAA may charge a fee or refuse to act on the request.
Protection of data subjects' rights
In accordance with the Data Protection Act and Regulation (EU) 2016/679, any individual who considers that his or her right to the protection of personal data has been infringed may lodge a complaint with the Data Protection Commission at the following address. 1592 Sofia Blvd. "1595, Proff. Tsvetan Lazarov"
Additional information
For more information on the data protection policy of the State Agency for the Protection of Personal Data, alerts, suggestions and other questions, please visit the State Agency for the Protection of Personal Data webpage http://www.statereserve.bg or contact us at tel. 02 9210 201 or e-mail [email protected]
Data Protection Officer contact details:
Address: 3 Moskovska str., 1000 Sofia
Name: Veselka Ivanova
Phone: (02) 9210 267
e-mail: [email protected]
Update and changes to the privacy policy
In order to apply the most up-to-date protection measures and to comply with the current legislation, we will regularly update this Privacy Policy. If any changes we make are material, we may post a notice of the changes on our website or notify you by other appropriate means.
Last updated: 07.11.2018