Personal Data Protection Policy when using the website and the internet resources of „Evrotrust Technologies“ AD

We at „Evrotrust Technologies“ AD (Evrotrust/ Evrotrust/we) are aware of our responsibility to you – our clients, partners and those who use our website and internet resources, to provide you not only with quality services, but also to protect your information in the course of our relationship.

With this Personal Data Protection Policy when using the website and the Internet resources of „Evrotrust Technologies“ AD (the Policy), we would like to inform you about how we process and protect your personal data when you use the information services and resources available on our website https://www.evrotrust.com/ (the Website) and on our corporate profiles in various social networks. Please read this Policy carefully to understand how we collect, store, and otherwise process your personal data in this context and what your rights in relation to this processing are.

The Privacy policy applicable to the trust, information, cryptographic and other services provided by “Evrotrust Technologies” AD available [here] is applicable with respect to the personal data we process in relation to the provision of our trust services and other services, as well as regarding the relationships we have with our business partners.

Our Privacy policy applicable to the services provided by “Evrotrust Technologies” AD through Evrotrust mobile application available [here] is applicable with respect to the personal data we process in connection with the provision of our trust and other services available through Evrotrust application.

With regards to the processing of personal data of persons who apply for a job with us, this Policy applies in addition to our Privacy Notice for Job Applicants and Participants in Recruitment Processes available on the Website[here].

This Policy also does not apply to the processing of personal data performed by various third parties to whose websites/platforms/applications, etc. you have been redirected from the Website. Such third parties should have their own privacy policies available on their websites/platforms/applications, etc., which we recommend that you read before using the respective service/resource.

I. Who are we?‍

‍We are “Evrotrust Technologies” AD, UIC 203397356, having its seat and registered address at Sofia 1113, Izgrev, Iztok, 2 Nikolay Haytov Str., entr. E, fl. 2, Bulgaria, and address for correspondence at Sofia 1766, Mladost, 251 D Okolovrasten Pat Blvd., “MM BUSINESS CENTER“, fl. 5, Bulgaria, with e-mail address: dpo@evrotrust.com.

As a personal data controller within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the Regulation/GDPR), we process your personal data in accordance with applicable law and the rules and principles set out in this Policy.

II. Persons whose data we process

In relation to the management and maintenance of our Website, the provision of information resources on it and on our corporate social media profiles, and the communication with anyone who comes into contact with us, we may process information about the following categories of individuals (Data Subjects/You):

• Visitors to the Website and users of information resources available on the Website;
• Persons who send us inquiries, requests, business proposals, signals, complaints or otherwise enter into correspondence with us regardless of the communication channel used (mail, e-mail, telephone, etc.);
• Third parties whose information is contained in enquiries, requests, business proposals, signals, complaints or other correspondence addressed to us, regardless of the communication channel used;
• Persons who have subscribed to receive certain communications sent by us (marketing messages, newsletters, etc.);
• Persons who apply for a job with us using the dedicated form on the Website;
• Persons who interact with our corporate profiles/pages on various social networks.‍ 

III. Categories of personal data we process

‍‍1. Data related to correspondence or other type of interaction you have with us: 

When you contact us with inquiries, requests or other communication, incl. via the contact form on the Website, when you apply for a job with us using the special form on the Website, as well as when you interact with our corporate profile or page in various social networks or thorough another communication channel (mail, e-mail, telephone, etc.), we may process the following types of personal data relating to you:

a) Data related to correspondence/ communication with us via the Website contact form, by e-mail, telephone, at our contact address, etc.

When you contact us, we may process the following types of data relating to you: name and surname; telephone; e-mail address; postal address, city/town; occupation; institution/ organisation you represent/ you are employed at; information on the way you have found about us and our services; unstructured information you provide in your message/inquiry; information about third parties contained in the messages/inquiries/ requests you have sent us; information contained in subsequent correspondence/ communication between you and Evrotrust; data related to the receipt of initial and subsequent correspondence with us, such as time log (date / time) and source (IP address) of the respective correspondence, channel through which the correspondence was made, etc.; additional information collected or created in relation to the processing, status and final outcome of the relevant correspondence.

When the communication addressed to or made with us via the Website contact form, by e-mail or telephone, contains data and information about you and/or third parties which data and information are provided to us in the context of an inquiry for trust services and other services or other type of cooperation related to the professional activity of Evrotrust, we will process such data in accordance with the rules and principles set out in this Policy, as well as in our Privacy policy applicable to the trust, information, cryptographic and other services provided by “Evrotrust Technologies” AD available [here].

b) Data related to the submission of a job application

In the ‘Careers’ section, which is part of the Website resources, you have the opportunity to find out about the specific open positions at Evrotrust, as well as to apply for a certain position. When applying for an open position, we may process the following types of data relating to you: names; e-mail address; telephone; position applied for; unstructured information which you would like to provide us with in relation to your application; information and data contained in documents attached to your application (e.g., CV, cover letter, etc.); information related to the processing of your application and the outcome. 

‍We will process this data in accordance with the rules and principles set out in our Privacy Notice for Job Applicants and Participants in Recruitment Processes, available on the Website. For more information on the purposes, legal grounds and terms applicable to the processing of this data, please refer to the said Notice.

‍c) Data related to any interaction on your part with our corporate profile or page in various social networks

In order to promote our activity and the services we provide, we may maintain corporate profiles/ pages in various social networks (such as Facebook, Twitter, LinkedIn, etc.). When you interact with our corporate profiles/ pages in such social networks (e.g., by liking, sharing or other forms of interaction with the content published by us – depending on the functionalities of the respective social network), we may receive information about you in accordance with your privacy settings in the respective social network, such as: names; username; information from your profile on the relevant social network (e.g., photo, gender, age or age range, language, country, list of friends, list of liked/ followed pages, etc.); other information you have given us access to and which the social network you use provides us with; information contained in and related to the initial and subsequent communication with us through the functionalities of the relevant social network.

The social networks referred to above are not maintained by us and the processing of personal data by them is not under our control. The persons maintaining the relevant social networks have different rules and procedures for the protection of your personal data, including the collection of information through tools such as cookies, therefore, we recommend that you carefully read their rules and policies.

d) Data related to receiving marketing messages, newsletters, etc. sent by us

When you subscribe to receive any type of communication/correspondence sent by us (e.g., marketing messages, newsletters, etc.), we will process the data provided by you in relation to this subscription. Such data may include: names; e-mail address; other data related to your occupation, profession or interests (if applicable); your preferences regarding the frequency of receiving the relevant communication and its content, etc. The specific types of data we may process in relation to sending such messages to you will always be clearly indicated in the relevant form through which you subscribe.

Newsletter and marketing messages subscription

Specifically, by filling in your email address in the relevant field in a registration form on our Website, or, respectively, by filling in your email address and ticking the box to agree to receive marketing messages, you grant your consent to us to send you our newsletter, or, respectively, marketing messages, including information and news about Evrotrust products and services, to this email address. In this case, along with your email address information, we also keep information proving the fact that you have subscribed (log files - IP address and time at which the subscription statement was made). You can unsubscribe/terminate these subscriptions at any time via the relevant links in the messages we will send you or by contacting us.

2. Data automatically collected or generated in relation to the use of the Website

Unless explicitly stated otherwise, access to the Website is free and no registration is required to use the information resources available on it. However, when you use the Website, certain information which is technologically necessary for its operation and which does not allow direct identification of the visitors, is automatically collected and processed. This information includes the following data: date and time of access to the Website; IP address from which the connection was made; server and system logs (to detect technical problems and/ or detect malicious activity); where applicable, logs for making legal statements (such as acknowledgement of having read a data protection policy, newsletter and/or marketing messages subscription, etc.).

In connection with the possibility to use the Website to log in and access by Users of Evrotrust’s trust services to their personal online portal (Portal) to submit documents for signature through Evrotrust application and access and download submitted and signed files, Evrotrust also stores additional data necessary to ensure this access, such as access logs, logs of actions performed through the Portal, encrypted forms of log-in credentials for the Portal for the purpose of comparison with data entered by the User, and other necessary information.

‍3. “Cookies” and similar technologies

In relation to the management and maintenance of the Website, we may use cookies and other similar technologies, e.g., web beacons (beacons/ web bugs/ pixel tags/ clear GIF technologies) to ensure its reliable and efficient operation. You can find out more about the different types of cookies we use, as well as about your options for managing cookies by reading our Cookies Policy of „Evrotrust Technologies“ AD (Cookies Policy) published on the Website and accessible from the footer of each of its web pages. The Cookie Policy constitutes an integral part of this Policy, unless expressly stated otherwise.

IV. Voluntary/mandatory nature of the provision of personal data

Where we ask you to provide us with your personal data, for example, through the contact form on the Website, we clearly indicate the mandatory or voluntary nature of the provision of personal data relating to you. Providing your data is entirely at your discretion, but your refusal to provide data marked as mandatory may result, as the case may be, in us not being able to contact you (e.g. if we do not have contact details to send a response to), to process and respond adequately to your inquiry, etc.

V. Purposes and legal grounds for processing personal data

Evrotrust collects, stores and processes the information described in item III above for the purposes set out in this Policy and in our General Terms and Conditions for the Use of „Evrotrust Technologies“ AD Website available [here]. Depending on the legal basis for processing, these purposes may be:

(1) Purposes necessary for compliance with legal obligations of Evrotrust;

(2) Purposes related to steps taken by you before entering into a contract with you;

(3) Purposes related to the legitimate interests of Evrotrust or of third parties;

(4) Purposes for which you have given your consent.

1. The purposes for processing personal data by Evrotrust related to compliance with legal obligations, include:

- Where applicable, carrying out activities to comply with legal obligations related to providing information to competent state and judicial authorities and to assisting inspections by competent authorities;

- Handling inquiries, requests, incl. for the exercise of rights, etc., which are addressed to us, incl. the preparation of responses thereto;

- Where applicable, documenting electronic statements addressed to Evrotrust and related to compliance with our legal obligations, such as acknowledgement of having read the privacy policies, cookie policy etc.

For the purposes listed above, we may process some or all of the personal data referred to in item III, 1, 2 and 3 of this Policy.

2. The purposes related to the steps you have taken before entering into a contract with you include: 

- Initial review of inquiries for services and assistance and contacting you (in case you are acting as an individual) in relation to the opportunity to provide you with the services you need, as well as in relation to the manner of proceeding the communication under your inquiry. Where such an inquiry is made on behalf of an entity, the processing of the data included in or relating to that inquiry constitutes our legitimate interest, namely to provide our services, and in those cases we process that data on the basis of legitimate interest.

‍For the purposes listed above, we may process some or all of the personal data referred to in item III, 1 (a) and 2 of this Policy.

‍3. The purposes for processing personal data related to the legitimate interest of Evrotrust to maintain and improve the quality of information services and resources provided on the Website, include:

- Administering, managing, analyzing the effectiveness and quality control of the information services and resources available on the Website;

- Ensuring the normal functioning and use of the Website and the services and resources available on it;

- Performing activities for maintenance and administration of the Website, including, but not limited to, prevention of cyber-attacks and other malicious activities;

For the purposes listed above, we may process some or all of the personal data referred to in items III, 2 and 3 of this Policy.

4. The purposes for processing personal data related to the legitimate interest of Evrotrust to communicate with you, include:

- Providing an opportunity for correspondence/ communication with us (incl. the opportunity for online inquiries for services and assistance) through various channels;

- Providing an opportunity for interactions and communication with us through our corporate profiles/ pages in various social networks;

- Timely processing and providing a response to the initially received correspondence, as well as to the subsequent one;

- Ensuring internal accountability, organizing the work and distributing the correspondence to the relevant persons in charge in Evrotrust.

For the purposes listed above, we may process some or all of the personal data referred to in item III, 1 (a), (b) and (c) of this Policy.

5. The purposes for processing personal data related to the legitimate interest of Evrotrust and/ or third parties for the exercise and protection of legal rights and interests, include:

‍- Exercise and protection of the legal rights and interests of Evrotrust, incl. establishment, exercise or defence of legal claims, including in legal proceedings (e.g., by filing and defending against filed complaints, signals, etc. to the competent state and judicial authorities);

- Assisting in the exercise and protection of the legal rights and interests of third parties (Evrotrust’s employees, visitors to the Website, processing personal data etc.), including in legal proceedings;

- Carrying out activities for administration and servicing of correspondence containing complaints, signals, etc.

For the purposes listed above, we may process some or all of the personal data referred to in item III, 1, 2 and 3 of this Policy.

6. The purposes for which personal data are processed on the basis of your consent include:

When we process your personal data on the basis of consent, the purposes for which we perform this processing are explicitly stated in the relevant forms by which you provide us with your consent for the respective processing (e.g., when subscribing to a newsletter, marketing messages, etc.). We will only process personal data which you have provided to us in the relevant consent form and only for the purposes specified in this form.   

VI. Categories of recipients of personal data

When we transfer your personal data to other persons, we do it in strict compliance with the terms of this Policy and our internal rules and policies, as well as in compliance with the requirements of the applicable personal data protection legislation. The categories of recipients we may transfer your personal data to, include:

Our subcontractors – Evrotrust uses carefully selected partners, subcontractors and service providers who may process your personal data on our behalf as processors. Such persons include persons providing services for the development and maintenance of the functionalities of the Website, specialized data centers for the colocation of server and network equipment, providers of cloud systems and services, etc. We disclose data to our subcontractors only to the extent necessary for the performance of the work assigned, while our subcontractors are obliged under a contract concluded with us to process such data strictly in accordance with our instructions and only for the purposes specified in the relevant contract.

Our business partners and service providers – other personal data controllers (e.g. companies providing telecommunication, transportation or courier services, etc.), as well as persons whose cooperation is necessary for the purposes of implementing and protecting the legitimate interests of Evrotrust or third parties (Website users, our employees and subcontractors or service providers, etc.) such as private and public bailiffs, notaries, etc. When dealing with such persons we require them to strictly comply with the applicable data protection laws and regulations.

Competent state, municipal and judicial authorities, where necessary to comply with our legal obligation or to protect the rights or legitimate interests of „Evrotrust Technologies“ AD or third parties.

In other cases provided for by law.

‍VII. Transfer of personal data outside the European union (EU)/ European Economic Area (EEA) ‍

Evrotrust does not transfer personal data outside the European Union (EU)/European Economic Area (EEA). In the event that situations arise in the future where upon transferring of data to third parties, incl. our business partners and service providers, it is possible that your personal data are transmitted to countries outside the EU/EEA which do not ensure the same level of protection as the one ensured by the applicable European legislation, then the transfer of data will be based on a decision of the European Commission (EC) in accordance with applicable law regarding the adequate level of personal data protection or in the absence of such a decision, based on standard contractual clauses of the EU in accordance with the decisions of the EC. You can obtain a copy of these standard contractual clauses by making a request to „Evrotrust Technologies“ AD at the contact details specified in item I.

VIII. Storage period of personal data

‍We undertake to store your personal data only for as long as it is necessary to achieve the purposes of processing.

1. Storage of personal data for compliance with legal obligations

Personal data relating to and/or contained in documents/ information carriers for which there are storage periods prescribed by law, will be stored for the periods provided for in the applicable legislation, unless this Policy provides for a longer storage period for the relevant documents/ information carriers.

2. Storage of personal data contained in correspondence/ communication with us

In the absence of a storage period prescribed by law, the personal data contained in correspondence with us (including, but not limited to, inquiries, requests, complaints, applications, and signals (including free text) and any other communication with us), incl. information on the processing, status and final outcome of this correspondence, will be stored for a period of up to 5 (five) years from the completion of the respective correspondence and the related relations.

As regards the entire communication carried out with regard to the provision of trust services, the Privacy policy applicable to the trust, information, cryptographic and other services provided by “Evrotrust Technologies” AD and terms provided in it and the in the applicable legislation apply.

3. Storage of server and system logs and logs for actions performed on the Website

We store server and system logs typically for a period of up to 1 (one) year.

Logs for statements of intent made on the Website, such as such as acknowledgement of having read this Policy when using the contact form with us, are stored for a period of up to 5 (five) years after the completion of the relevant communication with us. Logs for activities carried out on the Website, such as giving consent, shall be stored for the periods specified in item 4 below.

‍4. Storage of personal data when processed on the basis of consent

When the processing of your personal data is based on consent which is not time-limited, we may continue to process your personal data for the purposes for which you gave given us this consent until you withdraw it or until the final achievement of the purposes for which we process them. You may withdraw your consent at any time. When the consent you have given us for the processing of your personal data is time-limited, we will process the relevant personal data only for the period for which you have given us such consent.

5. Storage of cookies

For detailed information on the storage periods of the various cookies and similar technologies we use, you can refer to our Cookie Policy, published on the Website and accessible from the footer of each of its web pages. If certain information and/or certain documents or information carriers are required by law or other regulation to be stored for a longer period than the ones specified in items 1-6 above, the longer period prescribed by law shall apply to the storing such information. In case of a legal dispute or proceedings requiring the retention of data, and/ or in the case of a request from a competent public authority, it is possible to retain the data for a period longer than the ones specified above until the final settlement of the dispute or conclusion of the proceedings before all instances and for a period of up to 5 (five) years after its conclusion. The periods specified above may be amended if other requirements for retention of information are prescribed by the applicable legislation.

IX. Your rights

As a Data subject within the meaning of the Regulation, you have the following rights, which you can exercise by making a written request to Evrotrust at the contact details specified in item I of this Policy:

Right of information 

(Art.13 and Art. 14GDPR)

You shall have the right to obtain information regarding the processing of your personal data by Evrotrust. This Policy aims to inform you in detail about the processing of your personal data in relation to your use of the Website, as well as your communication with us.

‍Right of access

(Art. 15 GDPR)

You shall have the right to obtain confirmation as to whether your personal data are being processed by Evrotrust when using the Website, to obtain access to such data, as well as information regarding their processing and your rights in relation to this processing.

‍Right of rectification

(Art. 16 GDPR)

You shall have the right to request rectification or completion of your personal data, if the data are inaccurate or incomplete.

‍Right of erasure 

(Art. 17 GDPR)

If the grounds/conditions in the Regulation provided for this are available, you shall have the right to request erasure of your personal data.

‍Right of restriction of processing personal data

(Art. 18 GDPR)

The applicable legislation provides for a possibility to restrict the processing of your personal data, if the grounds provided for this in the Regulation are available.

‍Right of notification of third parties

(Art.19 GDPR)

Where applicable, you shall have the right to require Evrotrust to notify the third parties to whom your personal data have been disclosed, of any rectification, erasure or restriction of the processing of your personal data, unless this proves impossible or involves disproportionate effort on our part.

‍Right of data portability

(Art. 20 GDPR)

You shall have the right to receive the personal data, concerning you and provided by you, in a structured, commonly used, and machine-readable format and to transmit those data to another controller without hindrance on our part. The right of data portability is applied when the following two conditions are met simultaneously: the processing is based on consent or contract; and the processing is carried out by automated means.

Right to a complaint with a supervisory authority

(Art. 77 GDPR)

You shall have the right to lodge a complaint with a supervisory authority, if you consider that the processing of personal data relating to you infringes the applicable legislation on personal data protection. The Supervisory Authority in the Republic of Bulgaria is the Commission for personal data protection, with address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria.

Right to object

You shall have the right at any time and on grounds relating to your particular situation to object to processing of your data processed on the basis of legitimate interest. In case such an objection is received, we shall consider your request and if it is reasonable, we will comply with it. If we believe there are compelling legal grounds for processing, or that it is necessary for the establishment, exercise, or defense legal claims, we will inform you of that.

Privacy notice for job applicants and participants in recruitment processes

Please read this Notice carefully. It contains important information about how we process the personal data of job applicants and participants in recruitment processes (You).

1. Who is the data controller of Your personal data?

The data controller of Your personal data is “Evrotrust Technologies” AD, UIC 203397356, having its seat and registered address at Sofia 1113, Izgrev, Iztok, 2 Nikolay Haytov Str., entr. E, fl. 2, Bulgaria, and address for correspondence at Sofia 1766, Mladost, 251 D Okolovrasten Pat Blvd., “MM BUSINESS CENTER“, fl. 5, Bulgaria, with e-mail address: dpo@evrotrust.com (we/ Evrotrust).

2. What type of personal data do we process during the recruitment process for оur staff?

When applying for a position with us and participating in our recruitment procedures, we may process certain information about You, namely:

(1) Data concerning You and Your contact details: full name; address (permanent, current and correspondence address); e-mail; phone number; information about the position You apply for;

(2) Data concerning Your education and qualifications: resume/CV; cover letter, information contained in documents certifying level of education completed; professional qualifications, professional certification, membership in organisations and additional specialisations; information about the languages You have command of and Your level of fluency; information about Your skills and qualifications (computer skills, technical skills, additional qualifications, certificates and courses);

(3) Data concerning Your professional experience: previous work or other professional experience (including information on the name of a previous employer or other organisation with which You have been contracted, term of employment, place of employment, position held, recommendation letters, etc.); information on the nature and scope of work performed with previous employers, as well as information on current employment and civil contract relations;

(4) Data that became known to us in the course of interviews and tests conducted during the recruitment process, incl. information on requested/proposed remuneration, information generated in the course of performed tests, interviews and any other forms of assessment of the presence of relevant knowledge, skills, competences, qualifications, etc.;

(5) Data from communications carried out with You in connection with Your application and participation in the recruitment process;

(6) Other information included in Your application at Your discretion, including information concerning recommendations; a photo; other data which You have included in Your application at Your own discretion, e.g. information about age; date of birth; information contained in CVs, cover letters, other supporting documentation for the application, etc.;

(7) Information collected and prepared by recruitment agencies, to which Evrotrust has assigned separate stages of or the overall recruitment process, such as considering and assessing applications, conducting interviews, etc. (including data from reports, recommendations, etc., prepared by such agencies);

(8) Information contained in other documents required for the conclusion of an employment or civil contract – e.g. a document certifying the level of education, specialty, qualification, professional certification, scientific title or scientific degree acquired, where such is required for the role or position for which the person applies.

If You are selected and appointed to a relevant position with us, the information and documents provided to us within the application and recruitment process could become part of Your file as an employee or contractor. We will store these documents and information in accordance with the terms for storing data of employees and contractors under civil contract set by us. If You are selected for the relevant position for the purposes of concluding a contract with You (employment or civil contract), it may be necessary that You provide additional information and documents in accordance with the requirements of the applicable law and our internal rules and procedures. In these cases, we will bring to Your attention our Privacy policy for employees and contractors under civil contract of “Evrotrust Technologies” AD.

Information not to be included in Your application:

In case You wish that we do not process the data specified in item (6) above, please do not include such data in Your application. In addition, we explicitly ask You not to include in Your application and send to us any copies of official identification documents – ID, passport, driving license, residence permit.

3. For what purposes and on what grounds do we process Your personal data?

We may process Your personal data for the following purposes and on the following grounds:

(1) Recruitment for a specific position: When You apply for a specific position with us, we process the personal data specified above in order to consider Your application and to assess to what extent Your qualifications and professional experience meet the requirements for that position. The data we process for this purpose include the data You have provided to us in Your application and the data generated during the recruitment process (e.g., data which became known to us during the interview conducted with You). When considering Your application and carrying out the recruitment, we may contact You through the contact details You have provided for the purpose of conducting interviews or clarifying other matters regarding Your application.

For this purpose, we process Your personal data on the basis of Art. 6, Para 1 (b) of Regulation 2016/679 (“GDPR”/ the “Regulation”) – taking the necessary steps before concluding an employment or civil contract with You, and pursuant to Art. 6, Para 1 (f) of GDPR – legitimate interest, where our legitimate interest is to evaluate the compatibility of Your application with the necessary requirements and to carry out recruitment to fill certain vacancies with us.

(2) Exercise and protection of our legitimate rights and interests or those of third parties such as recruitment agencies, employees, members of management bodies, shareholders or counterparties at Evrotrust (including assistance in exercising and protection of legitimate rights and interests of such third parties): In case of complaints, reporting, etc. to the competent state and judicial authorities, we may process the personal data mentioned above to the extent necessary to exercise or protect our rights and interests or to assist our employees, members of management bodies, shareholders or contractors in the exercise and protection of their legal rights and interests.

In these cases, we may process Your Personal data on the basis of Art. 6, Para 1 (f) of GDPR – our legitimate interest in the exercise and defense of legal claims and, accordingly, the legitimate interest of our employees, members of management bodies, shareholders or contractors in the exercise and defense of legal claims.

(3) Compliance with the legal obligations: In certain cases and on the grounds of Art. 6, Para 1 (c) of the GDPR, we may process Your personal data in order also to comply with legal obligations that apply to us, such as the obligation to respond to Your request regarding the protection of Your personal data.

(4) Future recruitment: In case You provide Your prior and explicit consent, we may process Your personal data that were provided in spontaneous application (where no vacancy has been posted) or in application to a vacancy posted by us for the purposes of carrying out future recruitment process. This includes listing You in our database of applicants for future recruiting, assessment of Your suitability for a certain position (including a different one from the position You originally applied for, if any), considering Your application and contacting You in this connection.

In such cases, we will process Your personal data on the grounds of Art. 6, Para 1 (a) of GDPR – Your explicit consent. You have the right to withdraw Your consent at any time without detriment. Withdrawal or refusal to consent does not in any way affect Your participation in the recruitment for the particular position You are applying for.

4. Other sources of personal data

In some cases, personal data processed by us in connection with Your application are not collected or received directly from You, but from third parties such as Recruitment Agencies – e.g. when applying through such agencies, and from public sources, such as public registers, etc.

5. For what period do we store Your personal data?

We will process Your personal data as part of the recruitment process for the position for which Your application is submitted and will store it for a maximum of 6 (six) months after the process is completed. In the event that we have requested You to provide us with originals or notarized copies of documents certifying Your qualifications and professional experience required for the respective position, we will return those documents to You within 6 (six) months of the final completion of the recruitment procedure if You are not approved for appointment.

Where there is an explicit and voluntary written consent on Your part which allows Your data to be processed for a longer period (e.g., for You to be listed in our database of applicants for future recruitment and for participation in future recruitment procedures), we may store this data for up to 2 (two) years from the final completion of the recruitment procedure. If You withdraw Your consent, we will remove Your data from our database and will cease processing Your personal data for future recruitment.

In the event of a legal dispute or proceeding requiring the retention of personal data and/or in the case of a request from a competent public authority, it may be possible that we retain the data for a longer period until the final closure of the proceedings before all instances, as well as for a period of up to 5 (five) years from the date of final completion of that proceeding. Your personal data may also be processed for a longer period than the periods specified above, if this is necessary to achieve the purposes set out in this Notice, or if the legislation in place provides for the processing of the data for a longer period.

6. Who may have access to Your personal data?

Your personal data may be provided to:

• Service providers which process personal data on our behalf such as IT service providers, recruitment agencies, etc. These providers process Your personal data on the grounds of an agreement concluded with us, in strict compliance with our instructions and only to the extent necessary for the performance of the activities assigned to them;

• Postal service providers and telecommunications service providers for the purpose of contacting You;

• Providers of legal and notary services – in case of any need to defend our legitimate interests;

• Competent municipal, state and judicial authorities in accordance with the procedures provided for in the regulations;

• Upon explicit consent – other categories of recipients explicitly specified in the consent.

7. What are Your rights with regard to the processing of Your personal data?

With regard to the processing of Your Personal data by Evrotrust for the purposes specified in this Privacy Notice You have the following rights:

• Right of information: to obtain information regarding the processing of Your personal data on our part. The present notice has been prepared and made available to You with respect to this right.

• Right of access: to obtain confirmation whether personal data relating to You is being processed as well as to obtain access to these data, incl. to request a copy of the data;

• Right of rectification: to request rectification or completion of Your personal data in case the data are inaccurate or incomplete;

• Right of erasure: to request the erasure of Your personal data if there are the grounds for this provided for in the Regulation;

• Right of restriction of processing: to request restriction of processing of Your personal data within the limits provided for in the Regulation, if there are grounds for this;

• Notification of third parties to whom the personal data has been provided, of any rectification, erasure or restriction of processing of personal data unless this is impossible or requires a disproportionate effort on our part;

• Right of data portability (if applicable): to receive the personal data which You have provided to us, in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance if there are the grounds for this provided for in the Regulation;

• Right not to be subject to a decision based solely on automated processing (i.e. without human intervention), including profiling within the meaning of the Regulation. For avoidance of any doubt we do not process Your personal data in this manner.

• Right to withdraw consent for processing, at any time and without detriment, when the processing is based on consent;

• Right to lodge a complaint with a data protection supervising authority in case You consider that the processing of Your Personal data infringes the Regulation or any other applicable requirements for data protection. The data protection supervising authority in the Republic of Bulgaria is the Commission for Personal Data Protection, with its registered address: 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, Bulgaria, Website: https://www.cpdp.bg/ .

• Right to object to processing of Your personal data, which is based on legitimate interest, pursuant to Art. 6 (1) (e) GDPR, as specified above. In the event of such an objection, we will consider Your request and, if it is reasonable, we will comply with it. If we believe that there are compelling legal grounds for processing, or that it is necessary to establish, exercise, or defend legal claims, we will inform You of that.

You may exercise Your rights by submitting a written request to us using the contact details specified above in this Notice in accordance with the requirements of the applicable law.