Personal Data Protection Policy applicable to employees and job applicants
/updated 05.04.2023/
Todos 2004 EOOD, as a data controller, is committed to ensuring, managing and protecting the privacy of personal data provided to us due to job application or commencing employment with us.
In connection with the above-mentioned announcement, we comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), as well as Bulgarian data protection legislation.
1. Who are we?
Todos 2004 EOOD is a Bulgarian company registered under UIC: BG204334978 having its registered office in the Republic of Bulgaria, Burgas, 107, San Stefano Blvd., entrance 3, floor 6
2. What personal data do we collect and for what purpose do we use it?
For the sake of clarity, let us first elucidate what is meant by ‘personal data’ according to the European Commission: “Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data.” Examples of personal data: name and surname, home address, email address, ID number, IP address, etc.
– Identifying personal data: names, date and place of birth, nationality, current address.
– Contact details: email, phone number, postal address.
– Professional or employment-related information:
*Information on completed education, qualification courses and related certificates, professional experience (time in the relevant position, details of former employer, duties performed), references from former or current employer, information on work experience as listed on professional profiles such as LinkedIn.
*Information gathered during interviews (such as interviewer notes, test results, results of personality assessment questionnaires focusing on behaviour, skills, personal characteristics and qualities, carried out as part of the recruitment process).
*Information relating to your current remuneration, including benefits.
*Other information contained in your application that you consider relevant and have included in your CV, cover letter and/or shared during interviews (such as job preferences, willingness to relocate, current salary, expected salary, honours or membership of professional bodies).
For approved job applicants, we require or may require additional information depending on the specifics of the vacant position and the requirements of applicable law for the purposes of entering into an employment contract:
– A medical certificate for commencement of work
– Criminal record in case of liable persons, etc.
Todos 2004 EOOD does not collect personal data relating to racial or ethnic origin, political opinions, processing of genetic data, biometric data for the purpose of unique identification, religious or philosophical beliefs, trade union membership or data concerning the health, sex life or sexual orientation of job applicants or existing employees. We therefore ask that you do not include such information in your applications. If you do provide such information, you consent to Todos 2004 EOOD processing sensitive personal data. This shall be done in strict compliance with legal requirements.
As the data controller of personal data of employees, partners and customers of Todos 2004 EOOD, we use collected personal information solely for the purpose of establishing, verifying and maintaining the employee’s/worker’s contract and for their legitimate interests.
The personal data that Todos 2004 EOOD collects and processes shall be accurate and, where necessary, kept up to date. Personal data shall be erased or rectified where it is found to be inaccurate or not relevant to the purposes for which it is processed. Personal data collected by us shall also be stored and processed for no longer than is necessary to fulfil the purposes for which such personal data was collected, namely:
– For the pre-selection of personnel whose personal qualities, professional experience and qualifications meet the requirements for the vacant position.
– To contact you to arrange an interview, to inform you of the outcome of an interview and to obtain further information about your application.
– To arrange an interview for the purpose of testing your language skills and competencies, motivation, the veracity of the information you have provided regarding education and work experience required for the position for which you have applied.
– Sending a job offer or refusing a joint activity, as well as an offer for another vacant position that would be more suitable for you.
– We shall only send you an offer of a future vacancy or collaboration opportunity if you have previously given us your express consent.
– Testing of devices and internet connection you shall be using while working at home, as well as the working environment, which must meet all safety conditions and requirements.
– For the preparation of the documents necessary to commence work, in cases where an agreement has been reached, and for the organization of the work process.
3. Methods of collecting personal data
3.1 Directly – the personal data collected is sent to us by you in the form of: CV, cover letter, recommendation, certificates and diplomas.
3.2 Indirectly – the data collected has one of the following sources:
-Professional social networks (e.g., LinkedIn) – In this type of social network, you have chosen, through specific settings, what part of your personal information such as work experience, previous employers, professional competencies, etc. to share with other users. Posts relating to your personal life shall not be considered and taken into account when assessing your overall application.
-Recruitment agency – In cases where we use the professional services of a recruitment agency, we may obtain personal information from that company’s employees. Consent to process your data would also need to be provided to the relevant agency.
-Former employers and colleagues – We may obtain your personal data from references from your current and former employers or colleagues in the event that you provide us with such references or if you consent to us contacting such third parties.
-Viewing our database of job candidates – We may review our database of job candidates to conduct research for a suitable candidate in connection with a particular recruitment campaign, in the event that you have consented to us retaining your personal data for future job vacancies or other employment opportunities.
4. Are you obliged to provide personal data?
Providing personal data is voluntary but necessary for the purposes of the recruitment and hiring process. You are under no obligation under applicable law or contract to provide your personal data to Todos 2004 EOOD in the course of the recruitment process. However, in the event that you do not provide us with sufficient information, we may be unable to consider or progress your application.
5. Is your personal data provided to third parties?
We may share personal data with trusted third parties who assist us in carrying out our business activities and providing timely and quality services. These third parties are legally bound to adequately protect the data we entrust to them. We may engage some or all of the following categories of third parties:
– Business partners and clients of Todos 2004 EOOD who are directly involved in the recruitment process for the relevant project;
– Licensed firms, law firms, accountancy firms who prepare documents relating to your appointment;
– Individuals who facilitate the administration of our business or support our infrastructure or services (such as telecommunications providers, postal or transportation services, storage and backup services, data media maintenance or destruction services, cloud software services);
– Employees of government agencies engaged in the inspection of our activities;
– Courts, law enforcement or other governmental and regulatory agencies and entities or other third parties, subject to and in accordance with the provisions of applicable law or applicable regulations;
6. Where and for how long do we store your personal data?
We store personal data on servers located in the European Economic Area (EEA). Regardless of location, Todos 2004 EOOD is committed to protecting your data with the best precautions and in accordance with applicable law. As a partner of large international companies, we may transfer some data to companies outside the EEA provided that we have a valid business reason for such transfer. In this case, our organisation undertakes to adequately protect personal data using standard contractual clauses in a format approved by the European Commission, amongst other measures to ensure adequacy, ensuring that your data protection rights travel with your data.
Todos 2004 EOOD shall retain and process the personal data collected for no longer than is necessary to fulfil the purposes for which such data was collected. How long we keep your data depends on the type of data and the purpose for which it is being processed.
7. What are your rights under data protection law and how can you exercise them?
– Right to information and access to your personal data processed by Todos 2004 EOOD – you can request information about the personal information we collect, use or disclose. You have the right to know about the personal information we have collected about you in the last twelve months.
– Right to rectification of inaccurate personal data processed by Todos 2004 EOOD – you may request that we rectify the data we have recorded about you in the event of inaccurate or incomplete information.
– Right to erasure of personal data (right to be forgotten) – you have the right to request that we erase all information about you held in our database. In certain circumstances, we may not be able to delete your personal information, for example, to comply with legal obligations or to complete a business transaction you have requested.
– Right to restrict the processing of personal data – You may request that we temporarily restrict the processing of your personal data if you dispute its accuracy, prefer to restrict the processing of the data rather than ask us to delete it, or wish us to retain it for you for the purpose of establishing, exercising or defending legal claims. We may temporarily restrict the processing of your personal data until we have established whether we have legitimate grounds for processing it which override your rights. You may request that we notify you before lifting the temporary restriction on processing.
– Right to data portability – In some cases, where you have provided us with your personal data, you may require us to transfer that personal data directly to another company where this is technically feasible.
– Right to object – You may object to the use of your personal data if we are no longer entitled to use it. In these cases, we shall not continue to process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
– Right to withdraw consent to data processing – you have the right to withdraw your consent to the processing of your personal data at any time.
You can exercise your rights listed above by sending us a written request to our Data Protection Officer – Stefan Hristov, by email: dpo@todosconsulting.com or to: Burgas, 107, San Stefano Blvd. entrance 3, floor 6.
You have the right to file a complaint with the Personal Data Protection Commission and report your concerns about the way we process personal data as follows:
Post address: Sofia 1592, 2, Prof. Tsvetan Lazarov Blvd.
Telephone number: + 359 (2) 91-53-518
E-mail: kzld@cpdp.bg
Website: www.cpdp.bg
8. Changes to this privacy policy
Todos 2004 EOOD reserves the right to make changes to this text, which shall be updated and published on our official website in due course.
Where we make changes, we shall indicate the date of the last update at the top of this document.